@animalabs/context-manager 0.5.5 → 0.5.10

package/src/strategies/autobiographical.ts

@@ -87,7 +87,12 @@ function formatInstruction(targetTokens: number): string {
     'Preserve concrete details — file paths, exact values, decisions, ' +
     `unresolved questions, the user\'s active asks. Target ~${targetTokens} ` +
     'tokens. Output only the memory body — no preamble, no section headers ' +
-    'unless they help preservation, no meta-commentary about summarizing.'
+    'unless they help preservation, no meta-commentary about summarizing. ' +
+    'Memorize only what actually happened in that slice: if it holds little ' +
+    'beyond routine system traffic (heartbeats, empty turns, failure ' +
+    'notices), a short memory saying so is correct — do not pad it by ' +
+    're-narrating events you already remember from earlier as if they had ' +
+    'just happened again.'
   );
 }
 
@@ -231,6 +236,36 @@ export interface Chunk {
   summaryId?: string;
   /** Phase type tag (set by KnowledgeStrategy for semantic chunking) */
   phaseType?: string;
+  /** ID of the persisted ChunkRecord backing this chunk (chunk persistence). */
+  recordId?: string;
+}
+
+/**
+ * Persisted chunk boundary, one per CLOSED chunk, stored in the
+ * `autobio:chunks` chronicle state slot (append_log, branch-aware).
+ *
+ * Records OWN the past: once a chunk closes, its membership is a persisted
+ * fact — rebuilds and restarts materialize chunks from records instead of
+ * recomputing boundaries from the running token sum. This is the fix for the
+ * 2026-07 re-consolidation storms: boundary inputs (config knobs, head
+ * window, token estimates, message mutations) could shift across restarts,
+ * the old exact-sourceIds-match recovery then failed, and whole stretches of
+ * already-summarized history were re-compressed into duplicate L1s.
+ *
+ * Membership is by message ID (never index), so edits/redactions degrade a
+ * record gracefully instead of re-keying its neighbors.
+ */
+export interface ChunkRecord {
+  /** Stable record id ("c-<n>"). */
+  id: string;
+  /** Exact message IDs of the closed chunk, in order. */
+  sourceIds: string[];
+  /** Whether the chunk's L1 summary has been produced. */
+  compressed: boolean;
+  /** ID of the L1 SummaryEntry, once compressed. */
+  summaryId?: string;
+  /** Phase type tag (KnowledgeStrategy semantic chunking). */
+  phaseType?: string;
 }
 
 /**
@@ -269,6 +304,40 @@ function normalizePinLevels(opts?: PinLevelOptions): { level?: number; maxLevel?
   return maxLevel !== undefined ? { maxLevel } : {};
 }
 
+/**
+ * Drop empty text blocks (`{type:'text', text:''}` or whitespace-only). The
+ * Anthropic API rejects them with 400 "text content blocks must be non-empty",
+ * which — thrown inside the speculative-compression drain — halts ALL
+ * compression. Non-text blocks (tool_use/tool_result/image) pass through
+ * unchanged, so tool pairing is preserved; callers drop any message left with
+ * an empty content array.
+ */
+function stripEmptyTextBlocks(content: ContentBlock[]): ContentBlock[] {
+  return content.filter((b) => {
+    if (b.type !== 'text') return true;
+    const text = (b as { text?: unknown }).text;
+    return typeof text === 'string' && text.trim().length > 0;
+  });
+}
+
+/**
+ * Strip `thinking` / `redacted_thinking` blocks from compression INPUT.
+ *
+ * The summarizer must never be handed the agent's own reasoning:
+ *  (a) signed thinking is only valid verbatim in the turn that produced it —
+ *      replaying it into a rewritten summarize request corrupts the signature;
+ *  (b) asking the model to summarize its own reasoning reads as reproducing /
+ *      duplicating model output → `reasoning_extraction` refusal, which returns
+ *      empty (→ "empty L1 summary, chunk left raw") or, worse, produces a
+ *      summary that reproduces the reasoning as text — which then trips the
+ *      SAME classifier on the MAIN thread once that summary is rendered.
+ * Thinking is scratch work, not history (the same rationale already applied to
+ * the summarizer's OUTPUT). Drop it from the input too.
+ */
+function stripThinkingBlocks(content: ContentBlock[]): ContentBlock[] {
+  return content.filter((b) => b.type !== 'thinking' && b.type !== 'redacted_thinking');
+}
+
 /**
  * Autobiographical chunking strategy.
  * Compresses old conversation chunks into summaries in the model's own words.
@@ -297,6 +366,32 @@ export class AutobiographicalStrategy implements ResettableStrategy {
    */
   protected _drainProgress = 0;
 
+  /**
+   * Chunks (keyed by their LAST message id — chunk membership is immutable
+   * once closed) whose L1 was explicitly demanded by a picker `produce` op.
+   * Demanded chunks bypass the `l1HoldbackChunks` window in `rebuildChunks`:
+   * speculation waits, demand doesn't. Entries become inert once the chunk
+   * compresses (compressed chunks are never re-queued), so no cleanup needed.
+   */
+  protected _demandedL1Chunks = new Set<MessageId>();
+
+  /**
+   * In-memory mirror of the persisted chunk records (autobio:chunks slot).
+   * Loaded in `loadPersistedState`, appended to when a chunk closes,
+   * updated by ID when its L1 lands.
+   */
+  protected chunkRecords: ChunkRecord[] = [];
+  protected chunkIdCounter = 0;
+  /**
+   * Fail-closed latch: set when most persisted records resolve to zero live
+   * messages (the messages-chain-break signature). While set, NO compression
+   * runs — duplicate memories are strictly worse than delayed compression.
+   */
+  protected chunkRecordsOrphaned = false;
+  private _orphanWarned = false;
+  /** Record ids whose compression was refused by the L1 overlap guard. */
+  private _overlapBlocked = new Set<string>();
+
   // Hierarchical state
   protected summaries: SummaryEntry[] = [];
   protected summaryIdCounter = 0;
@@ -313,11 +408,13 @@ export class AutobiographicalStrategy implements ResettableStrategy {
   /** Namespace for state-id scoping. Set in `initialize()`. */
   protected ns: string = '';
   protected get summariesStateId(): string { return `${this.ns}/autobio:summaries`; }
+  protected get chunksStateId(): string { return `${this.ns}/autobio:chunks`; }
   protected get counterStateId(): string { return `${this.ns}/autobio:counter`; }
   protected get mergeQueueStateId(): string { return `${this.ns}/autobio:mergeQueue`; }
   protected get pinsStateId(): string { return `${this.ns}/autobio:pins`; }
   protected get resolutionsStateId(): string { return `${this.ns}/autobio:resolutions`; }
   protected get locksStateId(): string { return `${this.ns}/autobio:locks`; }
+  protected get calibrationStateId(): string { return `${this.ns}/autobio:calibration`; }
 
   /** Protected ranges (pins + documents). Loaded from chronicle in initialize. */
   protected pins: ProtectedRange[] = [];
@@ -465,7 +562,117 @@ export class AutobiographicalStrategy implements ResettableStrategy {
         break;
       }
     }
+    // Legacy stores (pre chunk-persistence) have L1 summaries but no chunk
+    // records — synthesize records from L1 sourceIds before the first
+    // rebuild, so covered ground is owned and never re-compressed.
+    this.migrateChunkRecords(ctx.messageStore);
     this.rebuildChunks(ctx.messageStore);
+    // Kick the merge ladder for pre-existing unmerged summaries. Normally a
+    // compression/merge completion does this, but a store that boots with a
+    // backlog above threshold and an empty queue (e.g. after a pyramid
+    // repair pruned duplicates and un-merged survivors) would otherwise
+    // never start consolidating. Idempotent: already-queued/merged sources
+    // are skipped.
+    if (this.config.hierarchical && !this.chunkRecordsOrphaned) {
+      this.checkMergeThreshold();
+    }
+  }
+
+  /**
+   * Whether chunk boundaries are persisted to the `autobio:chunks` slot and
+   * own the past. Subclasses with their own chunking (KnowledgeStrategy's
+   * semantic phases) opt out and keep the legacy recompute-every-rebuild
+   * behavior.
+   */
+  protected get chunkPersistenceEnabled(): boolean {
+    return true;
+  }
+
+  /**
+   * One-time lazy migration: a store with L1 summaries but an empty chunks
+   * slot predates chunk persistence. Each L1's sourceIds ARE the historical
+   * chunk boundary — synthesize a compressed record per L1, in message
+   * order. Stale generations from the old partial-tail compression bug
+   * (an L1 whose messages are ALL already covered by records synthesized so
+   * far — prefix families, same-range duplicates) get NO record; coverage is
+   * what blocks re-compression, and the repair tooling prunes their content
+   * separately.
+   */
+  protected migrateChunkRecords(store: MessageStoreView): void {
+    if (!this.chunkPersistenceEnabled || !this.store) return;
+    if (this.chunkRecords.length > 0) return;
+    const l1s = this.summaries.filter(s => s.level === 1 && Array.isArray(s.sourceIds) && s.sourceIds.length > 0);
+    if (l1s.length === 0) return;
+
+    const msgIndex = new Map<string, number>();
+    store.getAll().forEach((m, i) => msgIndex.set(m.id, i));
+
+    // Sort by (start position asc, span length desc) so at each starting
+    // point the LONGEST generation claims the ground first.
+    const sorted = [...l1s].sort((a, b) => {
+      const sa = msgIndex.get(a.sourceIds[0]) ?? Number.MAX_SAFE_INTEGER;
+      const sb = msgIndex.get(b.sourceIds[0]) ?? Number.MAX_SAFE_INTEGER;
+      return sa - sb || b.sourceIds.length - a.sourceIds.length;
+    });
+
+    const covered = new Set<string>();
+    let skippedStale = 0;
+    let skippedGhost = 0;
+    for (const s of sorted) {
+      // An L1 none of whose messages exist anymore can't own live ground.
+      if (!s.sourceIds.some(id => msgIndex.has(id))) { skippedGhost++; continue; }
+      // Fully-covered = stale generation / contained duplicate.
+      if (s.sourceIds.every(id => covered.has(id))) { skippedStale++; continue; }
+      for (const id of s.sourceIds) covered.add(id);
+      this.appendChunkRecord({
+        id: `c-${this.chunkIdCounter++}`,
+        sourceIds: [...s.sourceIds],
+        compressed: true,
+        summaryId: s.id,
+        ...(s.phaseType ? { phaseType: s.phaseType } : {}),
+      });
+    }
+    console.warn(
+      `[autobiographical] chunk-persistence migration: ${l1s.length} L1s → ` +
+      `${this.chunkRecords.length} records (${skippedStale} stale generations, ` +
+      `${skippedGhost} fully-orphaned L1s skipped)`,
+    );
+  }
+
+  /** Append a record to the chunks slot + in-memory mirror. */
+  protected appendChunkRecord(record: ChunkRecord): void {
+    this.chunkRecords.push(record);
+    this.store?.appendToStateJson(this.chunksStateId, record);
+  }
+
+  /**
+   * Mark a chunk's record compressed, linking its L1. Resolves the log slot
+   * by ID against the persisted array — never by in-memory index (see
+   * setMergedInto for the clobber this avoids).
+   */
+  protected markChunkRecordCompressed(recordId: string | undefined, summaryId: string): void {
+    if (!this.chunkPersistenceEnabled || !recordId) return;
+    const rec = this.chunkRecords.find(r => r.id === recordId);
+    if (!rec) return;
+    rec.compressed = true;
+    rec.summaryId = summaryId;
+    if (!this.store) return;
+    const stored = this.store.getStateJson(this.chunksStateId);
+    if (!Array.isArray(stored)) return;
+    const payload = Buffer.from(JSON.stringify(rec));
+    let found = false;
+    for (let i = 0; i < stored.length; i++) {
+      const item = stored[i] as ChunkRecord | null;
+      if (item && item.id === recordId) {
+        this.store.editStateItem(this.chunksStateId, i, payload);
+        found = true;
+      }
+    }
+    if (!found) {
+      console.warn(
+        `[autobiographical] markChunkRecordCompressed: ${recordId} not found in persisted chunk log`,
+      );
+    }
   }
 
   /**
@@ -483,6 +690,16 @@ export class AutobiographicalStrategy implements ResettableStrategy {
         fullSnapshotEvery: 10,
       });
     } catch { /* already registered */ }
+    if (this.chunkPersistenceEnabled) {
+      try {
+        this.store.registerState({
+          id: this.chunksStateId,
+          strategy: 'append_log',
+          deltaSnapshotEvery: 50,
+          fullSnapshotEvery: 10,
+        });
+      } catch { /* already registered */ }
+    }
     try {
       this.store.registerState({
         id: this.counterStateId,
@@ -501,6 +718,12 @@ export class AutobiographicalStrategy implements ResettableStrategy {
         strategy: 'snapshot',
       });
     } catch { /* already registered */ }
+    try {
+      this.store.registerState({
+        id: this.calibrationStateId,
+        strategy: 'snapshot',
+      });
+    } catch { /* already registered */ }
     // Adaptive-resolution state slots — only registered when the flag is on
     // so chronicles without the flag don't accumulate unused slots.
     if (this.config.adaptiveResolution) {
@@ -531,10 +754,91 @@ export class AutobiographicalStrategy implements ResettableStrategy {
       this.mergeQueue = [];
       this.pins = [];
       this.pinIdCounter = 0;
+      this.chunkRecords = [];
+      this.chunkIdCounter = 0;
       return;
     }
+
+    if (this.chunkPersistenceEnabled) {
+      const records = this.store.getStateJson(this.chunksStateId);
+      this.chunkRecords = (Array.isArray(records) ? (records as ChunkRecord[]) : [])
+        .filter(r => r && typeof r.id === 'string' && Array.isArray(r.sourceIds) && r.sourceIds.length > 0);
+      this.chunkIdCounter = this.chunkRecords.reduce((max, r) => {
+        const n = Number(r.id.replace(/^c-/, ''));
+        return Number.isFinite(n) && n >= max ? n + 1 : max;
+      }, 0);
+      this.chunkRecordsOrphaned = false;
+      this._orphanWarned = false;
+      this._overlapBlocked.clear();
+    }
     const summaries = this.store.getStateJson(this.summariesStateId);
-    this.summaries = Array.isArray(summaries) ? (summaries as SummaryEntry[]) : [];
+    const loaded = Array.isArray(summaries) ? (summaries as SummaryEntry[]) : [];
+    // Drop empty-content summaries (bugged/empty generations from before the
+    // production guards). Recalling or merging one yields an empty text block →
+    // Anthropic 400 "content must be non-empty". Never let them re-enter memory.
+    const nonEmpty = loaded.filter(s => s && typeof s.content === 'string' && s.content.trim().length > 0);
+    const droppedEmpty = loaded.length - nonEmpty.length;
+    const removedEmptyIds = new Set(
+      loaded
+        .filter(s => s && (typeof s.content !== 'string' || s.content.trim().length === 0))
+        .map(s => s.id),
+    );
+    if (droppedEmpty > 0) console.warn(`[autobiographical] dropped ${droppedEmpty} empty summary(ies) on load`);
+    // Dedupe by id, keeping the copy with mergedInto set (position of first
+    // occurrence preserved). Duplicate-id copies with diverging merge state
+    // exist in stores touched by the pre-fix setMergedInto index-desync bug;
+    // without dedupe, the plain copy stays on the unmerged frontier and its
+    // content renders twice (once itself, once via its parent's merge).
+    const byId = new Map<string, SummaryEntry>();
+    for (const s of nonEmpty) {
+      const prev = byId.get(s.id);
+      if (!prev) byId.set(s.id, s);
+      else if (!prev.mergedInto && s.mergedInto) byId.set(s.id, s);
+    }
+    const dupes = nonEmpty.length - byId.size;
+    if (dupes > 0) console.warn(`[autobiographical] deduped ${dupes} duplicate summary id(s) on load`);
+    // Dropping an invalid parent is only half the repair. Its children may
+    // still carry `mergedInto: <dropped-id>`, which makes them simultaneously
+    // unavailable to the picker (no parent to render) and ineligible for a
+    // replacement merge (they still look merged). Clear every dangling edge
+    // and persist the canonicalized array so the poison does not return on
+    // every restart.
+    let danglingParents = 0;
+    this.summaries = [...byId.values()].map((summary) => {
+      if (!summary.mergedInto || byId.has(summary.mergedInto)) return summary;
+      danglingParents++;
+      const { mergedInto: _dropped, ...repaired } = summary;
+      return repaired as SummaryEntry;
+    });
+    if (droppedEmpty > 0 || dupes > 0 || danglingParents > 0) {
+      this.store.setStateJson(this.summariesStateId, this.summaries);
+      console.warn(
+        `[autobiographical] repaired summary state: removed ${droppedEmpty} empty, ` +
+          `deduped ${dupes}, cleared ${danglingParents} dangling parent pointer(s)`,
+      );
+    }
+
+    // An invalid L1 may also be referenced by a persisted chunk record. Make
+    // that chunk compressible again instead of leaving it permanently marked
+    // complete with no summary behind it.
+    if (this.chunkPersistenceEnabled && this.chunkRecords.length > 0) {
+      const validL1Ids = new Set(this.summaries.filter(s => s.level === 1).map(s => s.id));
+      let repairedChunkRecords = 0;
+      this.chunkRecords = this.chunkRecords.map((record) => {
+        if (!record.compressed || (record.summaryId && validL1Ids.has(record.summaryId))) {
+          return record;
+        }
+        repairedChunkRecords++;
+        const { summaryId: _dropped, ...rest } = record;
+        return { ...rest, compressed: false };
+      });
+      if (repairedChunkRecords > 0) {
+        this.store.setStateJson(this.chunksStateId, this.chunkRecords);
+        console.warn(
+          `[autobiographical] repaired ${repairedChunkRecords} chunk record(s) with missing L1 summaries`,
+        );
+      }
+    }
 
     const counter = this.store.getStateJson(this.counterStateId);
     this.summaryIdCounter = typeof counter === 'number' ? counter : 0;
@@ -543,6 +847,15 @@ export class AutobiographicalStrategy implements ResettableStrategy {
     this.mergeQueue = Array.isArray(queue)
       ? (queue as Array<{ level: SummaryLevel; sourceIds: string[] }>)
       : [];
+    const validMergeQueue = this.mergeQueue.filter(
+      merge => !merge.sourceIds.some(id => removedEmptyIds.has(id) && !byId.has(id)),
+    );
+    if (validMergeQueue.length !== this.mergeQueue.length) {
+      const removed = this.mergeQueue.length - validMergeQueue.length;
+      this.mergeQueue = validMergeQueue;
+      this.store.setStateJson(this.mergeQueueStateId, this.mergeQueue);
+      console.warn(`[autobiographical] removed ${removed} merge queue item(s) with missing sources`);
+    }
 
     const pinsState = this.store.getStateJson(this.pinsStateId);
     if (pinsState && typeof pinsState === 'object' && Array.isArray((pinsState as { pins?: unknown }).pins)) {
@@ -813,6 +1126,11 @@ export class AutobiographicalStrategy implements ResettableStrategy {
    * Single point so subclasses inherit persistence.
    */
   protected pushSummary(entry: SummaryEntry): void {
+    if (typeof entry.content !== 'string' || entry.content.trim().length === 0) {
+      throw new Error(
+        `[autobiographical] refusing to persist empty summary ${entry.id} at L${entry.level}`,
+      );
+    }
     this.summaries.push(entry);
     this.store?.appendToStateJson(this.summariesStateId, entry);
   }
@@ -857,13 +1175,30 @@ export class AutobiographicalStrategy implements ResettableStrategy {
   protected setMergedInto(entry: SummaryEntry, mergedIntoId: string): void {
     entry.mergedInto = mergedIntoId;
     if (!this.store) return;
-    const index = this.summaries.indexOf(entry);
-    if (index < 0) return;
-    this.store.editStateItem(
-      this.summariesStateId,
-      index,
-      Buffer.from(JSON.stringify(entry)),
-    );
+    // Resolve the log position by ID against the PERSISTED array — never by
+    // in-memory index. `loadPersistedState` filters empty-content summaries
+    // out of `this.summaries` while they remain in the log, so after a reload
+    // the in-memory index is shifted relative to the log slot. Editing by
+    // in-memory index wrote merge-updates onto NEIGHBORING entries, silently
+    // clobbering them (4 summaries lost in the 2026-07 Lena incident, leaving
+    // duplicate-id copies with diverging mergedInto). Update every stored
+    // copy with this id so past duplicates converge too.
+    const stored = this.store.getStateJson(this.summariesStateId);
+    if (!Array.isArray(stored)) return;
+    let found = false;
+    const payload = Buffer.from(JSON.stringify(entry));
+    for (let i = 0; i < stored.length; i++) {
+      const item = stored[i] as SummaryEntry | null;
+      if (item && item.id === entry.id) {
+        this.store.editStateItem(this.summariesStateId, i, payload);
+        found = true;
+      }
+    }
+    if (!found) {
+      console.warn(
+        `[autobiographical] setMergedInto: ${entry.id} not found in persisted summary log — merge state not persisted`,
+      );
+    }
   }
 
   /**
@@ -959,6 +1294,10 @@ export class AutobiographicalStrategy implements ResettableStrategy {
     }
     for (const chunk of candidates) {
       if (chunk.compressed) continue;
+      // Demand path: mark the chunk so the l1HoldbackChunks window in
+      // rebuildChunks never filters it back out of the queue.
+      const lastId = chunk.messages[chunk.messages.length - 1]?.id;
+      if (lastId !== undefined) this._demandedL1Chunks.add(lastId);
       if (this.compressionQueue.includes(chunk.index)) continue;
       this.compressionQueue.push(chunk.index);
     }
@@ -1280,6 +1619,14 @@ export class AutobiographicalStrategy implements ResettableStrategy {
   // snapshot, so it reflects what the last compile actually rendered rather than
   // re-deriving the full pyramid (which, under adaptive resolution, bears little
   // resemblance to the folded output).
+  //
+  // CAVEAT: the final structural passes (`trimOrphanedToolUse`,
+  // `enforceToolPairing`) run AFTER the per-entry tallies and BEFORE `rsEnd()`,
+  // and are NOT reflected in the snapshot. Trims only remove entries (total
+  // over-counts by at most the trimmed tail); the pairing validator can also
+  // ADD stub tool_result entries (total then under-counts by those stubs).
+  // Both deltas are a handful of tokens — the stats describe the selection, not
+  // the byte-exact wire payload. Do not treat `total` as an exact wire count.
   // ===========================================================================
   private _rs: RenderStats | null = null;
   private _lastRenderStats: RenderStats | null = null;
@@ -1413,16 +1760,20 @@ export class AutobiographicalStrategy implements ResettableStrategy {
     msgCap: number,
     maxTokens: number,
     totalTokensBefore: number,
+    // Post-strip per-message estimates (2026-07-12): eviction must price a
+    // message the way the stripped render will. Raw pricing counted every
+    // stripped image at full cost and evicted most of an image-era tail the
+    // recent-window walk had correctly admitted (mythos: 601-message tail
+    // admitted, 228 survived eviction, 45k rendered of a 120k window).
+    pse?: number[],
   ): { messages: number; tokens: number } {
     if (recentStart >= messages.length) return { messages: 0, tokens: 0 };
 
+    const est = (i: number): number => pse?.[i] ?? store.estimateTokens(messages[i]);
     const accepted: number[] = [];
     let acceptedTokens = 0;
     for (let i = messages.length - 1; i >= recentStart; i--) {
-      const msg = messages[i];
-      const tokens = msgCap > 0
-        ? Math.min(store.estimateTokens(msg), msgCap + 50)
-        : store.estimateTokens(msg);
+      const tokens = msgCap > 0 ? Math.min(est(i), msgCap + 50) : est(i);
       if (this.isOverBudget(totalTokensBefore + acceptedTokens + tokens, maxTokens)) break;
       accepted.push(i);
       acceptedTokens += tokens;
@@ -1442,9 +1793,7 @@ export class AutobiographicalStrategy implements ResettableStrategy {
     for (const i of accepted) {
       const msg = messages[i];
       const content = msgCap > 0 ? this.truncateContent(msg.content, msgCap) : msg.content;
-      const tokens = msgCap > 0
-        ? Math.min(store.estimateTokens(msg), msgCap + 50)
-        : store.estimateTokens(msg);
+      const tokens = msgCap > 0 ? Math.min(est(i), msgCap + 50) : est(i);
       entries.push({
         index: entries.length,
         sourceMessageId: msg.id,
@@ -1508,30 +1857,194 @@ export class AutobiographicalStrategy implements ResettableStrategy {
       throw new Error('No membrane instance for compression');
     }
 
+    // ---- Duplicate-formation guards (layered) ----
+    // Merged from two independent fixes for the same disease:
+    //
+    // 1. EXACT MATCH → adopt (bug 6.10, Tengro). rebuildChunks (fired by
+    //    onNewMessage / select) can re-queue a span whose compression already
+    //    completed against a stale chunk object — or, under chunk
+    //    persistence, a crash between the L1 append and the record edit
+    //    leaves a record uncompressed with its summary already in the log.
+    //    Adopt the existing summary, skip the LLM call, and heal the record.
+    const chunkIdKey = this.chunkKey(chunk);
+    const exactExisting = this.summaries.find(
+      s => s.level === 1 && s.sourceIds.join(':') === chunkIdKey
+    );
+    if (exactExisting) {
+      chunk.compressed = true;
+      chunk.summaryId = exactExisting.id;
+      this.markChunkRecordCompressed(chunk.recordId, exactExisting.id);
+      return;
+    }
+
+    const coveredByL1 = new Set<string>();
+    for (const s of this.summaries) {
+      if (s.level === 1 && Array.isArray(s.sourceIds)) {
+        for (const id of s.sourceIds) coveredByL1.add(id);
+      }
+    }
+
+    // 2. FULLY COVERED (non-exact) → drop rather than duplicate history
+    //    (bug 6.10, Tengro): boundaries shifted across a rebuild and every
+    //    message is already inside some L1. Marking compressed WITHOUT a
+    //    summaryId means the uncompressed-middle fallback skips these
+    //    messages — they render only via the covering L1s. Safe while
+    //    `recentStart` advances monotonically (a fully-covered OLD chunk
+    //    can't intersect the recent-exclusion window); if that assumption is
+    //    ever weakened, reinstate a raw fallback (chunk-level `coveredBy`)
+    //    rather than dropping. The chunk record (if any) is deliberately
+    //    left uncompressed as an operator breadcrumb.
+    if (chunk.messages.length > 0 && chunk.messages.every(m => coveredByL1.has(m.id))) {
+      console.warn(
+        `[autobiographical] dedup guard: chunk ${chunk.recordId ?? `#${chunk.index}`} ` +
+        `is fully covered by existing L1s under different boundaries — dropped, not re-compressed.`,
+      );
+      chunk.compressed = true;
+      return;
+    }
+
+    // 3. PARTIAL OVERLAP → refuse (strict; chunk persistence). With
+    //    close-then-compress there is NO legitimate way for a chunk to
+    //    partially overlap an existing L1's span. If it happens anyway
+    //    (bookkeeping bug, store surgery gone wrong), refuse to produce:
+    //    a warning in the log is strictly better than a duplicate memory
+    //    in an agent's head.
+    const overlapIds = chunk.messages.filter(m => coveredByL1.has(m.id)).map(m => m.id);
+    if (overlapIds.length > 0) {
+      const key = chunk.recordId ?? chunkIdKey;
+      if (!this._overlapBlocked.has(key)) {
+        this._overlapBlocked.add(key);
+        console.error(
+          `[autobiographical] OVERLAP GUARD: refusing to compress chunk ` +
+          `${chunk.recordId ?? `#${chunk.index}`} — ${overlapIds.length}/${chunk.messages.length} ` +
+          `of its messages are already covered by existing L1 summaries ` +
+          `(first: ${overlapIds[0]}). Duplicate-memory formation blocked; ` +
+          `investigate before resuming this span.`,
+        );
+      }
+      return;
+    }
+
     const targetTokens = this.config.summaryTargetTokens ?? 2000;
     const agentParticipant = this.config.summaryParticipant ?? 'Claude';
 
+    // ---- 0. Thin-chunk guard ----
+    // A chunk of silent/skip turns and bare system traffic gives the
+    // summarizer nothing to remember. Asked anyway, it confabulates: it
+    // reaches for the nearest salient content (head window, prior recall
+    // pairs) and narrates it as if it just happened — each such L1 then
+    // compounds through merges (the "68 initiations" incident). Store a
+    // mechanical stub without an LLM call instead. Chunks with any
+    // non-text blocks (tool cycles, images) are never stubbed.
+    const minChunkChars = this.config.minChunkCharsForLLM ?? 200;
+    if (minChunkChars > 0) {
+      let substantiveChars = 0;
+      let hasNonText = false;
+      for (const m of chunk.messages) {
+        for (const b of m.content) {
+          if (b.type === 'text') substantiveChars += b.text.trim().length;
+          else hasNonText = true;
+        }
+      }
+      if (!hasNonText && substantiveChars < minChunkChars) {
+        const messageIds = chunk.messages.map(m => m.id);
+        const stub: SummaryEntry = {
+          id: `L1-${this.nextSummaryIdCounter()}`,
+          level: 1,
+          content:
+            `(A quiet stretch: ${chunk.messages.length} messages of routine ` +
+            `system traffic — heartbeats, empty turns, notices. Nothing ` +
+            `happened worth remembering.)`,
+          tokens: 40,
+          sourceLevel: 0,
+          sourceIds: messageIds,
+          sourceRange: { first: messageIds[0], last: messageIds[messageIds.length - 1] },
+          created: Date.now(),
+          phaseType: chunk.phaseType,
+        };
+        this.pushSummary(stub);
+        chunk.compressed = true;
+        chunk.summaryId = stub.id;
+        this.markChunkRecordCompressed(chunk.recordId, stub.id);
+        this._compressionCount++;
+        logCompressionCall({
+          operation: 'compress_l1',
+          system: null,
+          messages: [],
+          metadata: {
+            stub: true,
+            chunk_message_ids: messageIds,
+            chunk_size: chunk.messages.length,
+            substantive_chars: substantiveChars,
+            min_chunk_chars: minChunkChars,
+            summary_id: stub.id,
+          },
+          response: stub.content,
+        });
+        this.checkMergeThreshold();
+        return;
+      }
+    }
+
     // Build the KV-preserving prompt per hermes-autobio spec:
     //
-    //   1. Prior summaries — narrativized as CM-asks / agent-recalls
+    //   1. Head — the raw chronicle opening (identity anchor), FIRST,
+    //      exactly where the original instance saw it. It MUST precede
+    //      the recall pairs: when it followed them (pre-2026-07 order),
+    //      it read as the most recent live conversation, and for thin
+    //      chunks the summarizer narrated the head as fresh events
+    //      ("Antra came to me to explore the transformation story
+    //      again…"), compounding across merges into runaway false
+    //      memories (the "68 initiations" incident). Chronological
+    //      order is also the KV-stable order — the head never changes.
+    //      (executeMerge always had head-first; this site was the odd
+    //      one out.)
+    //   2. Prior summaries — narrativized as CM-asks / agent-recalls
     //      pairs, in source order. The unmerged frontier of the
     //      summary forest: any summary that has not yet been merged
     //      into a higher level. After merges run, the L_{k+1} replaces
     //      its L_k children — using the children plus their parent
     //      doubles the prompt size unboundedly.
-    //   2. Head — raw messages before the chunk that aren't already
-    //      represented by a prior summary.
-    //   3. Marker — in-band signal that a memory is about to form.
-    //   4. Chunk — raw messages being compressed, as the agent
+    //   3. Raw middle — messages between head and chunk not covered by
+    //      any summary (usually empty).
+    //   4. Marker — in-band signal that a memory is about to form.
+    //   5. Chunk — raw messages being compressed, as the agent
     //      experienced them.
-    //   5. Instruction — doc-aware if the chunk is part of a bodyGroup.
+    //   6. Instruction — doc-aware if the chunk is part of a bodyGroup.
     //
     // There is intentionally NO tail_after_chunk: that would leak
     // future information into the model's KV state and corrupt the
     // as-of framing of memory formation.
     const llmMessages: Array<{ participant: string; content: ContentBlock[] }> = [];
 
-    // ---- 1. Prior recall pairs ----
+    // ---- 1. Head window (raw, ALWAYS present, FIRST) ----
+    //
+    // The head is the foundational identity anchor: the actual opening
+    // of the chronicle (the user's first message, the agent's first
+    // reply, the system context if any). It establishes WHO is speaking
+    // to WHOM. Without it, when the chunk content is heavily first-person
+    // from someone other than the agent (e.g., a user-shared document),
+    // the agent loses its first-person grounding and drifts into the
+    // content author's voice.
+    //
+    // The head is the configured head window — not "everything before
+    // the chunk." For doc-heavy chronicles, "everything before" would
+    // be hundreds of thousands of tokens; the recall pairs below
+    // represent that intermediate content. The head is just the
+    // permanent prefix that the original instance always saw.
+    //
+    // Head messages are excluded from compression by `getCompressibleMessages`
+    // (they're outside the chunking range), so they won't appear in
+    // any L1's sourceIds — no overlap with the recall pairs below.
+    const allMessages = ctx.messageStore.getAll();
+    const headStartIdx = this.getHeadWindowStartIndex(ctx.messageStore);
+    const headEndIdx = this.getHeadWindowEnd(ctx.messageStore);
+    for (let i = headStartIdx; i < headEndIdx && i < allMessages.length; i++) {
+      const m = allMessages[i];
+      llmMessages.push({ participant: m.participant, content: m.content });
+    }
+
+    // ---- 2. Prior recall pairs ----
     // Filter to the unmerged frontier: any summary whose `mergedInto`
     // is unset. After merge, the children's mergedInto points at the
     // parent and the parent stands alone with that source range. The
@@ -1540,7 +2053,11 @@ export class AutobiographicalStrategy implements ResettableStrategy {
     // converged to ~500 L1s that never aged out, blowing the 200k
     // window around chunk 118.
     const priorSummaries = this.summaries
-      .filter((s) => !s.mergedInto)
+      // Skip empty-content summaries: emitting `{type:'text', text:''}` as a
+      // recall pair triggers Anthropic 400 "text content blocks must be
+      // non-empty", which stalls ALL compression (mirrors the render-path guard
+      // + load-drop). A single empty summary otherwise poisons every compression.
+      .filter((s) => !s.mergedInto && !!s.content && s.content.trim().length > 0)
       .sort((a, b) => a.sourceRange.first.localeCompare(b.sourceRange.first));
 
     // Token-budget cap (see capRecallPairs). Defense-in-depth: even with
@@ -1577,33 +2094,7 @@ export class AutobiographicalStrategy implements ResettableStrategy {
       });
     }
 
-    // ---- 2. Head window (raw, ALWAYS present) ----
-    //
-    // The head is the foundational identity anchor: the actual opening
-    // of the chronicle (the user's first message, the agent's first
-    // reply, the system context if any). It establishes WHO is speaking
-    // to WHOM. Without it, when the chunk content is heavily first-person
-    // from someone other than the agent (e.g., a user-shared document),
-    // the agent loses its first-person grounding and drifts into the
-    // content author's voice.
-    //
-    // The head is the configured head window — not "everything before
-    // the chunk." For doc-heavy chronicles, "everything before" would
-    // be hundreds of thousands of tokens; the recall pairs already
-    // represent that intermediate content. The head is just the
-    // permanent prefix that the original instance always saw.
-    //
-    // Head messages are excluded from compression by `getCompressibleMessages`
-    // (they're outside the chunking range), so they won't appear in
-    // any L1's sourceIds — no overlap with the recall pairs above.
-    const allMessages = ctx.messageStore.getAll();
-    const headStartIdx = this.getHeadWindowStartIndex(ctx.messageStore);
-    const headEndIdx = this.getHeadWindowEnd(ctx.messageStore);
-    for (let i = headStartIdx; i < headEndIdx && i < allMessages.length; i++) {
-      const m = allMessages[i];
-      llmMessages.push({ participant: m.participant, content: m.content });
-    }
-
+    // ---- 3. Raw middle ----
     // Any raw messages between the head and the chunk that aren't yet
     // represented by any summary — usually empty in adaptive-resolution
     // mode, since chunking proceeds contiguously and summaries cover
@@ -1635,18 +2126,18 @@ export class AutobiographicalStrategy implements ResettableStrategy {
       }
     }
 
-    // ---- 3. In-band marker ----
+    // ---- 4. In-band marker ----
     llmMessages.push({
       participant: 'Context Manager',
       content: [{ type: 'text', text: COMPRESSION_MARKER }],
     });
 
-    // ---- 4. Chunk messages raw ----
+    // ---- 5. Chunk messages raw ----
     for (const m of chunk.messages) {
       llmMessages.push({ participant: m.participant, content: m.content });
     }
 
-    // ---- 5. Instruction (reading-mode aware) ----
+    // ---- 6. Instruction (reading-mode aware) ----
     //
     // When the chunk is a portion of a substantially larger sharded message
     // (≥ 2× chunk size), use the reading-mode instruction. It avoids the
@@ -1680,6 +2171,18 @@ export class AutobiographicalStrategy implements ResettableStrategy {
     // by its tool_result, and any tool_result that doesn't follow a use.
     const cleaned = stripUnpairedToolBlocks(collapsed);
 
+    // Without the agent's live tool definitions, a request that replays
+    // tool-block-bearing history is deterministically refused
+    // (reasoning_extraction -- see the `tools` comment below). Tools are
+    // pushed by the host on every activation; before the first activation
+    // of a session, defer rather than burn a doomed full-window call.
+    const chunkHasToolBlocks = cleaned.some(m =>
+      m.content.some((b: ContentBlock) => b.type === 'tool_use' || b.type === 'tool_result'));
+    if (chunkHasToolBlocks && !(ctx.tools && ctx.tools.length > 0)) {
+      console.warn('[autobiographical] deferring chunk compression: history contains tool blocks but host has not provided tool definitions yet (ctx.tools empty) — will retry after next activation');
+      return;
+    }
+
     // NO system prompt. The agent's identity is established by the head
     // (the actual conversation opening — user message + agent reply that
     // grounded the original instance). A system prompt would (a) add a
@@ -1688,12 +2191,53 @@ export class AutobiographicalStrategy implements ResettableStrategy {
     // (b) provide an alternative identity source that competes with the
     // structural one carried by the conversation itself. Anchoring
     // identity by the chronicle's actual head is more honest.
+    // Own the byte wall here rather than delegating to membrane's shed: cap
+    // the prompt's inline image bytes newest-first before the request is built.
+    // A tighter budget than the live window's: a compression prompt also
+    // carries the head, the whole recall frontier and the raw chunk, so the
+    // image share must leave room for all of it under the API's 32MB cap.
+    this.capCompressionImageBytes(
+      llmMessages as Array<{ content: ContentBlock[] }>,
+      this.config.maxCompressionImageBytes ??
+        AutobiographicalStrategy.DEFAULT_MAX_COMPRESSION_IMAGE_BYTES,
+    );
+
     const request: NormalizedRequest = {
-      messages: cleaned.map(m => ({ participant: m.participant, content: m.content })),
+      // EXPLICIT image-loss opt-in (2026-07-12): summarizer prompts replay
+      // raw history that can carry more inline image bytes than the API's
+      // request cap. Dropping the OLDEST images from the summarizer's view is
+      // acceptable policy here — the summary describes the span, it does not
+      // preserve pixels — and membrane error-logs every exercised shed. All
+      // other callers fail loudly instead (no silent transport mutation).
+      shedOversizeImages: true,
+      // Sanitize: strip empty text blocks (`{type:'text',text:''}`) and drop any
+      // message left with no content. An empty-content turn (e.g. a silent/skip
+      // turn that produced no text) otherwise reaches the API as an empty text
+      // block → 400 "text content blocks must be non-empty", which throws in the
+      // speculative drain and stalls ALL compression. (Twin of the empty-summary
+      // recall-header guard — together they cover every source of the 400.)
+      messages: cleaned
+        .map(m => ({ participant: m.participant, content: stripThinkingBlocks(stripEmptyTextBlocks(m.content)) }))
+        .filter(m => m.content.length > 0),
       config: {
         model: this.config.compressionModel ?? 'claude-sonnet-4-20250514',
-        maxTokens: Math.round(targetTokens * 1.5),
+        // Generous output ceiling so a memory-write is never truncated mid-thought:
+        // targetTokens is a *target*, not a cap, and adaptive models routinely
+        // overshoot a ~2k target. Was `* 1.5` (=3000 at the 2k default), which cut
+        // off rich memories (stop=max_tokens).
+        maxTokens: Math.max(16000, Math.round(targetTokens * 1.5)),
       },
+      // Declare the agent's live tools. A summarizer request that replays
+      // tool_use/tool_result history with NO tools param reads to Anthropic's
+      // safety classifier as a foreign agent trace being duplicated ->
+      // deterministic reasoning_extraction refusal of every memory-write
+      // (labclaude incident, 2026-07-09; 268 refusals). Declaring the same
+      // tools the live instance runs with is also strictly MORE faithful to
+      // the original context, so it is the KV-honest choice, not a
+      // workaround. Undefined before the first activation of a session --
+      // acceptable: those chunks stay raw and are retried after the agent's
+      // first turn (see the defer guard in compressChunkHierarchical).
+      tools: ctx.tools,
     };
 
     const callStart = Date.now();
@@ -1713,12 +2257,45 @@ export class AutobiographicalStrategy implements ResettableStrategy {
         .join('\n');
       logResponse = summaryText;
 
+      // A bugged/empty generation (summarizer returned no text — spent budget on
+      // thinking, truncated, etc.) must NOT be stored: recalled later it becomes
+      // an empty assistant text block → Anthropic 400 "content must be non-empty".
+      // Leave the chunk raw rather than poisoning memory with an empty summary.
+      if (!summaryText.trim()) {
+        console.warn(`[autobiographical] empty L1 summary for chunk of ${chunk.messages.length} msgs — skipping (chunk left raw)`);
+        return;
+      }
+
+      // Re-check the dedup guard AFTER the await: summary state may have
+      // changed while the LLM call was in flight (persisted-state reload,
+      // or any future concurrent producer). Discarding a paid-for result
+      // is cheaper than storing a duplicate L1 over the same messages.
+      const postExisting = this.summaries.find(
+        s => s.level === 1 && s.sourceIds.join(':') === chunkIdKey
+      );
+      if (postExisting) {
+        chunk.compressed = true;
+        chunk.summaryId = postExisting.id;
+        return;
+      }
+
       const messageIds = chunk.messages.map(m => m.id);
       const entry: SummaryEntry = {
         id: `L1-${this.nextSummaryIdCounter()}`,
         level: 1,
         content: summaryText,
-        tokens: Math.ceil(summaryText.length / 4),
+        // Exact when available (2026-07-12): the compression response's own
+        // usage.outputTokens IS the true token count of the text it just
+        // wrote — the single most-reused number in the pyramid (fold floor,
+        // middle budget, recall caps). Estimate only as fallback.
+        tokens:
+          response.usage?.outputTokens &&
+          response.usage.outputTokens > 0 &&
+          // outputTokens includes scratch thinking when present — only exact
+          // when the whole response is the summary text itself.
+          !response.content.some(b => b.type === 'thinking' || b.type === 'redacted_thinking')
+            ? response.usage.outputTokens
+            : Math.ceil(summaryText.length / 3),
         sourceLevel: 0,
         sourceIds: messageIds,
         sourceRange: {
@@ -1732,6 +2309,7 @@ export class AutobiographicalStrategy implements ResettableStrategy {
       this.pushSummary(entry);
       chunk.compressed = true;
       chunk.summaryId = entry.id;
+      this.markChunkRecordCompressed(chunk.recordId, entry.id);
       this._compressionCount++;
       logSummaryId = entry.id;
 
@@ -1781,6 +2359,78 @@ export class AutobiographicalStrategy implements ResettableStrategy {
    * already-eligible siblings, producing N near-identical higher-level
    * summaries when the queue eventually drains.
    */
+  /**
+   * Pick merge sources as the oldest CONTIGUOUS run (2026-07-12 fix).
+   *
+   * The old rule merged "whatever N are unmerged" in creation order. On a
+   * store whose frontier held both June L2s and a July L2, that minted an
+   * L3 spanning months of already-merged history (mythos L3-415, 0-3853 of
+   * 3995 messages) — a group whose range straddles the recent window can
+   * never fold (group-atomicity vs the raw zone), so the whole deep lineage
+   * above it went unusable and the fold floor stopped fitting the budget.
+   *
+   * Rules: order candidates by live source position; break runs where the
+   * positional gap exceeds `mergeContiguityGapLimit` (holes from wiped/
+   * pruned nodes are fine, cross-era bridges are not); exclude candidates
+   * whose OWN span exceeds `mergeMaxSourceSpanMessages` (replay-era wide-
+   * span summaries would bridge anything they join); merge the oldest run
+   * that still has `threshold` members.
+   */
+  protected contiguousMergeCandidates(
+    unmerged: SummaryEntry[],
+    threshold: number,
+  ): SummaryEntry[] | null {
+    if (unmerged.length < threshold) return null;
+    const messageOrder = new Map<MessageId, number>();
+    let seq = 0;
+    for (const ch of this.chunks) {
+      for (const m of ch.messages) messageOrder.set(m.id, seq++);
+    }
+    const gapLimit = this.config.mergeContiguityGapLimit ?? 300;
+    const spanLimit = this.config.mergeMaxSourceSpanMessages ?? 1500;
+    const withPos: Array<{ s: SummaryEntry; first: number; last: number }> = [];
+    for (const s of unmerged) {
+      const first = messageOrder.get(s.sourceRange.first);
+      const last = messageOrder.get(s.sourceRange.last);
+      if (first === undefined || last === undefined) continue;
+      if (Math.abs(last - first) > spanLimit) continue; // wide-span quarantine
+      withPos.push({ s, first: Math.min(first, last), last: Math.max(first, last) });
+    }
+    withPos.sort((a, b) => a.first - b.first);
+
+    // Split into contiguous runs (a gap larger than `gapLimit` starts a new one).
+    const runs: Array<typeof withPos> = [];
+    let run: typeof withPos = [];
+    let runEnd = -Infinity;
+    for (const x of withPos) {
+      if (run.length > 0 && x.first - runEnd > gapLimit) {
+        runs.push(run);
+        run = [];
+        runEnd = -Infinity;
+      }
+      run.push(x);
+      runEnd = Math.max(runEnd, x.last);
+    }
+    if (run.length > 0) runs.push(run);
+    if (runs.length === 0) return null;
+
+    // ONLY THE NEWEST RUN CAN GROW (2026-07-12 starvation fix). Summaries are
+    // always produced at the live end, so any INTERIOR run is stranded: it can
+    // never reach `threshold` members, and waiting for it froze the whole
+    // pyramid (mythos: L1 frontier [913-981]x5 + [4039-4131]x5 separated by a
+    // 3058-message hole from the poison-node surgery — 10 unmerged L1s, 8
+    // unmerged L2s, merge queue empty, fold floor climbing to 117k until the
+    // picker died). Interior runs consolidate as soon as they have 2 members;
+    // only the newest run waits for the full threshold.
+    for (let i = 0; i < runs.length; i++) {
+      const r = runs[i];
+      const isNewest = i === runs.length - 1;
+      if (r.length >= threshold) return r.slice(0, threshold).map((x) => x.s);
+      if (!isNewest && r.length >= 2) return r.slice(0, threshold).map((x) => x.s);
+    }
+    return null;
+  }
+
   protected checkMergeThreshold(): void {
     phaseChannel.report('merge-threshold'); // liveness-watchdog phase
     if (this.config.speculativeProduction) {
@@ -1803,11 +2453,11 @@ export class AutobiographicalStrategy implements ResettableStrategy {
     const unmergedL1 = this.summaries.filter(
       s => s.level === 1 && !s.mergedInto && !queuedL1.has(s.id),
     );
-    if (unmergedL1.length >= threshold) {
-      const toMerge = unmergedL1.slice(0, threshold);
+    const l1Run = this.contiguousMergeCandidates(unmergedL1, threshold);
+    if (l1Run) {
       this.enqueueMerge({
         level: 2,
-        sourceIds: toMerge.map(s => s.id),
+        sourceIds: l1Run.map(s => s.id),
       });
     }
 
@@ -1815,11 +2465,11 @@ export class AutobiographicalStrategy implements ResettableStrategy {
     const unmergedL2 = this.summaries.filter(
       s => s.level === 2 && !s.mergedInto && !queuedL2.has(s.id),
     );
-    if (unmergedL2.length >= threshold) {
-      const toMerge = unmergedL2.slice(0, threshold);
+    const l2Run = this.contiguousMergeCandidates(unmergedL2, threshold);
+    if (l2Run) {
       this.enqueueMerge({
         level: 3,
-        sourceIds: toMerge.map(s => s.id),
+        sourceIds: l2Run.map(s => s.id),
       });
     }
   }
@@ -1863,11 +2513,11 @@ export class AutobiographicalStrategy implements ResettableStrategy {
       const unmerged = this.summaries.filter(
         s => s.level === level && !getSummaryParentId(s) && !queued.has(s.id),
       );
-      if (unmerged.length >= threshold) {
-        const toMerge = unmerged.slice(0, threshold);
+      const run = this.contiguousMergeCandidates(unmerged, threshold);
+      if (run) {
         this.enqueueMerge({
           level: level + 1,
-          sourceIds: toMerge.map(s => s.id),
+          sourceIds: run.map(s => s.id),
         });
       }
     }
@@ -1987,7 +2637,9 @@ export class AutobiographicalStrategy implements ResettableStrategy {
     // parent — the same rule used everywhere else and now in
     // `compressChunkHierarchical`. The cap below is the defense-in-depth.
     const priorSummariesAll = this.summaries
-      .filter((s) => !s.mergedInto)
+      // Skip empty-content summaries (see compressChunkHierarchical): an empty
+      // text block in the merge recall header 400s and stalls compression.
+      .filter((s) => !s.mergedInto && !!s.content && s.content.trim().length > 0)
       .filter((s) => {
         for (const lid of s.sourceIds) if (sourceLeafIds.has(lid)) return false;
         const firstIdx = allMessages.findIndex((m) => m.id === s.sourceRange.first);
@@ -2147,15 +2799,56 @@ export class AutobiographicalStrategy implements ResettableStrategy {
     const collapsed = this.collapseConsecutiveMessages(split);
     const cleaned = stripUnpairedToolBlocks(collapsed);
 
+    // Byte wall on the MERGE prompt too (2026-07-12). A merge expands its
+    // sources ONE LEVEL DEEPER — an L2 merge therefore replays the RAW
+    // messages under its L1s, images and all (including screenshots nested in
+    // tool_results). This is the path that kept tripping membrane's transport
+    // shed at 27MB after the L1 site was already capped. Own it here.
+    this.capCompressionImageBytes(
+      cleaned as Array<{ content: ContentBlock[] }>,
+      this.config.maxCompressionImageBytes ??
+        AutobiographicalStrategy.DEFAULT_MAX_COMPRESSION_IMAGE_BYTES,
+    );
+
     // NO system prompt — identity is established by the head window
     // (present at the start of llmMessages above) and by the prior
     // recall pairs. Same rationale as compressChunkHierarchical.
     const request: NormalizedRequest = {
-      messages: cleaned.map(m => ({ participant: m.participant, content: m.content })),
+      // EXPLICIT image-loss opt-in (2026-07-12): summarizer prompts replay
+      // raw history that can carry more inline image bytes than the API's
+      // request cap. Dropping the OLDEST images from the summarizer's view is
+      // acceptable policy here — the summary describes the span, it does not
+      // preserve pixels — and membrane error-logs every exercised shed. All
+      // other callers fail loudly instead (no silent transport mutation).
+      shedOversizeImages: true,
+      // Sanitize: strip empty text blocks (`{type:'text',text:''}`) and drop any
+      // message left with no content. An empty-content turn (e.g. a silent/skip
+      // turn that produced no text) otherwise reaches the API as an empty text
+      // block → 400 "text content blocks must be non-empty", which throws in the
+      // speculative drain and stalls ALL compression. (Twin of the empty-summary
+      // recall-header guard — together they cover every source of the 400.)
+      messages: cleaned
+        .map(m => ({ participant: m.participant, content: stripThinkingBlocks(stripEmptyTextBlocks(m.content)) }))
+        .filter(m => m.content.length > 0),
       config: {
         model: this.config.compressionModel ?? 'claude-sonnet-4-20250514',
-        maxTokens: Math.round(targetTokens * 1.5),
+        // Generous output ceiling so a memory-write is never truncated mid-thought:
+        // targetTokens is a *target*, not a cap, and adaptive models routinely
+        // overshoot a ~2k target. Was `* 1.5` (=3000 at the 2k default), which cut
+        // off rich memories (stop=max_tokens).
+        maxTokens: Math.max(16000, Math.round(targetTokens * 1.5)),
       },
+      // Declare the agent's live tools. A summarizer request that replays
+      // tool_use/tool_result history with NO tools param reads to Anthropic's
+      // safety classifier as a foreign agent trace being duplicated ->
+      // deterministic reasoning_extraction refusal of every memory-write
+      // (labclaude incident, 2026-07-09; 268 refusals). Declaring the same
+      // tools the live instance runs with is also strictly MORE faithful to
+      // the original context, so it is the KV-honest choice, not a
+      // workaround. Undefined before the first activation of a session --
+      // acceptable: those chunks stay raw and are retried after the agent's
+      // first turn (see the defer guard in compressChunkHierarchical).
+      tools: ctx.tools,
     };
 
     const callStart = Date.now();
@@ -2172,6 +2865,14 @@ export class AutobiographicalStrategy implements ResettableStrategy {
         .join('\n');
       logResponse = mergedText;
 
+      // Empty merged generation: skip the merge entirely (do NOT push or mark
+      // sources merged) so we never store/recall an empty summary. Sources stay
+      // unmerged and can be retried.
+      if (!mergedText.trim()) {
+        console.warn(`[autobiographical] empty merged L${targetLevel} summary (${sources.length} sources) — skipping merge`);
+        return;
+      }
+
       // Compute source range from constituent summaries
       const sourceRange = {
         first: sources[0].sourceRange.first,
@@ -2183,7 +2884,15 @@ export class AutobiographicalStrategy implements ResettableStrategy {
         id: `L${targetLevel}-${this.nextSummaryIdCounter()}`,
         level: targetLevel,
         content: mergedText,
-        tokens: Math.ceil(mergedText.length / 4),
+        // Exact when available — see the L1 site.
+        tokens:
+          response.usage?.outputTokens &&
+          response.usage.outputTokens > 0 &&
+          // outputTokens includes scratch thinking when present — only exact
+          // when the whole response is the summary text itself.
+          !response.content.some(b => b.type === 'thinking' || b.type === 'redacted_thinking')
+            ? response.usage.outputTokens
+            : Math.ceil(mergedText.length / 3),
         sourceLevel,
         sourceIds,
         sourceRange,
@@ -2254,10 +2963,18 @@ export class AutobiographicalStrategy implements ResettableStrategy {
     this.rsBegin();
     const entries: ContextEntry[] = [];
     const maxTokens = budget.maxTokens - budget.reserveForResponse;
+    const overBudgetGraceRatio = Math.max(0, this.config.overBudgetGraceRatio ?? 0);
+    const rejectionBudget = Math.floor(maxTokens * (1 + overBudgetGraceRatio));
+    // Closed-loop calibration: apply the persisted multiplier BEFORE any
+    // estimate is taken this compile.
+    this.loadCalibration(store);
     const messages = store.getAll();
     const msgCap = this.config.maxMessageTokens;
+    // Post-strip estimates (see postStripEstimates): every budgeting site in
+    // this method prices a message the way the stripped render will cost it.
+    const pse = this.postStripEstimates(store);
 
-    // ----- 1. Build head/tail sets and emit head entries -----
+    // ----- 1. Build head/tail sets and reserve the tail before emitting -----
     const headStart = this.getHeadWindowStartIndex(store);
     const headEnd = this.getHeadWindowEnd(store);
     const recentStart = this.getRecentWindowStart(store);
@@ -2267,14 +2984,45 @@ export class AutobiographicalStrategy implements ResettableStrategy {
     let headTokens = 0;
     let tailTokens = 0;
 
+    // Compute the fixed raw windows first. They are hard reservations, not
+    // best-effort phases: foldable history may use only the space left after
+    // every head and tail message has been accounted for.
+    for (let i = headStart; i < headEnd && i < messages.length; i++) {
+      const msg = messages[i];
+      const tokens = msgCap > 0 ? Math.min(pse[i], msgCap + 50) : pse[i];
+      headMessageIds.add(msg.id);
+      headTokens += tokens;
+    }
+    const effectiveRecentStart = Math.max(recentStart, headEnd);
+    for (let i = effectiveRecentStart; i < messages.length; i++) {
+      const msg = messages[i];
+      const tokens = msgCap > 0 ? Math.min(pse[i], msgCap + 50) : pse[i];
+      tailMessageIds.add(msg.id);
+      tailTokens += tokens;
+    }
+
+    if (headTokens + tailTokens > rejectionBudget) {
+      throw new OverBudgetError({
+        budget: rejectionBudget,
+        actual: headTokens + tailTokens,
+        diagnostics: {
+          headTokens,
+          tailTokens,
+          middleTokens: 0,
+          middleChunkCount: Math.max(0, effectiveRecentStart - headEnd),
+          deepestLevel: 0,
+        },
+      });
+    }
+
+    const prefixBudget = rejectionBudget - tailTokens;
     let totalTokens = 0;
 
-    // Emit head entries verbatim
+    // Emit the already-reserved head entries verbatim.
     for (let i = headStart; i < headEnd && i < messages.length; i++) {
       const msg = messages[i];
       const content = msgCap > 0 ? this.truncateContent(msg.content, msgCap) : msg.content;
-      const tokens = msgCap > 0 ? Math.min(store.estimateTokens(msg), msgCap + 50) : store.estimateTokens(msg);
-      if (totalTokens + tokens > maxTokens) break;
+      const tokens = msgCap > 0 ? Math.min(pse[i], msgCap + 50) : pse[i];
       entries.push({
         index: entries.length,
         sourceMessageId: msg.id,
@@ -2283,23 +3031,12 @@ export class AutobiographicalStrategy implements ResettableStrategy {
         content,
       });
       totalTokens += tokens;
-      headMessageIds.add(msg.id);
-      headTokens += tokens;
       this.rsRaw('head', tokens);
     }
     // (Cache breakpoints are placed in one pass over the FINAL ordered entries
     // below — see placeCacheMarkers — capturing the stable folded prefix, not
     // just the head boundary.)
 
-    // Compute tail message IDs (will be emitted at end)
-    const effectiveRecentStart = Math.max(recentStart, headEnd);
-    for (let i = effectiveRecentStart; i < messages.length; i++) {
-      const msg = messages[i];
-      const tokens = msgCap > 0 ? Math.min(store.estimateTokens(msg), msgCap + 50) : store.estimateTokens(msg);
-      tailMessageIds.add(msg.id);
-      tailTokens += tokens;
-    }
-
     // ----- 2. Build PickerChunks for messages in the middle -----
     // For each compressible (non-head, non-tail) message we create one
     // PickerChunk. Its l1Id is determined by the existing chunks that
@@ -2330,8 +3067,8 @@ export class AutobiographicalStrategy implements ResettableStrategy {
       const msg = messages[i];
       const ch = chunksByMessageId.get(msg.id);
       const tokens = msgCap > 0
-        ? Math.min(store.estimateTokens(msg), msgCap + 50)
-        : store.estimateTokens(msg);
+        ? Math.min(pse[i], msgCap + 50)
+        : pse[i];
       const bound = pinBounds.get(i);
       pickerChunks.push({
         id: msg.id,
@@ -2345,6 +3082,7 @@ export class AutobiographicalStrategy implements ResettableStrategy {
         pinLevel: bound?.level,
         pinMaxLevel: bound?.maxLevel,
         l1Id: ch?.summaryId,
+        salience: AutobiographicalStrategy.staticSalience(msg),
       });
     }
 
@@ -2353,8 +3091,8 @@ export class AutobiographicalStrategy implements ResettableStrategy {
     for (let i = headStart; i < headEnd && i < messages.length; i++) {
       const msg = messages[i];
       const tokens = msgCap > 0
-        ? Math.min(store.estimateTokens(msg), msgCap + 50)
-        : store.estimateTokens(msg);
+        ? Math.min(pse[i], msgCap + 50)
+        : pse[i];
       pickerChunks.push({
         id: msg.id,
         sequence: i,
@@ -2368,8 +3106,8 @@ export class AutobiographicalStrategy implements ResettableStrategy {
     for (let i = effectiveRecentStart; i < messages.length; i++) {
       const msg = messages[i];
       const tokens = msgCap > 0
-        ? Math.min(store.estimateTokens(msg), msgCap + 50)
-        : store.estimateTokens(msg);
+        ? Math.min(pse[i], msgCap + 50)
+        : pse[i];
       pickerChunks.push({
         id: msg.id,
         sequence: i,
@@ -2421,6 +3159,17 @@ export class AutobiographicalStrategy implements ResettableStrategy {
     const picker = this.buildPicker(pickerInputs);
     const result = picker.run(pickerInputs, foldingBudget);
 
+    // Every trust-region override is loud (design §13.4) — silence was half
+    // of the 2026-07-12 incident.
+    const plan = this._lastKvStable?.lastPlan();
+    if (plan?.override) {
+      console.error(
+        `[kv-escalation] override=${plan.override} perturbation=${plan.perturbation}` +
+          ` tokens=${plan.tokens} budget=${foldingBudget.totalBudget}` +
+          ` (see adaptive-resolution-design.md §13.4)`,
+      );
+    }
+
     // Commit the new resolutions back to strategy state for next compile.
     // Persist to chronicle only if anything actually changed — avoids
     // unnecessary state-slot writes on no-op compiles (which is the common
@@ -2456,14 +3205,12 @@ export class AutobiographicalStrategy implements ResettableStrategy {
       this.handleProducedOps(result.produced);
     }
 
-    // Hard-fail check: if the picker exhausted itself but the final render
-    // would still exceed the HARD budget (not just the soft target), surface
-    // an OverBudgetError to the host rather than silently dropping entries.
-    // The strategy has done all it can; the application has to decide what
-    // to do next (raise budget, switch model, drop windows, etc.).
-    if (result.exhausted && result.finalTokens > totalBudget) {
+    // Hard-fail whenever the picker's current plan exceeds the hard budget.
+    // A `produce` op only schedules a missing summary; it does not make the
+    // current raw plan feasible and must never authorize an inference.
+    if (result.finalTokens > rejectionBudget) {
       throw new OverBudgetError({
-        budget: totalBudget,
+        budget: rejectionBudget,
         actual: result.finalTokens,
         diagnostics: {
           headTokens,
@@ -2535,7 +3282,7 @@ export class AutobiographicalStrategy implements ResettableStrategy {
             // (`maxMessageTokens` is for per-message caps on chat / tool
             // results, not for sharded bodyGroup composites.)
             const tokens = this.estimateTokens(content);
-            if (totalTokens + tokens > maxTokens) {
+            if (totalTokens + tokens > prefixBudget) {
               currentRun = null;
               return false;
             }
@@ -2567,7 +3314,7 @@ export class AutobiographicalStrategy implements ResettableStrategy {
                 sourceRelation: 'derived',
               };
               const pairTokens = this.estimateTokens(questionEntry.content) + this.estimateTokens(answerEntry.content);
-              if (totalTokens + pairTokens > maxTokens) {
+              if (totalTokens + pairTokens > prefixBudget) {
                 currentRun = null;
                 return false;
               }
@@ -2625,8 +3372,8 @@ export class AutobiographicalStrategy implements ResettableStrategy {
       const resolution = result.finalResolutions.get(msg.id) ?? 0;
       if (resolution === 0) {
         const content = msgCap > 0 ? this.truncateContent(msg.content, msgCap) : msg.content;
-        const tokens = msgCap > 0 ? Math.min(store.estimateTokens(msg), msgCap + 50) : store.estimateTokens(msg);
-        if (totalTokens + tokens > maxTokens) break;
+        const tokens = msgCap > 0 ? Math.min(pse[i], msgCap + 50) : pse[i];
+        if (totalTokens + tokens > prefixBudget) break;
         entries.push({
           index: entries.length,
           sourceMessageId: msg.id,
@@ -2641,8 +3388,8 @@ export class AutobiographicalStrategy implements ResettableStrategy {
         const ancestor = this.findAncestorAt(msg.id, resolution, chunksByMessageId, summariesById);
         if (!ancestor) {
           const content = msgCap > 0 ? this.truncateContent(msg.content, msgCap) : msg.content;
-          const tokens = msgCap > 0 ? Math.min(store.estimateTokens(msg), msgCap + 50) : store.estimateTokens(msg);
-          if (totalTokens + tokens > maxTokens) break;
+          const tokens = msgCap > 0 ? Math.min(pse[i], msgCap + 50) : pse[i];
+          if (totalTokens + tokens > prefixBudget) break;
           entries.push({
             index: entries.length,
             sourceMessageId: msg.id,
@@ -2674,7 +3421,7 @@ export class AutobiographicalStrategy implements ResettableStrategy {
           sourceRelation: 'derived',
         };
         const pairTokens = this.estimateTokens(questionEntry.content) + this.estimateTokens(answerEntry.content);
-        if (totalTokens + pairTokens > maxTokens) break;
+        if (totalTokens + pairTokens > prefixBudget) break;
         entries.push(questionEntry);
         entries.push(answerEntry);
         totalTokens += pairTokens;
@@ -2683,8 +3430,21 @@ export class AutobiographicalStrategy implements ResettableStrategy {
       }
     }
 
-    // ----- 6. Emit tail entries newest-first eviction (matches existing behavior) -----
-    const tailStats = this.emitRecentNewestFirst(entries, store, messages, effectiveRecentStart, msgCap, maxTokens, totalTokens);
+    // ----- 6. Emit the fully-reserved tail -----
+    const tailStats = this.emitRecentNewestFirst(entries, store, messages, effectiveRecentStart, msgCap, rejectionBudget, totalTokens, pse);
+    if (tailStats.messages !== messages.length - effectiveRecentStart) {
+      throw new OverBudgetError({
+        budget: rejectionBudget,
+        actual: totalTokens + tailTokens,
+        diagnostics: {
+          headTokens,
+          tailTokens,
+          middleTokens: totalTokens - headTokens,
+          middleChunkCount: pickerChunks.length - headMessageIds.size - tailMessageIds.size,
+          deepestLevel,
+        },
+      });
+    }
     this.rsRaw('tail', tailStats.tokens, tailStats.messages);
 
     // ----- 7. Post-process: merge consecutive raw entries from the same bodyGroup -----
@@ -2697,9 +3457,43 @@ export class AutobiographicalStrategy implements ResettableStrategy {
 
     this.pruneToolEntries(merged);
     this.trimOrphanedToolUse(merged);
+    // Full pairing invariant over the final rendered context — catches the
+    // mid-list orphans the trailing/leading trims can't (bug 6.7). The adaptive
+    // path has the same mid-list orphan producers as hierarchical (budget
+    // `break`s between pair members, raw emission interleaved with recall
+    // pairs), and FKM defaults autobiographical strategies onto this path — so
+    // the guard has to run here too. It's a no-op on already-valid output.
+    this.enforceToolPairing(merged);
     // Strip stale images BEFORE placing markers and committing stats, so both
     // describe the post-strip context the agent actually receives.
     this.applyImageStripping(merged, store);
+
+    // The newest stored message is the triggering turn for this compile. A
+    // structural repair may rewrite tool blocks, but it must never erase that
+    // turn. Body-group shards merge under the first shard's source id, so any
+    // surviving member of the same group proves the newest shard is present.
+    const newest = messages[messages.length - 1];
+    if (newest) {
+      const newestGroupIds = newest.bodyGroupId
+        ? new Set(messages.filter(m => m.bodyGroupId === newest.bodyGroupId).map(m => m.id))
+        : new Set([newest.id]);
+      const newestRetained = merged.some(
+        entry => entry.sourceMessageId && newestGroupIds.has(entry.sourceMessageId),
+      );
+      if (!newestRetained) {
+        throw new OverBudgetError({
+          budget: rejectionBudget,
+          actual: totalTokens + tailTokens,
+          diagnostics: {
+            headTokens,
+            tailTokens,
+            middleTokens: totalTokens - headTokens,
+            middleChunkCount: pickerChunks.length - headMessageIds.size - tailMessageIds.size,
+            deepestLevel,
+          },
+        });
+      }
+    }
     // Place ≤4 cache breakpoints across the FINAL ordered entries so the
     // provider can reuse the stable folded prefix — not just the head. With a
     // single head marker the cache hit is ~2%; well-placed breakpoints take the
@@ -2707,9 +3501,100 @@ export class AutobiographicalStrategy implements ResettableStrategy {
     // placement is the dominant KV lever).
     this.placeCacheMarkers(merged, headMessageIds, tailMessageIds);
     this.rsEnd();
+    // Closed-loop calibration bookkeeping: the committed render stats total
+    // (in CURRENT calibrated units) is what this compile claims the request
+    // will cost — reportRealInputTokens compares provider usage against it.
+    this._storeView = store;
+    const rs = this.getRenderStats(store);
+    this._lastCompileEstimate =
+      rs.head.tokens + rs.tail.tokens + rs.middleRaw.tokens +
+      rs.summaries.l1.tokens + rs.summaries.l2.tokens + rs.summaries.l3.tokens;
+    this._calibrationArmed = true; // exactly one sample per compile
     return merged;
   }
 
+  private _lastCompileEstimate = 0;
+  private _storeView: MessageStoreView | null = null;
+
+  /**
+   * Closed-loop estimator calibration (2026-07-12). Feed the REAL input total
+   * for a request built from the latest compile (fresh + cache_read +
+   * cache_creation, minus non-window overhead the caller knows about, e.g.
+   * tool schemas). Maintains an EMA of real/estimated and applies it as the
+   * store's global multiplier, persisted across restarts. The per-class rates
+   * carry the shape; this carries the residual level.
+   */
+  reportRealInputTokens(realTotal: number): void {
+    if (!Number.isFinite(realTotal) || realTotal <= 0) return;
+    const est = this._lastCompileEstimate;
+    if (!est || est <= 0) return;
+
+    // ARM-ONCE-PER-COMPILE (2026-07-12 regression fix). A turn makes MANY API
+    // calls — tool-use rounds and max_tokens continuations each append to the
+    // request — so only the FIRST completion after a compile was built from
+    // the window this estimate describes. Feeding later calls compares a grown
+    // request against the original estimate: ratios of 2.0-2.3 (est=224k
+    // real=504k) drove the multiplier 1.0 -> 2.37 in minutes, inflating every
+    // estimate (the fold floor went 62k -> 108k on unchanged content) and
+    // exhausting the picker on every wake. One sample per compile, always.
+    if (!this._calibrationArmed) return;
+    this._calibrationArmed = false;
+
+    const ratio = realTotal / est;
+    // SANITY BAND: a representative sample sits near 1. Anything wilder is a
+    // structural mismatch (a request we didn't compile, a partial compile, a
+    // provider quirk) — never evidence about chars-per-token. Log, don't learn.
+    if (ratio < 0.6 || ratio > 1.8) {
+      console.error(
+        `[estimator-calibration] REJECTED out-of-band sample real/est=${ratio.toFixed(2)} ` +
+          `(est=${Math.round(est / 1000)}k real=${Math.round(realTotal / 1000)}k) — ` +
+          `not a window-shaped request; multiplier stays ${this._calibration.toFixed(2)}`,
+      );
+      return;
+    }
+
+    const current = this._calibration;
+    const observed = ratio * current; // back out the multiplier already applied
+    const alpha = 0.2; // slow EMA: one wild request shouldn't yank the ruler
+    const next = current + alpha * (observed - current);
+    const clamped = Math.min(1.8, Math.max(0.6, next));
+    if (Math.abs(clamped - current) / current > 0.02) {
+      console.error(
+        `[estimator-calibration] real/est=${ratio.toFixed(2)} ` +
+          `multiplier ${current.toFixed(2)} -> ${clamped.toFixed(2)} (est=${Math.round(est / 1000)}k real=${Math.round(realTotal / 1000)}k)`,
+      );
+    }
+    this._calibration = clamped;
+    this.applyCalibration();
+    try {
+      this.store?.setStateJson(this.calibrationStateId, { multiplier: this._calibration, at: Date.now() });
+    } catch { /* persistence is best-effort */ }
+  }
+
+  private _calibrationArmed = false;
+
+  private _calibration = 1;
+  private _calibrationLoaded = false;
+
+  protected applyCalibration(): void {
+    this._storeView?.setTokenCalibration?.(this._calibration);
+  }
+
+  /** Load the persisted multiplier once and push it into the store view. */
+  protected loadCalibration(store: MessageStoreView): void {
+    this._storeView = store;
+    if (!this._calibrationLoaded) {
+      this._calibrationLoaded = true;
+      try {
+        const saved = this.store?.getStateJson(this.calibrationStateId) as { multiplier?: number } | null;
+        if (saved && Number.isFinite(saved.multiplier)) {
+          this._calibration = Math.min(1.8, Math.max(0.6, saved.multiplier!));
+        }
+      } catch { /* absent slot is fine */ }
+    }
+    this.applyCalibration();
+  }
+
   /**
    * Place up to four `cache_control` breakpoints across the final ordered
    * entries: the head/system boundary, the end of the folded history (the
@@ -2763,12 +3648,23 @@ export class AutobiographicalStrategy implements ResettableStrategy {
   ): ContextEntry[] {
     if (entries.length === 0) return entries;
 
-    // Look up bodyGroupId by sourceMessageId via the message store.
-    const groupOf = (sourceMessageId?: string): string | undefined => {
+    // Look up bodyGroup metadata by sourceMessageId, memoized for the
+    // duration of this pass. Entries reference the same messages repeatedly
+    // (run-extension checks + the shardIndex sort comparator below), and
+    // store.get() also resolves blobs — fetch each message at most once.
+    const shardMeta = new Map<string, { groupId?: string; shardIndex?: number }>();
+    const metaOf = (sourceMessageId?: string): { groupId?: string; shardIndex?: number } | undefined => {
       if (!sourceMessageId) return undefined;
-      const m = store.get(sourceMessageId);
-      return m?.bodyGroupId;
+      let meta = shardMeta.get(sourceMessageId);
+      if (!meta) {
+        const m = store.get(sourceMessageId);
+        meta = { groupId: m?.bodyGroupId, shardIndex: m?.shardIndex };
+        shardMeta.set(sourceMessageId, meta);
+      }
+      return meta;
     };
+    const groupOf = (sourceMessageId?: string): string | undefined =>
+      metaOf(sourceMessageId)?.groupId;
 
     const out: ContextEntry[] = [];
     let i = 0;
@@ -2800,9 +3696,9 @@ export class AutobiographicalStrategy implements ResettableStrategy {
       // ordering. (Head/tail emission keeps chronological order, but defending
       // against reorderings is cheap.)
       const sortedRun = [...run].sort((a, b) => {
-        const ma = a.sourceMessageId ? store.get(a.sourceMessageId) : null;
-        const mb = b.sourceMessageId ? store.get(b.sourceMessageId) : null;
-        return (ma?.shardIndex ?? 0) - (mb?.shardIndex ?? 0);
+        const sa = metaOf(a.sourceMessageId)?.shardIndex ?? 0;
+        const sb = metaOf(b.sourceMessageId)?.shardIndex ?? 0;
+        return sa - sb;
       });
       // Build merged text content. Non-text blocks (rare in shards) are
       // preserved on the first shard's entry only.
@@ -2848,16 +3744,89 @@ export class AutobiographicalStrategy implements ResettableStrategy {
    */
   protected buildPicker(inputs: PickerInputs): Picker {
     if (this.config.foldingStrategy === 'kv-stable') {
-      return new Picker(
-        new KvStableStrategy(inputs, {
-          reachTokens: this.config.kvStableReachTokens,
-          mergeThreshold: this.config.mergeThreshold,
-        }),
-      );
+      const strategy = new KvStableStrategy(inputs, {
+        reachTokens: this.config.kvStableReachTokens,
+        qualityGapRatio: this.config.kvStableQualityGapRatio,
+        mergeThreshold: this.config.mergeThreshold,
+      });
+      this._lastKvStable = strategy;
+      return new Picker(strategy);
     }
+    this._lastKvStable = null;
     return this.getAdaptivePicker();
   }
 
+  /** The kv-stable strategy instance behind the most recent compile — kept for
+   *  `[kv-escalation]` observability (design §13.4: every override is loud). */
+  private _lastKvStable: KvStableStrategy | null = null;
+
+  /**
+   * Static salience prior (design §13.3) — "is the window the only copy?".
+   * Content whose payload is externalized folds cheap: tool blocks
+   * (re-derivable), fenced code (usually written to disk), images (the file/
+   * CDN keeps them), bare link drops. Conversation exists nowhere but the
+   * chronicle, so it stays at 1. Returns a value in [0.2, 1]; cheap,
+   * deterministic, computed per message at picker-input construction.
+   */
+  protected static staticSalience(msg: StoredMessage): number {
+    let totalChars = 0;
+    let externalChars = 0;
+    for (const block of msg.content) {
+      const b = block as {
+        type?: string;
+        text?: string;
+        input?: unknown;
+        content?: unknown;
+      };
+      switch (b.type) {
+        case 'text': {
+          const t = b.text ?? '';
+          totalChars += t.length;
+          // Fenced code blocks.
+          const fences = t.split('```');
+          for (let i = 1; i < fences.length; i += 2) externalChars += fences[i].length;
+          // Bare link-drop lines (the URL is the payload).
+          for (const line of t.split('\n')) {
+            const trimmed = line.trim();
+            if (/^https?:\/\/\S+$/.test(trimmed)) externalChars += trimmed.length;
+          }
+          break;
+        }
+        case 'tool_use': {
+          const n = JSON.stringify(b.input ?? {}).length;
+          totalChars += n;
+          externalChars += n;
+          break;
+        }
+        case 'tool_result': {
+          const n =
+            typeof b.content === 'string'
+              ? b.content.length
+              : JSON.stringify(b.content ?? '').length;
+          totalChars += n;
+          externalChars += n;
+          break;
+        }
+        case 'image': {
+          // Estimate parity with the renderer's flat image cost; the payload
+          // lives in the file/CDN, so it is fully externalized.
+          totalChars += 6400; // ≈1600 tokens × 4 chars
+          externalChars += 6400;
+          break;
+        }
+        default: {
+          const t = (b as { text?: string }).text ?? '';
+          totalChars += t.length;
+        }
+      }
+    }
+    if (totalChars <= 0) return 1;
+    const externalized = Math.min(1, externalChars / totalChars);
+    // Fully-externalized content bottoms out at 0.2 — cheap, never free
+    // (hard protections, not salience, are what make content unfoldable).
+    return Math.max(0.2, 1 - 0.8 * externalized);
+  }
+
   /**
    * Walk the summary tree to find the L_k ancestor of a message.
    * Returns null if no ancestor exists at that level (e.g., L_k not yet produced).
@@ -3020,6 +3989,76 @@ export class AutobiographicalStrategy implements ResettableStrategy {
     selectedSummaries.push(...l1Selected);
     totalSummaryTokens += l1Used;
 
+    // Phase 3b: coverage repair (bug 6.9). getAntiRedundantSummaries excluded
+    // an L2 (or L3) when ALL of its children were in the CANDIDATE shown-set —
+    // computed before budget selection. If the budget then dropped some of
+    // those children (e.g. KnowledgeStrategy's research L1 cap), the covered
+    // history appears at NEITHER level: a silent memory hole. Re-include any
+    // excluded L2/L3 whose children did not all make the final selection.
+    // Some overlap with the children that DID survive is accepted — coverage
+    // beats perfect dedup here.
+    //
+    // Repairs are additionally bounded by a per-level ALLOWANCE (a fraction of
+    // that level's budget), not just the overall context budget. The
+    // excluded-with-partially-dropped-children state only arises from a store
+    // damaged mid-merge (the crash window at compressChunkHierarchical, or the
+    // legacy setMergedInto index-desync). On such a store MANY L2s can be in
+    // this state at once; without a cap, re-including all of them at full size
+    // would starve the recent window via Phase 4's newest-first eviction. When
+    // repairs exceed the allowance we stop re-including and warn — a corrupted
+    // store announces itself instead of silently trading recent messages for
+    // redundant summaries.
+    {
+      // Allowance = a fraction of the level budget, with a floor tied to the
+      // overall budget so a strategy that zeroes a level budget (e.g.
+      // KnowledgeStrategy prioritising L1) can still repair a handful of
+      // covering summaries, while a corrupted store with dozens of them stays
+      // bounded well short of the recent window.
+      const REPAIR_ALLOWANCE_FRACTION = 0.25;
+      const REPAIR_FLOOR_FRACTION = 0.05;
+      const repairFloor = maxTokens * REPAIR_FLOOR_FRACTION;
+      const l2RepairAllowance = Math.max(l2Budget * REPAIR_ALLOWANCE_FRACTION, repairFloor);
+      const l3RepairAllowance = Math.max(l3Budget * REPAIR_ALLOWANCE_FRACTION, repairFloor);
+      const selectedIds = new Set(selectedSummaries.map(s => s.id));
+      const shownL2Ids = new Set(shownL2.map(s => s.id));
+      const shownL3Ids = new Set(shownL3.map(s => s.id));
+      let l2RepairTokens = 0;
+      let l3RepairTokens = 0;
+      let l2RepairsSkipped = 0;
+      let l3RepairsSkipped = 0;
+      // L2s excluded by anti-redundancy: unmerged, not in shownL2.
+      for (const s of this.summaries) {
+        if (s.level !== 2 || s.mergedInto || shownL2Ids.has(s.id)) continue;
+        if (s.sourceIds.every(id => selectedIds.has(id))) continue; // truly redundant
+        if (this.isOverBudget(totalTokens + totalSummaryTokens + s.tokens, maxTokens)) continue;
+        if (l2RepairTokens + s.tokens > l2RepairAllowance) { l2RepairsSkipped++; continue; }
+        selectedSummaries.push(s);
+        totalSummaryTokens += s.tokens;
+        l2RepairTokens += s.tokens;
+        selectedIds.add(s.id);
+      }
+      // L3s excluded by anti-redundancy — after L2 repair, so a repaired L2
+      // counts as selected coverage for its parent L3.
+      for (const s of this.summaries) {
+        if (s.level !== 3 || s.mergedInto || shownL3Ids.has(s.id)) continue;
+        if (s.sourceIds.every(id => selectedIds.has(id))) continue;
+        if (this.isOverBudget(totalTokens + totalSummaryTokens + s.tokens, maxTokens)) continue;
+        if (l3RepairTokens + s.tokens > l3RepairAllowance) { l3RepairsSkipped++; continue; }
+        selectedSummaries.push(s);
+        totalSummaryTokens += s.tokens;
+        l3RepairTokens += s.tokens;
+        selectedIds.add(s.id);
+      }
+      if (l2RepairsSkipped > 0 || l3RepairsSkipped > 0) {
+        console.warn(
+          `[AutobiographicalStrategy] coverage-repair allowance exceeded — ` +
+          `skipped ${l2RepairsSkipped} L2 and ${l3RepairsSkipped} L3 re-inclusions ` +
+          `(store likely corrupted mid-merge). Some covered history may render at ` +
+          `no summary level this pass.`,
+        );
+      }
+    }
+
     // Emit summaries + pinned messages between head and recent windows.
     //
     // Default (positionedRecallPairs=true): one Q/A pair per summary,
@@ -3103,6 +4142,10 @@ export class AutobiographicalStrategy implements ResettableStrategy {
         for (const item of items) {
           if (item.kind === 'summary') {
             const summary = item.summary;
+            // Defensive: never emit a recall pair for an empty/bugged summary — an
+            // empty assistant text block triggers a 400. (Production guards too,
+            // but a legacy empty summary may already exist in the store.)
+            if (!summary.content || !summary.content.trim()) continue;
             const headerText = this.buildRecallHeader(summary);
             const questionEntry: ContextEntry = {
               index: entries.length,
@@ -3208,6 +4251,9 @@ export class AutobiographicalStrategy implements ResettableStrategy {
     this.rsRaw('tail', tailStats.tokens, tailStats.messages);
 
     this.trimOrphanedToolUse(entries);
+    // Full pairing invariant over the final rendered context — catches the
+    // mid-list orphans the trailing/leading trims can't (bug 6.7).
+    this.enforceToolPairing(entries);
     this.pruneToolEntries(entries);
     // Strip stale images before committing stats so RenderStats.total reflects
     // the post-strip context (this path places no cache markers).
@@ -3520,27 +4566,83 @@ export class AutobiographicalStrategy implements ResettableStrategy {
   }
 
   /**
-   * Rebuild chunk boundaries based on current messages.
+   * Rebuild the chunk list: persisted records own the past; the running-sum
+   * chunker only extends at the frontier, and a chunk is only ever created
+   * once it CLOSES (reaches targetChunkTokens). The trailing partial chunk
+   * is never created and never compressed — eager partial-tail compression
+   * minted a new near-duplicate L1 per rebuild while the tail grew (the
+   * prefix-generation families found fleet-wide in the 2026-07 audit).
    */
   protected rebuildChunks(store: MessageStoreView): void {
-    const messagesToChunk = this.getCompressibleMessages(store);
+    this.chunks = [];
+    this.compressionQueue = [];
 
-    // Preserve existing compressed chunks (legacy) and summary linkage (hierarchical)
-    const existingCompressed = new Map<string, Chunk>();
+    // ---- 1. Materialize persisted records (they OWN their messages). ----
+    const byId = new Map<string, StoredMessage>();
+    for (const m of store.getAll()) byId.set(m.id, m);
+
+    const consumed = new Set<string>();
+    let orphaned = 0;
+    for (const rec of this.chunkRecords) {
+      const msgs: StoredMessage[] = [];
+      for (const id of rec.sourceIds) {
+        const m = byId.get(id);
+        if (m) msgs.push(m);
+      }
+      if (msgs.length === 0) { orphaned++; continue; }
+      for (const m of msgs) consumed.add(m.id);
+      const chunk: Chunk = {
+        index: this.chunks.length,
+        startIndex: -1, // record-derived; filtered-array indices are not meaningful
+        endIndex: -1,
+        messages: msgs,
+        tokens: msgs.reduce((sum, m) => sum + (this.config.attachmentsIgnoreSize
+          ? this.estimateTextOnlyTokens(m)
+          : store.estimateTokens(m)), 0),
+        compressed: rec.compressed,
+        summaryId: rec.summaryId,
+        phaseType: rec.phaseType,
+        recordId: rec.id,
+      };
+      this.chunks.push(chunk);
+    }
+
+    // ---- 2. Fail closed on the chain-break signature. ----
+    // Most records resolving to zero live messages means message identity
+    // has been rebuilt/renumbered underneath us. Chunking "fresh" ground now
+    // would re-compress already-lived history into duplicate memories.
+    // Halt ALL compression until an operator reconciles the store.
+    if (this.chunkPersistenceEnabled && this.chunkRecords.length >= 3 &&
+        orphaned / this.chunkRecords.length > 0.5) {
+      this.chunkRecordsOrphaned = true;
+      this.compressionQueue = [];
+      if (!this._orphanWarned) {
+        this._orphanWarned = true;
+        console.error(
+          `[autobiographical] FAIL-CLOSED: ${orphaned}/${this.chunkRecords.length} chunk ` +
+          `records resolve to zero live messages (messages chain break / store ` +
+          `reconciliation signature). Compression halted to prevent duplicate ` +
+          `memory formation — reconcile the store before resuming.`,
+        );
+      }
+      return;
+    }
+    this.chunkRecordsOrphaned = false;
+
+    // Queue uncompressed record-backed chunks (crash-recovery: record was
+    // appended but the process died before its L1 landed).
     for (const chunk of this.chunks) {
-      if (chunk.compressed) {
-        const key = this.chunkKey(chunk);
-        existingCompressed.set(key, chunk);
+      if (!chunk.compressed && !(chunk.recordId && this._overlapBlocked.has(chunk.recordId))) {
+        this.compressionQueue.push(chunk.index);
       }
     }
 
-    // Rebuild chunks
-    this.chunks = [];
-    this.compressionQueue = [];
+    // ---- 3. Chunk the frontier: compressible messages not owned by any record. ----
+    const messagesToChunk = this.getCompressibleMessages(store)
+      .filter(m => !consumed.has(m.id));
 
     let currentChunk: StoredMessage[] = [];
     let currentTokens = 0;
-    // Track start position in the filtered array for chunk boundary metadata
     let chunkFilteredStart = 0;
 
     for (let i = 0; i < messagesToChunk.length; i++) {
@@ -3570,19 +4672,27 @@ export class AutobiographicalStrategy implements ResettableStrategy {
       }
 
       if (shouldClose) {
-        const chunk = this.createChunk(
-          this.chunks.length,
-          chunkFilteredStart,
-          i + 1,
-          currentChunk,
-          currentTokens,
-          existingCompressed
-        );
-        this.chunks.push(chunk);
-
-        if (!chunk.compressed) {
-          this.compressionQueue.push(chunk.index);
+        const chunk: Chunk = {
+          index: this.chunks.length,
+          startIndex: chunkFilteredStart,
+          endIndex: i + 1,
+          messages: [...currentChunk],
+          tokens: currentTokens,
+          compressed: false,
+        };
+        // Persist the boundary the moment it closes — from here on this
+        // span is owned and never re-keyed by config drift or restarts.
+        if (this.chunkPersistenceEnabled) {
+          const record: ChunkRecord = {
+            id: `c-${this.chunkIdCounter++}`,
+            sourceIds: chunk.messages.map(m => m.id),
+            compressed: false,
+          };
+          this.appendChunkRecord(record);
+          chunk.recordId = record.id;
         }
+        this.chunks.push(chunk);
+        this.compressionQueue.push(chunk.index);
 
         currentChunk = [];
         currentTokens = 0;
@@ -3590,20 +4700,27 @@ export class AutobiographicalStrategy implements ResettableStrategy {
       }
     }
 
-    if (currentChunk.length >= 4) {
-      const chunk = this.createChunk(
-        this.chunks.length,
-        chunkFilteredStart,
-        messagesToChunk.length,
-        currentChunk,
-        currentTokens,
-        existingCompressed
-      );
-      this.chunks.push(chunk);
-
-      if (!chunk.compressed) {
-        this.compressionQueue.push(chunk.index);
-      }
+    // NOTE: no trailing-partial chunk. An unclosed chunk is not a chunk —
+    // it compresses only after the running sum closes it.
+
+    // ---- 4. L1 holdback: keep the newest X closed chunks out of the
+    // speculative queue (default 1). The chunk at the live edge is the one
+    // most likely to still be in motion (edits, tool-result landings, the
+    // episode it belongs to still resolving); summarize it once a newer chunk
+    // has closed behind it. The queue is rebuilt on every message, so a
+    // held-back chunk is released automatically the moment it ages out of the
+    // window. Demand overrides: a picker `produce` op (enqueueL1ForRange)
+    // marks the chunk demanded, and demanded chunks are never held back —
+    // when folding actually NEEDS the L1, production must not be blocked.
+    const holdback = this.config.l1HoldbackChunks ?? 1;
+    if (holdback > 0 && this.chunks.length > 0) {
+      const cutoff = this.chunks.length - holdback;
+      this.compressionQueue = this.compressionQueue.filter((idx) => {
+        if (idx < cutoff) return true;
+        const ch = this.chunks[idx];
+        const lastId = ch?.messages[ch.messages.length - 1]?.id;
+        return lastId !== undefined && this._demandedL1Chunks.has(lastId);
+      });
     }
   }
 
@@ -3701,7 +4818,8 @@ export class AutobiographicalStrategy implements ResettableStrategy {
   protected applyImageStripping(entries: ContextEntry[], store: MessageStoreView): void {
     const maxLive = this.config.maxLiveImages ?? 0;             // 0 = unlimited count
     const depthTokens = this.config.imageStripDepthTokens ?? 0; // 0 = no depth strip
-    if (maxLive === 0 && depthTokens === 0) return;             // policy disabled
+    const maxLiveBytes = this.config.maxLiveImageBytes ?? AutobiographicalStrategy.DEFAULT_MAX_LIVE_IMAGE_BYTES;
+    if (maxLive === 0 && depthTokens === 0 && maxLiveBytes === 0) return; // policy disabled
 
     const messages = store.getAll();
     const posById = new Map<string, number>();
@@ -3732,34 +4850,152 @@ export class AutobiographicalStrategy implements ResettableStrategy {
       .sort((a, b) => b.pos - a.pos);
 
     let keptImages = 0;
+    let keptImageBytes = 0;
     for (const { idx, pos } of ordered) {
       const entry = entries[idx];
       const tooDeep = depthTokens > 0 && (pos < 0 || pos < stripStart);
       const bucket = bucketAt(pos);
       entry.content = entry.content.map((block) => {
         if (block.type !== 'image') return block;
+        const blockBytes = AutobiographicalStrategy.imageBlockBytes(block);
         const overCount = maxLive > 0 && keptImages >= maxLive;
-        if (tooDeep || overCount) {
-          // The renderer estimates an image at `tokenEstimate ?? 1600` (see
-          // message-store/context-log). Hand that back to the bucket, less the
-          // placeholder text that replaces it, so the stats match the output.
-          const reclaimed =
-            ((block as { tokenEstimate?: number }).tokenEstimate ?? 1600) - placeholderTokens;
-          if (this._rs && reclaimed > 0) this._rs[bucket].tokens -= reclaimed;
+        const overBytes = maxLiveBytes > 0 && keptImageBytes + blockBytes > maxLiveBytes;
+        if (tooDeep || overCount || overBytes) {
+          // Stats-neutral (2026-07-12): every budgeting site now tallies at
+          // POST-STRIP prices (see postStripEstimates), so the bucket never
+          // charged this image at full weight — reclaiming here would
+          // double-decrement. The strip pass only swaps the block.
+          void bucket;
+          void placeholderTokens;
           return { type: 'text', text: AutobiographicalStrategy.IMAGE_PLACEHOLDER } as ContentBlock;
         }
         keptImages++;
+        keptImageBytes += blockBytes;
         return block;
       });
     }
   }
 
+  /**
+   * Post-strip token estimate per message index (2026-07-12 tail-starvation
+   * fix). Mirrors `applyImageStripping`: an image beyond the `maxLiveImages`
+   * newest (counted newest-first) or deeper than `imageStripDepthTokens` of
+   * raw estimate from the live end renders as a placeholder — so every place
+   * that BUDGETS messages (recent-window walk-back, head/tail sums, middle
+   * chunk sizes) must cost it as one. Pricing stripped images at their full
+   * estimate collapsed an image-dense tail to a fraction of its configured
+   * size (42k rendered of a 120k window), and pricing them post-strip in the
+   * walk-back alone made the picker's raw-priced tail overflow the budget
+   * (318k) — the estimate must be consistent EVERYWHERE.
+   */
+  protected postStripEstimates(store: MessageStoreView): number[] {
+    const messages = store.getAll();
+    const out = new Array<number>(messages.length);
+    const stripDepth = this.config.imageStripDepthTokens ?? 0;
+    const maxLive = this.config.maxLiveImages ?? 0;
+    const maxLiveBytes = this.config.maxLiveImageBytes ?? AutobiographicalStrategy.DEFAULT_MAX_LIVE_IMAGE_BYTES;
+    const stripActive = stripDepth > 0 || maxLive > 0 || maxLiveBytes > 0;
+    const placeholderTokens = Math.ceil(AutobiographicalStrategy.IMAGE_PLACEHOLDER.length / 4);
+    let liveImagesSeen = 0;
+    let liveImageBytes = 0;
+    let rawDepth = 0; // raw-estimate depth from the newest message (mirrors getImageStripStart)
+    for (let i = messages.length - 1; i >= 0; i--) {
+      const raw = store.estimateTokens(messages[i]);
+      let est = raw;
+      if (stripActive) {
+        for (const b of messages[i].content) {
+          if (b.type !== 'image') continue;
+          const bytes = AutobiographicalStrategy.imageBlockBytes(b);
+          const beyondDepth = stripDepth > 0 && rawDepth > stripDepth;
+          const beyondCount = maxLive > 0 && liveImagesSeen >= maxLive;
+          const beyondBytes = maxLiveBytes > 0 && liveImageBytes + bytes > maxLiveBytes;
+          if (beyondDepth || beyondCount || beyondBytes) {
+            const imgEst = (b as { tokenEstimate?: number }).tokenEstimate ?? 1600;
+            est -= Math.max(0, imgEst - placeholderTokens);
+          } else {
+            liveImagesSeen++;
+            liveImageBytes += bytes;
+          }
+        }
+      }
+      rawDepth += raw;
+      out[i] = est;
+    }
+    return out;
+  }
+
+  /** Byte wall default: 20MB of base64 (API total-request cap is 32MB). */
+  protected static readonly DEFAULT_MAX_LIVE_IMAGE_BYTES = 20 * 1024 * 1024;
+
+  /** Compression prompts carry head + recall frontier + raw chunk alongside
+   *  their images, so they get a tighter image budget than the live window. */
+  protected static readonly DEFAULT_MAX_COMPRESSION_IMAGE_BYTES = 12 * 1024 * 1024;
+
+  /** Base64 payload size of an image block (0 for non-base64 sources). */
+  protected static imageBlockBytes(b: unknown): number {
+    const src = (b as { source?: { data?: string } }).source;
+    return typeof src?.data === 'string' ? src.data.length : 0;
+  }
+
+  /**
+   * Cap inline image bytes in a COMPRESSION prompt (2026-07-12). The main
+   * window enforces `maxLiveImageBytes` through the strip policy; the
+   * summarizer's raw-chunk replay had no such wall and leaned on membrane's
+   * byte shed instead — which is a transport backstop, not a policy owner
+   * (it fired at 27MB on a live merge). Keep images newest-first within the
+   * budget; older ones become the same loud placeholder the window uses, so
+   * the summarizer is told plainly that it is not seeing them.
+   * Returns the number of images replaced.
+   */
+  protected capCompressionImageBytes(
+    messages: Array<{ content: ContentBlock[] }>,
+    capBytes: number,
+  ): number {
+    if (capBytes <= 0) return 0;
+    let kept = 0;
+    let dropped = 0;
+    // Recurse into tool_result content: an agent that drives a shell/plotter/
+    // browser carries most of its image bytes NESTED in tool results, not as
+    // top-level blocks. Capping only the top level left those untouched and
+    // membrane's transport shed kept firing at 27MB (2026-07-12).
+    const capBlocks = (blocks: ContentBlock[]): ContentBlock[] =>
+      blocks.map((b) => {
+        if (b.type === 'image') {
+          const bytes = AutobiographicalStrategy.imageBlockBytes(b);
+          if (kept + bytes <= capBytes) {
+            kept += bytes;
+            return b;
+          }
+          dropped++;
+          return { type: 'text', text: AutobiographicalStrategy.IMAGE_PLACEHOLDER } as ContentBlock;
+        }
+        const nested = (b as { type: string; content?: unknown }).content;
+        if (b.type === 'tool_result' && Array.isArray(nested)) {
+          return { ...b, content: capBlocks(nested as ContentBlock[]) } as ContentBlock;
+        }
+        return b;
+      });
+    for (let i = messages.length - 1; i >= 0; i--) {
+      const m = messages[i];
+      if (!Array.isArray(m.content)) continue;
+      m.content = capBlocks(m.content);
+    }
+    if (dropped > 0) {
+      console.error(
+        `[autobiographical] compression prompt: replaced ${dropped} older image(s) with placeholders ` +
+          `to stay under the ${Math.round(capBytes / 1e6)}MB image-byte budget (kept ${Math.round(kept / 1e6)}MB, newest-first)`,
+      );
+    }
+    return dropped;
+  }
+
   protected getRecentWindowStart(store: MessageStoreView): number {
     const messages = store.getAll();
+    const pse = this.postStripEstimates(store);
     let tokens = 0;
 
     for (let i = messages.length - 1; i >= 0; i--) {
-      tokens += store.estimateTokens(messages[i]);
+      tokens += pse[i];
       if (tokens > this.config.recentWindowTokens) {
         let boundary = i + 1;
         // Don't split a tool_use/tool_result pair: if the message at the boundary
@@ -3847,6 +5083,180 @@ export class AutobiographicalStrategy implements ResettableStrategy {
     }
   }
 
+  /** Placeholder body for a stub tool_result inserted by enforceToolPairing. */
+  private static readonly STUB_TOOL_RESULT_TEXT =
+    '[tool result unavailable — omitted during context compression]';
+
+  /**
+   * Final post-selection tool-pairing validator (bug 6.7).
+   *
+   * The Anthropic API requires every `tool_use` block to be answered by a
+   * matching `tool_result` in the immediately-following message, and every
+   * `tool_result` to answer a `tool_use` in the immediately-preceding
+   * message. Selection can violate this mid-list in ways the trailing
+   * (`trimOrphanedToolUse`) and leading orphan trims don't catch:
+   *
+   *   - a budget `break` cutting between a raw pin pair's two messages;
+   *   - the uncompressed-chunk fallback emitting a raw tool_result whose
+   *     tool_use chunk already compressed (or vice versa);
+   *   - a recall pair or pin interleaving between a tool_use and its result.
+   *
+   * Repair policy prefers preserving content over dropping:
+   *
+   *   - a tool_use whose result is missing from the next entry first triggers
+   *     a short look-ahead: if the genuine (displaced) result is a few entries
+   *     down it is MOVED up into position (see
+   *     {@link relocateOrDropMissingResults}); only when no real result exists
+   *     is a STUB tool_result emitted. Either way the result block is merged
+   *     into the next entry when that entry already carries results for this
+   *     cycle, or inserted as a new user entry;
+   *   - a tool_result whose tool_use is not in the immediately-preceding
+   *     entry (and was not relocated) is dropped — there is no safe way to
+   *     stub a tool_use, so the result's information content survives only if
+   *     its use is adjacent; an entry left empty is replaced with a
+   *     placeholder text block.
+   *
+   * Runs as a structural pass over the rendered context in BOTH render
+   * paths — `selectHierarchical` (downstream of `selectL1Summaries`, so
+   * subclass overrides like KnowledgeStrategy are covered) and
+   * `selectAdaptive` (the path FKM defaults onto). It's a no-op on
+   * already-valid output.
+   */
+  protected enforceToolPairing(entries: ContextEntry[]): void {
+    let prevUseIds = new Set<string>();
+
+    for (let i = 0; i < entries.length; i++) {
+      const entry = entries[i];
+
+      // --- Rule A: every tool_result must answer a tool_use in the
+      // immediately-preceding entry (and only once). Drop orphans/dupes. ---
+      if (entry.content.some(b => b.type === 'tool_result')) {
+        const seen = new Set<string>();
+        const filtered = entry.content.filter(b => {
+          if (b.type !== 'tool_result') return true;
+          if (!prevUseIds.has(b.toolUseId) || seen.has(b.toolUseId)) return false;
+          seen.add(b.toolUseId);
+          return true;
+        });
+        if (filtered.length !== entry.content.length) {
+          entry.content = filtered.length > 0
+            ? filtered
+            : [{ type: 'text', text: '[tool call omitted]' }];
+        }
+      }
+
+      // --- Rule B: every tool_use in the PREVIOUS entry must be answered
+      // by this entry. Stub any that aren't. ---
+      if (prevUseIds.size > 0) {
+        const answered = new Set<string>();
+        for (const b of entry.content) {
+          if (b.type === 'tool_result') answered.add(b.toolUseId);
+        }
+        const missing = [...prevUseIds].filter(id => !answered.has(id));
+        if (missing.length > 0) {
+          // Look-ahead relocation: the genuine result for a "missing" id is
+          // often sitting a few entries down, displaced by an interleaved
+          // recall pair / pin (it will otherwise be dropped as an orphan by
+          // Rule A when we reach it). Move the real block up into position and
+          // only stub the ids for which no real result exists — so tool output
+          // is preserved, not silently replaced by a placeholder.
+          const results = this.relocateOrDropMissingResults(entries, i, missing);
+          if (answered.size > 0) {
+            // This entry already carries results for the cycle — prepend the
+            // relocated/stub results so all results for the preceding tool_use
+            // sit together (the API wants tool_result blocks at the head of
+            // the message).
+            entry.content = [...results, ...entry.content];
+          } else {
+            // Not a results entry at all — insert a synthetic user entry
+            // between the tool_use entry and this one.
+            entries.splice(i, 0, {
+              index: i,
+              participant: 'user',
+              sourceRelation: 'derived',
+              content: results,
+            });
+            // The stub entry (no tool_use blocks) is now at index i; the
+            // current entry moved to i+1 and is re-processed next iteration
+            // with an empty prevUseIds (its orphan results, if any, were
+            // already filtered above and none survived — Rule A matched
+            // against the same prevUseIds and answered.size === 0).
+            prevUseIds = new Set();
+            continue;
+          }
+        }
+      }
+
+      prevUseIds = new Set();
+      for (const b of entry.content) {
+        if (b.type === 'tool_use') prevUseIds.add(b.id);
+      }
+    }
+
+    // Tail: an entry that mixes tool_use with other blocks can survive
+    // trimOrphanedToolUse (which only pops pure use-without-result tails).
+    if (prevUseIds.size > 0) {
+      entries.push({
+        index: entries.length,
+        participant: 'user',
+        sourceRelation: 'derived',
+        content: [...prevUseIds].map(id => ({
+          type: 'tool_result' as const,
+          toolUseId: id,
+          content: AutobiographicalStrategy.STUB_TOOL_RESULT_TEXT,
+        })),
+      });
+    }
+
+    // Reindex after any splices/appends.
+    for (let i = 0; i < entries.length; i++) entries[i].index = i;
+  }
+
+  /**
+   * For each `missing` tool_use id (a use in the preceding entry with no
+   * adjacent result), return the result block to place next to it:
+   *
+   *   - if the genuine result exists within a short look-ahead window after
+   *     `afterIndex`, MOVE it up into position (removing it from its source
+   *     entry — replacing a now-empty entry with a placeholder) so the real
+   *     tool output survives the repair;
+   *   - otherwise emit a stub.
+   *
+   * tool_use ids are unique, so the single result carrying a given id is
+   * unambiguously the answer to that use — relocating it cannot break any
+   * other pairing. Results for `missing` ids never sit at or before
+   * `afterIndex` (that entry's results are already matched), so the search
+   * starts at `afterIndex + 1`.
+   */
+  private relocateOrDropMissingResults(
+    entries: ContextEntry[],
+    afterIndex: number,
+    missing: string[],
+  ): ContentBlock[] {
+    const LOOKAHEAD = 6;
+    const end = Math.min(entries.length, afterIndex + 1 + LOOKAHEAD);
+    return missing.map(id => {
+      for (let j = afterIndex + 1; j < end; j++) {
+        const src = entries[j];
+        const bi = src.content.findIndex(
+          b => b.type === 'tool_result' && b.toolUseId === id,
+        );
+        if (bi === -1) continue;
+        const real = src.content[bi];
+        const rest = src.content.filter((_, k) => k !== bi);
+        src.content = rest.length > 0
+          ? rest
+          : [{ type: 'text', text: '[tool call omitted]' }];
+        return real;
+      }
+      return {
+        type: 'tool_result',
+        toolUseId: id,
+        content: AutobiographicalStrategy.STUB_TOOL_RESULT_TEXT,
+      } as ContentBlock;
+    });
+  }
+
   /**
    * Prune tool_use / tool_result blocks in-place:
    *  1. Truncate `tool_use.input` blocks whose serialized JSON exceeds