@animalabs/context-manager 0.5.5 → 0.5.9

package/dist/src/strategies/autobiographical.js

@@ -54,7 +54,12 @@ function formatInstruction(targetTokens) {
         'Preserve concrete details — file paths, exact values, decisions, ' +
         `unresolved questions, the user\'s active asks. Target ~${targetTokens} ` +
         'tokens. Output only the memory body — no preamble, no section headers ' +
-        'unless they help preservation, no meta-commentary about summarizing.');
+        'unless they help preservation, no meta-commentary about summarizing. ' +
+        'Memorize only what actually happened in that slice: if it holds little ' +
+        'beyond routine system traffic (heartbeats, empty turns, failure ' +
+        'notices), a short memory saying so is correct — do not pad it by ' +
+        're-narrating events you already remember from earlier as if they had ' +
+        'just happened again.');
 }
 /**
  * Compression instruction for chunks that are part of a substantially larger
@@ -165,6 +170,39 @@ function normalizePinLevels(opts) {
     const maxLevel = clean(opts?.maxLevel);
     return maxLevel !== undefined ? { maxLevel } : {};
 }
+/**
+ * Drop empty text blocks (`{type:'text', text:''}` or whitespace-only). The
+ * Anthropic API rejects them with 400 "text content blocks must be non-empty",
+ * which — thrown inside the speculative-compression drain — halts ALL
+ * compression. Non-text blocks (tool_use/tool_result/image) pass through
+ * unchanged, so tool pairing is preserved; callers drop any message left with
+ * an empty content array.
+ */
+function stripEmptyTextBlocks(content) {
+    return content.filter((b) => {
+        if (b.type !== 'text')
+            return true;
+        const text = b.text;
+        return typeof text === 'string' && text.trim().length > 0;
+    });
+}
+/**
+ * Strip `thinking` / `redacted_thinking` blocks from compression INPUT.
+ *
+ * The summarizer must never be handed the agent's own reasoning:
+ *  (a) signed thinking is only valid verbatim in the turn that produced it —
+ *      replaying it into a rewritten summarize request corrupts the signature;
+ *  (b) asking the model to summarize its own reasoning reads as reproducing /
+ *      duplicating model output → `reasoning_extraction` refusal, which returns
+ *      empty (→ "empty L1 summary, chunk left raw") or, worse, produces a
+ *      summary that reproduces the reasoning as text — which then trips the
+ *      SAME classifier on the MAIN thread once that summary is rendered.
+ * Thinking is scratch work, not history (the same rationale already applied to
+ * the summarizer's OUTPUT). Drop it from the input too.
+ */
+function stripThinkingBlocks(content) {
+    return content.filter((b) => b.type !== 'thinking' && b.type !== 'redacted_thinking');
+}
 /**
  * Autobiographical chunking strategy.
  * Compresses old conversation chunks into summaries in the model's own words.
@@ -190,6 +228,30 @@ export class AutobiographicalStrategy {
      * unchanged), halting the drain with work still queued.
      */
     _drainProgress = 0;
+    /**
+     * Chunks (keyed by their LAST message id — chunk membership is immutable
+     * once closed) whose L1 was explicitly demanded by a picker `produce` op.
+     * Demanded chunks bypass the `l1HoldbackChunks` window in `rebuildChunks`:
+     * speculation waits, demand doesn't. Entries become inert once the chunk
+     * compresses (compressed chunks are never re-queued), so no cleanup needed.
+     */
+    _demandedL1Chunks = new Set();
+    /**
+     * In-memory mirror of the persisted chunk records (autobio:chunks slot).
+     * Loaded in `loadPersistedState`, appended to when a chunk closes,
+     * updated by ID when its L1 lands.
+     */
+    chunkRecords = [];
+    chunkIdCounter = 0;
+    /**
+     * Fail-closed latch: set when most persisted records resolve to zero live
+     * messages (the messages-chain-break signature). While set, NO compression
+     * runs — duplicate memories are strictly worse than delayed compression.
+     */
+    chunkRecordsOrphaned = false;
+    _orphanWarned = false;
+    /** Record ids whose compression was refused by the L1 overlap guard. */
+    _overlapBlocked = new Set();
     // Hierarchical state
     summaries = [];
     summaryIdCounter = 0;
@@ -204,11 +266,13 @@ export class AutobiographicalStrategy {
     /** Namespace for state-id scoping. Set in `initialize()`. */
     ns = '';
     get summariesStateId() { return `${this.ns}/autobio:summaries`; }
+    get chunksStateId() { return `${this.ns}/autobio:chunks`; }
     get counterStateId() { return `${this.ns}/autobio:counter`; }
     get mergeQueueStateId() { return `${this.ns}/autobio:mergeQueue`; }
     get pinsStateId() { return `${this.ns}/autobio:pins`; }
     get resolutionsStateId() { return `${this.ns}/autobio:resolutions`; }
     get locksStateId() { return `${this.ns}/autobio:locks`; }
+    get calibrationStateId() { return `${this.ns}/autobio:calibration`; }
     /** Protected ranges (pins + documents). Loaded from chronicle in initialize. */
     pins = [];
     /** Monotonically increasing counter for pin ids. Persisted as part of the pins snapshot. */
@@ -345,7 +409,120 @@ export class AutobiographicalStrategy {
                 break;
             }
         }
+        // Legacy stores (pre chunk-persistence) have L1 summaries but no chunk
+        // records — synthesize records from L1 sourceIds before the first
+        // rebuild, so covered ground is owned and never re-compressed.
+        this.migrateChunkRecords(ctx.messageStore);
         this.rebuildChunks(ctx.messageStore);
+        // Kick the merge ladder for pre-existing unmerged summaries. Normally a
+        // compression/merge completion does this, but a store that boots with a
+        // backlog above threshold and an empty queue (e.g. after a pyramid
+        // repair pruned duplicates and un-merged survivors) would otherwise
+        // never start consolidating. Idempotent: already-queued/merged sources
+        // are skipped.
+        if (this.config.hierarchical && !this.chunkRecordsOrphaned) {
+            this.checkMergeThreshold();
+        }
+    }
+    /**
+     * Whether chunk boundaries are persisted to the `autobio:chunks` slot and
+     * own the past. Subclasses with their own chunking (KnowledgeStrategy's
+     * semantic phases) opt out and keep the legacy recompute-every-rebuild
+     * behavior.
+     */
+    get chunkPersistenceEnabled() {
+        return true;
+    }
+    /**
+     * One-time lazy migration: a store with L1 summaries but an empty chunks
+     * slot predates chunk persistence. Each L1's sourceIds ARE the historical
+     * chunk boundary — synthesize a compressed record per L1, in message
+     * order. Stale generations from the old partial-tail compression bug
+     * (an L1 whose messages are ALL already covered by records synthesized so
+     * far — prefix families, same-range duplicates) get NO record; coverage is
+     * what blocks re-compression, and the repair tooling prunes their content
+     * separately.
+     */
+    migrateChunkRecords(store) {
+        if (!this.chunkPersistenceEnabled || !this.store)
+            return;
+        if (this.chunkRecords.length > 0)
+            return;
+        const l1s = this.summaries.filter(s => s.level === 1 && Array.isArray(s.sourceIds) && s.sourceIds.length > 0);
+        if (l1s.length === 0)
+            return;
+        const msgIndex = new Map();
+        store.getAll().forEach((m, i) => msgIndex.set(m.id, i));
+        // Sort by (start position asc, span length desc) so at each starting
+        // point the LONGEST generation claims the ground first.
+        const sorted = [...l1s].sort((a, b) => {
+            const sa = msgIndex.get(a.sourceIds[0]) ?? Number.MAX_SAFE_INTEGER;
+            const sb = msgIndex.get(b.sourceIds[0]) ?? Number.MAX_SAFE_INTEGER;
+            return sa - sb || b.sourceIds.length - a.sourceIds.length;
+        });
+        const covered = new Set();
+        let skippedStale = 0;
+        let skippedGhost = 0;
+        for (const s of sorted) {
+            // An L1 none of whose messages exist anymore can't own live ground.
+            if (!s.sourceIds.some(id => msgIndex.has(id))) {
+                skippedGhost++;
+                continue;
+            }
+            // Fully-covered = stale generation / contained duplicate.
+            if (s.sourceIds.every(id => covered.has(id))) {
+                skippedStale++;
+                continue;
+            }
+            for (const id of s.sourceIds)
+                covered.add(id);
+            this.appendChunkRecord({
+                id: `c-${this.chunkIdCounter++}`,
+                sourceIds: [...s.sourceIds],
+                compressed: true,
+                summaryId: s.id,
+                ...(s.phaseType ? { phaseType: s.phaseType } : {}),
+            });
+        }
+        console.warn(`[autobiographical] chunk-persistence migration: ${l1s.length} L1s → ` +
+            `${this.chunkRecords.length} records (${skippedStale} stale generations, ` +
+            `${skippedGhost} fully-orphaned L1s skipped)`);
+    }
+    /** Append a record to the chunks slot + in-memory mirror. */
+    appendChunkRecord(record) {
+        this.chunkRecords.push(record);
+        this.store?.appendToStateJson(this.chunksStateId, record);
+    }
+    /**
+     * Mark a chunk's record compressed, linking its L1. Resolves the log slot
+     * by ID against the persisted array — never by in-memory index (see
+     * setMergedInto for the clobber this avoids).
+     */
+    markChunkRecordCompressed(recordId, summaryId) {
+        if (!this.chunkPersistenceEnabled || !recordId)
+            return;
+        const rec = this.chunkRecords.find(r => r.id === recordId);
+        if (!rec)
+            return;
+        rec.compressed = true;
+        rec.summaryId = summaryId;
+        if (!this.store)
+            return;
+        const stored = this.store.getStateJson(this.chunksStateId);
+        if (!Array.isArray(stored))
+            return;
+        const payload = Buffer.from(JSON.stringify(rec));
+        let found = false;
+        for (let i = 0; i < stored.length; i++) {
+            const item = stored[i];
+            if (item && item.id === recordId) {
+                this.store.editStateItem(this.chunksStateId, i, payload);
+                found = true;
+            }
+        }
+        if (!found) {
+            console.warn(`[autobiographical] markChunkRecordCompressed: ${recordId} not found in persisted chunk log`);
+        }
     }
     /**
      * Register the three Chronicle state slots this strategy uses.
@@ -364,6 +541,17 @@ export class AutobiographicalStrategy {
             });
         }
         catch { /* already registered */ }
+        if (this.chunkPersistenceEnabled) {
+            try {
+                this.store.registerState({
+                    id: this.chunksStateId,
+                    strategy: 'append_log',
+                    deltaSnapshotEvery: 50,
+                    fullSnapshotEvery: 10,
+                });
+            }
+            catch { /* already registered */ }
+        }
         try {
             this.store.registerState({
                 id: this.counterStateId,
@@ -385,6 +573,13 @@ export class AutobiographicalStrategy {
             });
         }
         catch { /* already registered */ }
+        try {
+            this.store.registerState({
+                id: this.calibrationStateId,
+                strategy: 'snapshot',
+            });
+        }
+        catch { /* already registered */ }
         // Adaptive-resolution state slots — only registered when the flag is on
         // so chronicles without the flag don't accumulate unused slots.
         if (this.config.adaptiveResolution) {
@@ -416,10 +611,48 @@ export class AutobiographicalStrategy {
             this.mergeQueue = [];
             this.pins = [];
             this.pinIdCounter = 0;
+            this.chunkRecords = [];
+            this.chunkIdCounter = 0;
             return;
         }
+        if (this.chunkPersistenceEnabled) {
+            const records = this.store.getStateJson(this.chunksStateId);
+            this.chunkRecords = (Array.isArray(records) ? records : [])
+                .filter(r => r && typeof r.id === 'string' && Array.isArray(r.sourceIds) && r.sourceIds.length > 0);
+            this.chunkIdCounter = this.chunkRecords.reduce((max, r) => {
+                const n = Number(r.id.replace(/^c-/, ''));
+                return Number.isFinite(n) && n >= max ? n + 1 : max;
+            }, 0);
+            this.chunkRecordsOrphaned = false;
+            this._orphanWarned = false;
+            this._overlapBlocked.clear();
+        }
         const summaries = this.store.getStateJson(this.summariesStateId);
-        this.summaries = Array.isArray(summaries) ? summaries : [];
+        const loaded = Array.isArray(summaries) ? summaries : [];
+        // Drop empty-content summaries (bugged/empty generations from before the
+        // production guards). Recalling or merging one yields an empty text block →
+        // Anthropic 400 "content must be non-empty". Never let them re-enter memory.
+        const nonEmpty = loaded.filter(s => s && typeof s.content === 'string' && s.content.trim().length > 0);
+        const droppedEmpty = loaded.length - nonEmpty.length;
+        if (droppedEmpty > 0)
+            console.warn(`[autobiographical] dropped ${droppedEmpty} empty summary(ies) on load`);
+        // Dedupe by id, keeping the copy with mergedInto set (position of first
+        // occurrence preserved). Duplicate-id copies with diverging merge state
+        // exist in stores touched by the pre-fix setMergedInto index-desync bug;
+        // without dedupe, the plain copy stays on the unmerged frontier and its
+        // content renders twice (once itself, once via its parent's merge).
+        const byId = new Map();
+        for (const s of nonEmpty) {
+            const prev = byId.get(s.id);
+            if (!prev)
+                byId.set(s.id, s);
+            else if (!prev.mergedInto && s.mergedInto)
+                byId.set(s.id, s);
+        }
+        const dupes = nonEmpty.length - byId.size;
+        if (dupes > 0)
+            console.warn(`[autobiographical] deduped ${dupes} duplicate summary id(s) on load`);
+        this.summaries = [...byId.values()];
         const counter = this.store.getStateJson(this.counterStateId);
         this.summaryIdCounter = typeof counter === 'number' ? counter : 0;
         const queue = this.store.getStateJson(this.mergeQueueStateId);
@@ -731,10 +964,29 @@ export class AutobiographicalStrategy {
         entry.mergedInto = mergedIntoId;
         if (!this.store)
             return;
-        const index = this.summaries.indexOf(entry);
-        if (index < 0)
+        // Resolve the log position by ID against the PERSISTED array — never by
+        // in-memory index. `loadPersistedState` filters empty-content summaries
+        // out of `this.summaries` while they remain in the log, so after a reload
+        // the in-memory index is shifted relative to the log slot. Editing by
+        // in-memory index wrote merge-updates onto NEIGHBORING entries, silently
+        // clobbering them (4 summaries lost in the 2026-07 Lena incident, leaving
+        // duplicate-id copies with diverging mergedInto). Update every stored
+        // copy with this id so past duplicates converge too.
+        const stored = this.store.getStateJson(this.summariesStateId);
+        if (!Array.isArray(stored))
             return;
-        this.store.editStateItem(this.summariesStateId, index, Buffer.from(JSON.stringify(entry)));
+        let found = false;
+        const payload = Buffer.from(JSON.stringify(entry));
+        for (let i = 0; i < stored.length; i++) {
+            const item = stored[i];
+            if (item && item.id === entry.id) {
+                this.store.editStateItem(this.summariesStateId, i, payload);
+                found = true;
+            }
+        }
+        if (!found) {
+            console.warn(`[autobiographical] setMergedInto: ${entry.id} not found in persisted summary log — merge state not persisted`);
+        }
     }
     /**
      * Allocate the next summary-id counter value and persist the new counter.
@@ -828,6 +1080,11 @@ export class AutobiographicalStrategy {
         for (const chunk of candidates) {
             if (chunk.compressed)
                 continue;
+            // Demand path: mark the chunk so the l1HoldbackChunks window in
+            // rebuildChunks never filters it back out of the queue.
+            const lastId = chunk.messages[chunk.messages.length - 1]?.id;
+            if (lastId !== undefined)
+                this._demandedL1Chunks.add(lastId);
             if (this.compressionQueue.includes(chunk.index))
                 continue;
             this.compressionQueue.push(chunk.index);
@@ -1131,6 +1388,14 @@ export class AutobiographicalStrategy {
     // snapshot, so it reflects what the last compile actually rendered rather than
     // re-deriving the full pyramid (which, under adaptive resolution, bears little
     // resemblance to the folded output).
+    //
+    // CAVEAT: the final structural passes (`trimOrphanedToolUse`,
+    // `enforceToolPairing`) run AFTER the per-entry tallies and BEFORE `rsEnd()`,
+    // and are NOT reflected in the snapshot. Trims only remove entries (total
+    // over-counts by at most the trimmed tail); the pairing validator can also
+    // ADD stub tool_result entries (total then under-counts by those stubs).
+    // Both deltas are a handful of tokens — the stats describe the selection, not
+    // the byte-exact wire payload. Do not treat `total` as an exact wire count.
     // ===========================================================================
     _rs = null;
     _lastRenderStats = null;
@@ -1244,16 +1509,20 @@ export class AutobiographicalStrategy {
      * chronological order, dropping a leading orphan tool_result if its tool_use
      * fell into the evicted older portion.
      */
-    emitRecentNewestFirst(entries, store, messages, recentStart, msgCap, maxTokens, totalTokensBefore) {
+    emitRecentNewestFirst(entries, store, messages, recentStart, msgCap, maxTokens, totalTokensBefore, 
+    // Post-strip per-message estimates (2026-07-12): eviction must price a
+    // message the way the stripped render will. Raw pricing counted every
+    // stripped image at full cost and evicted most of an image-era tail the
+    // recent-window walk had correctly admitted (mythos: 601-message tail
+    // admitted, 228 survived eviction, 45k rendered of a 120k window).
+    pse) {
         if (recentStart >= messages.length)
             return { messages: 0, tokens: 0 };
+        const est = (i) => pse?.[i] ?? store.estimateTokens(messages[i]);
         const accepted = [];
         let acceptedTokens = 0;
         for (let i = messages.length - 1; i >= recentStart; i--) {
-            const msg = messages[i];
-            const tokens = msgCap > 0
-                ? Math.min(store.estimateTokens(msg), msgCap + 50)
-                : store.estimateTokens(msg);
+            const tokens = msgCap > 0 ? Math.min(est(i), msgCap + 50) : est(i);
             if (this.isOverBudget(totalTokensBefore + acceptedTokens + tokens, maxTokens))
                 break;
             accepted.push(i);
@@ -1270,9 +1539,7 @@ export class AutobiographicalStrategy {
         for (const i of accepted) {
             const msg = messages[i];
             const content = msgCap > 0 ? this.truncateContent(msg.content, msgCap) : msg.content;
-            const tokens = msgCap > 0
-                ? Math.min(store.estimateTokens(msg), msgCap + 50)
-                : store.estimateTokens(msg);
+            const tokens = msgCap > 0 ? Math.min(est(i), msgCap + 50) : est(i);
             entries.push({
                 index: entries.length,
                 sourceMessageId: msg.id,
@@ -1319,28 +1586,182 @@ export class AutobiographicalStrategy {
         if (!ctx.membrane) {
             throw new Error('No membrane instance for compression');
         }
+        // ---- Duplicate-formation guards (layered) ----
+        // Merged from two independent fixes for the same disease:
+        //
+        // 1. EXACT MATCH → adopt (bug 6.10, Tengro). rebuildChunks (fired by
+        //    onNewMessage / select) can re-queue a span whose compression already
+        //    completed against a stale chunk object — or, under chunk
+        //    persistence, a crash between the L1 append and the record edit
+        //    leaves a record uncompressed with its summary already in the log.
+        //    Adopt the existing summary, skip the LLM call, and heal the record.
+        const chunkIdKey = this.chunkKey(chunk);
+        const exactExisting = this.summaries.find(s => s.level === 1 && s.sourceIds.join(':') === chunkIdKey);
+        if (exactExisting) {
+            chunk.compressed = true;
+            chunk.summaryId = exactExisting.id;
+            this.markChunkRecordCompressed(chunk.recordId, exactExisting.id);
+            return;
+        }
+        const coveredByL1 = new Set();
+        for (const s of this.summaries) {
+            if (s.level === 1 && Array.isArray(s.sourceIds)) {
+                for (const id of s.sourceIds)
+                    coveredByL1.add(id);
+            }
+        }
+        // 2. FULLY COVERED (non-exact) → drop rather than duplicate history
+        //    (bug 6.10, Tengro): boundaries shifted across a rebuild and every
+        //    message is already inside some L1. Marking compressed WITHOUT a
+        //    summaryId means the uncompressed-middle fallback skips these
+        //    messages — they render only via the covering L1s. Safe while
+        //    `recentStart` advances monotonically (a fully-covered OLD chunk
+        //    can't intersect the recent-exclusion window); if that assumption is
+        //    ever weakened, reinstate a raw fallback (chunk-level `coveredBy`)
+        //    rather than dropping. The chunk record (if any) is deliberately
+        //    left uncompressed as an operator breadcrumb.
+        if (chunk.messages.length > 0 && chunk.messages.every(m => coveredByL1.has(m.id))) {
+            console.warn(`[autobiographical] dedup guard: chunk ${chunk.recordId ?? `#${chunk.index}`} ` +
+                `is fully covered by existing L1s under different boundaries — dropped, not re-compressed.`);
+            chunk.compressed = true;
+            return;
+        }
+        // 3. PARTIAL OVERLAP → refuse (strict; chunk persistence). With
+        //    close-then-compress there is NO legitimate way for a chunk to
+        //    partially overlap an existing L1's span. If it happens anyway
+        //    (bookkeeping bug, store surgery gone wrong), refuse to produce:
+        //    a warning in the log is strictly better than a duplicate memory
+        //    in an agent's head.
+        const overlapIds = chunk.messages.filter(m => coveredByL1.has(m.id)).map(m => m.id);
+        if (overlapIds.length > 0) {
+            const key = chunk.recordId ?? chunkIdKey;
+            if (!this._overlapBlocked.has(key)) {
+                this._overlapBlocked.add(key);
+                console.error(`[autobiographical] OVERLAP GUARD: refusing to compress chunk ` +
+                    `${chunk.recordId ?? `#${chunk.index}`} — ${overlapIds.length}/${chunk.messages.length} ` +
+                    `of its messages are already covered by existing L1 summaries ` +
+                    `(first: ${overlapIds[0]}). Duplicate-memory formation blocked; ` +
+                    `investigate before resuming this span.`);
+            }
+            return;
+        }
         const targetTokens = this.config.summaryTargetTokens ?? 2000;
         const agentParticipant = this.config.summaryParticipant ?? 'Claude';
+        // ---- 0. Thin-chunk guard ----
+        // A chunk of silent/skip turns and bare system traffic gives the
+        // summarizer nothing to remember. Asked anyway, it confabulates: it
+        // reaches for the nearest salient content (head window, prior recall
+        // pairs) and narrates it as if it just happened — each such L1 then
+        // compounds through merges (the "68 initiations" incident). Store a
+        // mechanical stub without an LLM call instead. Chunks with any
+        // non-text blocks (tool cycles, images) are never stubbed.
+        const minChunkChars = this.config.minChunkCharsForLLM ?? 200;
+        if (minChunkChars > 0) {
+            let substantiveChars = 0;
+            let hasNonText = false;
+            for (const m of chunk.messages) {
+                for (const b of m.content) {
+                    if (b.type === 'text')
+                        substantiveChars += b.text.trim().length;
+                    else
+                        hasNonText = true;
+                }
+            }
+            if (!hasNonText && substantiveChars < minChunkChars) {
+                const messageIds = chunk.messages.map(m => m.id);
+                const stub = {
+                    id: `L1-${this.nextSummaryIdCounter()}`,
+                    level: 1,
+                    content: `(A quiet stretch: ${chunk.messages.length} messages of routine ` +
+                        `system traffic — heartbeats, empty turns, notices. Nothing ` +
+                        `happened worth remembering.)`,
+                    tokens: 40,
+                    sourceLevel: 0,
+                    sourceIds: messageIds,
+                    sourceRange: { first: messageIds[0], last: messageIds[messageIds.length - 1] },
+                    created: Date.now(),
+                    phaseType: chunk.phaseType,
+                };
+                this.pushSummary(stub);
+                chunk.compressed = true;
+                chunk.summaryId = stub.id;
+                this.markChunkRecordCompressed(chunk.recordId, stub.id);
+                this._compressionCount++;
+                logCompressionCall({
+                    operation: 'compress_l1',
+                    system: null,
+                    messages: [],
+                    metadata: {
+                        stub: true,
+                        chunk_message_ids: messageIds,
+                        chunk_size: chunk.messages.length,
+                        substantive_chars: substantiveChars,
+                        min_chunk_chars: minChunkChars,
+                        summary_id: stub.id,
+                    },
+                    response: stub.content,
+                });
+                this.checkMergeThreshold();
+                return;
+            }
+        }
         // Build the KV-preserving prompt per hermes-autobio spec:
         //
-        //   1. Prior summaries — narrativized as CM-asks / agent-recalls
+        //   1. Head — the raw chronicle opening (identity anchor), FIRST,
+        //      exactly where the original instance saw it. It MUST precede
+        //      the recall pairs: when it followed them (pre-2026-07 order),
+        //      it read as the most recent live conversation, and for thin
+        //      chunks the summarizer narrated the head as fresh events
+        //      ("Antra came to me to explore the transformation story
+        //      again…"), compounding across merges into runaway false
+        //      memories (the "68 initiations" incident). Chronological
+        //      order is also the KV-stable order — the head never changes.
+        //      (executeMerge always had head-first; this site was the odd
+        //      one out.)
+        //   2. Prior summaries — narrativized as CM-asks / agent-recalls
         //      pairs, in source order. The unmerged frontier of the
         //      summary forest: any summary that has not yet been merged
         //      into a higher level. After merges run, the L_{k+1} replaces
         //      its L_k children — using the children plus their parent
         //      doubles the prompt size unboundedly.
-        //   2. Head — raw messages before the chunk that aren't already
-        //      represented by a prior summary.
-        //   3. Marker — in-band signal that a memory is about to form.
-        //   4. Chunk — raw messages being compressed, as the agent
+        //   3. Raw middle — messages between head and chunk not covered by
+        //      any summary (usually empty).
+        //   4. Marker — in-band signal that a memory is about to form.
+        //   5. Chunk — raw messages being compressed, as the agent
         //      experienced them.
-        //   5. Instruction — doc-aware if the chunk is part of a bodyGroup.
+        //   6. Instruction — doc-aware if the chunk is part of a bodyGroup.
         //
         // There is intentionally NO tail_after_chunk: that would leak
         // future information into the model's KV state and corrupt the
         // as-of framing of memory formation.
         const llmMessages = [];
-        // ---- 1. Prior recall pairs ----
+        // ---- 1. Head window (raw, ALWAYS present, FIRST) ----
+        //
+        // The head is the foundational identity anchor: the actual opening
+        // of the chronicle (the user's first message, the agent's first
+        // reply, the system context if any). It establishes WHO is speaking
+        // to WHOM. Without it, when the chunk content is heavily first-person
+        // from someone other than the agent (e.g., a user-shared document),
+        // the agent loses its first-person grounding and drifts into the
+        // content author's voice.
+        //
+        // The head is the configured head window — not "everything before
+        // the chunk." For doc-heavy chronicles, "everything before" would
+        // be hundreds of thousands of tokens; the recall pairs below
+        // represent that intermediate content. The head is just the
+        // permanent prefix that the original instance always saw.
+        //
+        // Head messages are excluded from compression by `getCompressibleMessages`
+        // (they're outside the chunking range), so they won't appear in
+        // any L1's sourceIds — no overlap with the recall pairs below.
+        const allMessages = ctx.messageStore.getAll();
+        const headStartIdx = this.getHeadWindowStartIndex(ctx.messageStore);
+        const headEndIdx = this.getHeadWindowEnd(ctx.messageStore);
+        for (let i = headStartIdx; i < headEndIdx && i < allMessages.length; i++) {
+            const m = allMessages[i];
+            llmMessages.push({ participant: m.participant, content: m.content });
+        }
+        // ---- 2. Prior recall pairs ----
         // Filter to the unmerged frontier: any summary whose `mergedInto`
         // is unset. After merge, the children's mergedInto points at the
         // parent and the parent stands alone with that source range. The
@@ -1349,7 +1770,11 @@ export class AutobiographicalStrategy {
         // converged to ~500 L1s that never aged out, blowing the 200k
         // window around chunk 118.
         const priorSummaries = this.summaries
-            .filter((s) => !s.mergedInto)
+            // Skip empty-content summaries: emitting `{type:'text', text:''}` as a
+            // recall pair triggers Anthropic 400 "text content blocks must be
+            // non-empty", which stalls ALL compression (mirrors the render-path guard
+            // + load-drop). A single empty summary otherwise poisons every compression.
+            .filter((s) => !s.mergedInto && !!s.content && s.content.trim().length > 0)
             .sort((a, b) => a.sourceRange.first.localeCompare(b.sourceRange.first));
         // Token-budget cap (see capRecallPairs). Defense-in-depth: even with
         // merged exclusion the unmerged frontier can be large at extreme scale.
@@ -1378,32 +1803,7 @@ export class AutobiographicalStrategy {
                 content: [{ type: 'text', text: s.content }],
             });
         }
-        // ---- 2. Head window (raw, ALWAYS present) ----
-        //
-        // The head is the foundational identity anchor: the actual opening
-        // of the chronicle (the user's first message, the agent's first
-        // reply, the system context if any). It establishes WHO is speaking
-        // to WHOM. Without it, when the chunk content is heavily first-person
-        // from someone other than the agent (e.g., a user-shared document),
-        // the agent loses its first-person grounding and drifts into the
-        // content author's voice.
-        //
-        // The head is the configured head window — not "everything before
-        // the chunk." For doc-heavy chronicles, "everything before" would
-        // be hundreds of thousands of tokens; the recall pairs already
-        // represent that intermediate content. The head is just the
-        // permanent prefix that the original instance always saw.
-        //
-        // Head messages are excluded from compression by `getCompressibleMessages`
-        // (they're outside the chunking range), so they won't appear in
-        // any L1's sourceIds — no overlap with the recall pairs above.
-        const allMessages = ctx.messageStore.getAll();
-        const headStartIdx = this.getHeadWindowStartIndex(ctx.messageStore);
-        const headEndIdx = this.getHeadWindowEnd(ctx.messageStore);
-        for (let i = headStartIdx; i < headEndIdx && i < allMessages.length; i++) {
-            const m = allMessages[i];
-            llmMessages.push({ participant: m.participant, content: m.content });
-        }
+        // ---- 3. Raw middle ----
         // Any raw messages between the head and the chunk that aren't yet
         // represented by any summary — usually empty in adaptive-resolution
         // mode, since chunking proceeds contiguously and summaries cover
@@ -1437,16 +1837,16 @@ export class AutobiographicalStrategy {
                 llmMessages.push({ participant: m.participant, content: m.content });
             }
         }
-        // ---- 3. In-band marker ----
+        // ---- 4. In-band marker ----
         llmMessages.push({
             participant: 'Context Manager',
             content: [{ type: 'text', text: COMPRESSION_MARKER }],
         });
-        // ---- 4. Chunk messages raw ----
+        // ---- 5. Chunk messages raw ----
         for (const m of chunk.messages) {
             llmMessages.push({ participant: m.participant, content: m.content });
         }
-        // ---- 5. Instruction (reading-mode aware) ----
+        // ---- 6. Instruction (reading-mode aware) ----
         //
         // When the chunk is a portion of a substantially larger sharded message
         // (≥ 2× chunk size), use the reading-mode instruction. It avoids the
@@ -1476,6 +1876,16 @@ export class AutobiographicalStrategy {
         // case). The API rejects any tool_use that isn't immediately followed
         // by its tool_result, and any tool_result that doesn't follow a use.
         const cleaned = stripUnpairedToolBlocks(collapsed);
+        // Without the agent's live tool definitions, a request that replays
+        // tool-block-bearing history is deterministically refused
+        // (reasoning_extraction -- see the `tools` comment below). Tools are
+        // pushed by the host on every activation; before the first activation
+        // of a session, defer rather than burn a doomed full-window call.
+        const chunkHasToolBlocks = cleaned.some(m => m.content.some((b) => b.type === 'tool_use' || b.type === 'tool_result'));
+        if (chunkHasToolBlocks && !(ctx.tools && ctx.tools.length > 0)) {
+            console.warn('[autobiographical] deferring chunk compression: history contains tool blocks but host has not provided tool definitions yet (ctx.tools empty) — will retry after next activation');
+            return;
+        }
         // NO system prompt. The agent's identity is established by the head
         // (the actual conversation opening — user message + agent reply that
         // grounded the original instance). A system prompt would (a) add a
@@ -1485,11 +1895,41 @@ export class AutobiographicalStrategy {
         // structural one carried by the conversation itself. Anchoring
         // identity by the chronicle's actual head is more honest.
         const request = {
-            messages: cleaned.map(m => ({ participant: m.participant, content: m.content })),
+            // EXPLICIT image-loss opt-in (2026-07-12): summarizer prompts replay
+            // raw history that can carry more inline image bytes than the API's
+            // request cap. Dropping the OLDEST images from the summarizer's view is
+            // acceptable policy here — the summary describes the span, it does not
+            // preserve pixels — and membrane error-logs every exercised shed. All
+            // other callers fail loudly instead (no silent transport mutation).
+            shedOversizeImages: true,
+            // Sanitize: strip empty text blocks (`{type:'text',text:''}`) and drop any
+            // message left with no content. An empty-content turn (e.g. a silent/skip
+            // turn that produced no text) otherwise reaches the API as an empty text
+            // block → 400 "text content blocks must be non-empty", which throws in the
+            // speculative drain and stalls ALL compression. (Twin of the empty-summary
+            // recall-header guard — together they cover every source of the 400.)
+            messages: cleaned
+                .map(m => ({ participant: m.participant, content: stripThinkingBlocks(stripEmptyTextBlocks(m.content)) }))
+                .filter(m => m.content.length > 0),
             config: {
                 model: this.config.compressionModel ?? 'claude-sonnet-4-20250514',
-                maxTokens: Math.round(targetTokens * 1.5),
+                // Generous output ceiling so a memory-write is never truncated mid-thought:
+                // targetTokens is a *target*, not a cap, and adaptive models routinely
+                // overshoot a ~2k target. Was `* 1.5` (=3000 at the 2k default), which cut
+                // off rich memories (stop=max_tokens).
+                maxTokens: Math.max(16000, Math.round(targetTokens * 1.5)),
             },
+            // Declare the agent's live tools. A summarizer request that replays
+            // tool_use/tool_result history with NO tools param reads to Anthropic's
+            // safety classifier as a foreign agent trace being duplicated ->
+            // deterministic reasoning_extraction refusal of every memory-write
+            // (labclaude incident, 2026-07-09; 268 refusals). Declaring the same
+            // tools the live instance runs with is also strictly MORE faithful to
+            // the original context, so it is the KV-honest choice, not a
+            // workaround. Undefined before the first activation of a session --
+            // acceptable: those chunks stay raw and are retried after the agent's
+            // first turn (see the defer guard in compressChunkHierarchical).
+            tools: ctx.tools,
         };
         const callStart = Date.now();
         let logResponse;
@@ -1506,12 +1946,40 @@ export class AutobiographicalStrategy {
                 .map(b => b.text)
                 .join('\n');
             logResponse = summaryText;
+            // A bugged/empty generation (summarizer returned no text — spent budget on
+            // thinking, truncated, etc.) must NOT be stored: recalled later it becomes
+            // an empty assistant text block → Anthropic 400 "content must be non-empty".
+            // Leave the chunk raw rather than poisoning memory with an empty summary.
+            if (!summaryText.trim()) {
+                console.warn(`[autobiographical] empty L1 summary for chunk of ${chunk.messages.length} msgs — skipping (chunk left raw)`);
+                return;
+            }
+            // Re-check the dedup guard AFTER the await: summary state may have
+            // changed while the LLM call was in flight (persisted-state reload,
+            // or any future concurrent producer). Discarding a paid-for result
+            // is cheaper than storing a duplicate L1 over the same messages.
+            const postExisting = this.summaries.find(s => s.level === 1 && s.sourceIds.join(':') === chunkIdKey);
+            if (postExisting) {
+                chunk.compressed = true;
+                chunk.summaryId = postExisting.id;
+                return;
+            }
             const messageIds = chunk.messages.map(m => m.id);
             const entry = {
                 id: `L1-${this.nextSummaryIdCounter()}`,
                 level: 1,
                 content: summaryText,
-                tokens: Math.ceil(summaryText.length / 4),
+                // Exact when available (2026-07-12): the compression response's own
+                // usage.outputTokens IS the true token count of the text it just
+                // wrote — the single most-reused number in the pyramid (fold floor,
+                // middle budget, recall caps). Estimate only as fallback.
+                tokens: response.usage?.outputTokens &&
+                    response.usage.outputTokens > 0 &&
+                    // outputTokens includes scratch thinking when present — only exact
+                    // when the whole response is the summary text itself.
+                    !response.content.some(b => b.type === 'thinking' || b.type === 'redacted_thinking')
+                    ? response.usage.outputTokens
+                    : Math.ceil(summaryText.length / 3),
                 sourceLevel: 0,
                 sourceIds: messageIds,
                 sourceRange: {
@@ -1524,6 +1992,7 @@ export class AutobiographicalStrategy {
             this.pushSummary(entry);
             chunk.compressed = true;
             chunk.summaryId = entry.id;
+            this.markChunkRecordCompressed(chunk.recordId, entry.id);
             this._compressionCount++;
             logSummaryId = entry.id;
             this.checkMergeThreshold();
@@ -1573,6 +2042,61 @@ export class AutobiographicalStrategy {
      * already-eligible siblings, producing N near-identical higher-level
      * summaries when the queue eventually drains.
      */
+    /**
+     * Pick merge sources as the oldest CONTIGUOUS run (2026-07-12 fix).
+     *
+     * The old rule merged "whatever N are unmerged" in creation order. On a
+     * store whose frontier held both June L2s and a July L2, that minted an
+     * L3 spanning months of already-merged history (mythos L3-415, 0-3853 of
+     * 3995 messages) — a group whose range straddles the recent window can
+     * never fold (group-atomicity vs the raw zone), so the whole deep lineage
+     * above it went unusable and the fold floor stopped fitting the budget.
+     *
+     * Rules: order candidates by live source position; break runs where the
+     * positional gap exceeds `mergeContiguityGapLimit` (holes from wiped/
+     * pruned nodes are fine, cross-era bridges are not); exclude candidates
+     * whose OWN span exceeds `mergeMaxSourceSpanMessages` (replay-era wide-
+     * span summaries would bridge anything they join); merge the oldest run
+     * that still has `threshold` members.
+     */
+    contiguousMergeCandidates(unmerged, threshold) {
+        if (unmerged.length < threshold)
+            return null;
+        const messageOrder = new Map();
+        let seq = 0;
+        for (const ch of this.chunks) {
+            for (const m of ch.messages)
+                messageOrder.set(m.id, seq++);
+        }
+        const gapLimit = this.config.mergeContiguityGapLimit ?? 300;
+        const spanLimit = this.config.mergeMaxSourceSpanMessages ?? 1500;
+        const withPos = [];
+        for (const s of unmerged) {
+            const first = messageOrder.get(s.sourceRange.first);
+            const last = messageOrder.get(s.sourceRange.last);
+            if (first === undefined || last === undefined)
+                continue;
+            if (Math.abs(last - first) > spanLimit)
+                continue; // wide-span quarantine
+            withPos.push({ s, first: Math.min(first, last), last: Math.max(first, last) });
+        }
+        withPos.sort((a, b) => a.first - b.first);
+        let run = [];
+        let runEnd = -Infinity;
+        for (const x of withPos) {
+            if (run.length > 0 && x.first - runEnd > gapLimit) {
+                if (run.length >= threshold)
+                    break; // oldest qualifying run wins
+                run = [];
+                runEnd = -Infinity;
+            }
+            run.push(x);
+            runEnd = Math.max(runEnd, x.last);
+        }
+        if (run.length < threshold)
+            return null;
+        return run.slice(0, threshold).map((x) => x.s);
+    }
     checkMergeThreshold() {
         phaseChannel.report('merge-threshold'); // liveness-watchdog phase
         if (this.config.speculativeProduction) {
@@ -1591,20 +2115,20 @@ export class AutobiographicalStrategy {
         }
         // Check L1 → L2
         const unmergedL1 = this.summaries.filter(s => s.level === 1 && !s.mergedInto && !queuedL1.has(s.id));
-        if (unmergedL1.length >= threshold) {
-            const toMerge = unmergedL1.slice(0, threshold);
+        const l1Run = this.contiguousMergeCandidates(unmergedL1, threshold);
+        if (l1Run) {
             this.enqueueMerge({
                 level: 2,
-                sourceIds: toMerge.map(s => s.id),
+                sourceIds: l1Run.map(s => s.id),
             });
         }
         // Check L2 → L3
         const unmergedL2 = this.summaries.filter(s => s.level === 2 && !s.mergedInto && !queuedL2.has(s.id));
-        if (unmergedL2.length >= threshold) {
-            const toMerge = unmergedL2.slice(0, threshold);
+        const l2Run = this.contiguousMergeCandidates(unmergedL2, threshold);
+        if (l2Run) {
             this.enqueueMerge({
                 level: 3,
-                sourceIds: toMerge.map(s => s.id),
+                sourceIds: l2Run.map(s => s.id),
             });
         }
     }
@@ -1646,11 +2170,11 @@ export class AutobiographicalStrategy {
         for (let level = 1; level <= maxLevel; level++) {
             const queued = queuedSources.get(level) ?? new Set();
             const unmerged = this.summaries.filter(s => s.level === level && !getSummaryParentId(s) && !queued.has(s.id));
-            if (unmerged.length >= threshold) {
-                const toMerge = unmerged.slice(0, threshold);
+            const run = this.contiguousMergeCandidates(unmerged, threshold);
+            if (run) {
                 this.enqueueMerge({
                     level: level + 1,
-                    sourceIds: toMerge.map(s => s.id),
+                    sourceIds: run.map(s => s.id),
                 });
             }
         }
@@ -1759,7 +2283,9 @@ export class AutobiographicalStrategy {
         // parent — the same rule used everywhere else and now in
         // `compressChunkHierarchical`. The cap below is the defense-in-depth.
         const priorSummariesAll = this.summaries
-            .filter((s) => !s.mergedInto)
+            // Skip empty-content summaries (see compressChunkHierarchical): an empty
+            // text block in the merge recall header 400s and stalls compression.
+            .filter((s) => !s.mergedInto && !!s.content && s.content.trim().length > 0)
             .filter((s) => {
             for (const lid of s.sourceIds)
                 if (sourceLeafIds.has(lid))
@@ -1910,11 +2436,41 @@ export class AutobiographicalStrategy {
         // (present at the start of llmMessages above) and by the prior
         // recall pairs. Same rationale as compressChunkHierarchical.
         const request = {
-            messages: cleaned.map(m => ({ participant: m.participant, content: m.content })),
+            // EXPLICIT image-loss opt-in (2026-07-12): summarizer prompts replay
+            // raw history that can carry more inline image bytes than the API's
+            // request cap. Dropping the OLDEST images from the summarizer's view is
+            // acceptable policy here — the summary describes the span, it does not
+            // preserve pixels — and membrane error-logs every exercised shed. All
+            // other callers fail loudly instead (no silent transport mutation).
+            shedOversizeImages: true,
+            // Sanitize: strip empty text blocks (`{type:'text',text:''}`) and drop any
+            // message left with no content. An empty-content turn (e.g. a silent/skip
+            // turn that produced no text) otherwise reaches the API as an empty text
+            // block → 400 "text content blocks must be non-empty", which throws in the
+            // speculative drain and stalls ALL compression. (Twin of the empty-summary
+            // recall-header guard — together they cover every source of the 400.)
+            messages: cleaned
+                .map(m => ({ participant: m.participant, content: stripThinkingBlocks(stripEmptyTextBlocks(m.content)) }))
+                .filter(m => m.content.length > 0),
             config: {
                 model: this.config.compressionModel ?? 'claude-sonnet-4-20250514',
-                maxTokens: Math.round(targetTokens * 1.5),
+                // Generous output ceiling so a memory-write is never truncated mid-thought:
+                // targetTokens is a *target*, not a cap, and adaptive models routinely
+                // overshoot a ~2k target. Was `* 1.5` (=3000 at the 2k default), which cut
+                // off rich memories (stop=max_tokens).
+                maxTokens: Math.max(16000, Math.round(targetTokens * 1.5)),
             },
+            // Declare the agent's live tools. A summarizer request that replays
+            // tool_use/tool_result history with NO tools param reads to Anthropic's
+            // safety classifier as a foreign agent trace being duplicated ->
+            // deterministic reasoning_extraction refusal of every memory-write
+            // (labclaude incident, 2026-07-09; 268 refusals). Declaring the same
+            // tools the live instance runs with is also strictly MORE faithful to
+            // the original context, so it is the KV-honest choice, not a
+            // workaround. Undefined before the first activation of a session --
+            // acceptable: those chunks stay raw and are retried after the agent's
+            // first turn (see the defer guard in compressChunkHierarchical).
+            tools: ctx.tools,
         };
         const callStart = Date.now();
         let logResponse;
@@ -1928,6 +2484,13 @@ export class AutobiographicalStrategy {
                 .map(b => b.text)
                 .join('\n');
             logResponse = mergedText;
+            // Empty merged generation: skip the merge entirely (do NOT push or mark
+            // sources merged) so we never store/recall an empty summary. Sources stay
+            // unmerged and can be retried.
+            if (!mergedText.trim()) {
+                console.warn(`[autobiographical] empty merged L${targetLevel} summary (${sources.length} sources) — skipping merge`);
+                return;
+            }
             // Compute source range from constituent summaries
             const sourceRange = {
                 first: sources[0].sourceRange.first,
@@ -1938,7 +2501,14 @@ export class AutobiographicalStrategy {
                 id: `L${targetLevel}-${this.nextSummaryIdCounter()}`,
                 level: targetLevel,
                 content: mergedText,
-                tokens: Math.ceil(mergedText.length / 4),
+                // Exact when available — see the L1 site.
+                tokens: response.usage?.outputTokens &&
+                    response.usage.outputTokens > 0 &&
+                    // outputTokens includes scratch thinking when present — only exact
+                    // when the whole response is the summary text itself.
+                    !response.content.some(b => b.type === 'thinking' || b.type === 'redacted_thinking')
+                    ? response.usage.outputTokens
+                    : Math.ceil(mergedText.length / 3),
                 sourceLevel,
                 sourceIds,
                 sourceRange,
@@ -2006,8 +2576,16 @@ export class AutobiographicalStrategy {
         this.rsBegin();
         const entries = [];
         const maxTokens = budget.maxTokens - budget.reserveForResponse;
+        const overBudgetGraceRatio = Math.max(0, this.config.overBudgetGraceRatio ?? 0);
+        const rejectionBudget = Math.floor(maxTokens * (1 + overBudgetGraceRatio));
+        // Closed-loop calibration: apply the persisted multiplier BEFORE any
+        // estimate is taken this compile.
+        this.loadCalibration(store);
         const messages = store.getAll();
         const msgCap = this.config.maxMessageTokens;
+        // Post-strip estimates (see postStripEstimates): every budgeting site in
+        // this method prices a message the way the stripped render will cost it.
+        const pse = this.postStripEstimates(store);
         // ----- 1. Build head/tail sets and emit head entries -----
         const headStart = this.getHeadWindowStartIndex(store);
         const headEnd = this.getHeadWindowEnd(store);
@@ -2021,8 +2599,8 @@ export class AutobiographicalStrategy {
         for (let i = headStart; i < headEnd && i < messages.length; i++) {
             const msg = messages[i];
             const content = msgCap > 0 ? this.truncateContent(msg.content, msgCap) : msg.content;
-            const tokens = msgCap > 0 ? Math.min(store.estimateTokens(msg), msgCap + 50) : store.estimateTokens(msg);
-            if (totalTokens + tokens > maxTokens)
+            const tokens = msgCap > 0 ? Math.min(pse[i], msgCap + 50) : pse[i];
+            if (totalTokens + tokens > rejectionBudget)
                 break;
             entries.push({
                 index: entries.length,
@@ -2043,7 +2621,7 @@ export class AutobiographicalStrategy {
         const effectiveRecentStart = Math.max(recentStart, headEnd);
         for (let i = effectiveRecentStart; i < messages.length; i++) {
             const msg = messages[i];
-            const tokens = msgCap > 0 ? Math.min(store.estimateTokens(msg), msgCap + 50) : store.estimateTokens(msg);
+            const tokens = msgCap > 0 ? Math.min(pse[i], msgCap + 50) : pse[i];
             tailMessageIds.add(msg.id);
             tailTokens += tokens;
         }
@@ -2075,8 +2653,8 @@ export class AutobiographicalStrategy {
             const msg = messages[i];
             const ch = chunksByMessageId.get(msg.id);
             const tokens = msgCap > 0
-                ? Math.min(store.estimateTokens(msg), msgCap + 50)
-                : store.estimateTokens(msg);
+                ? Math.min(pse[i], msgCap + 50)
+                : pse[i];
             const bound = pinBounds.get(i);
             pickerChunks.push({
                 id: msg.id,
@@ -2090,6 +2668,7 @@ export class AutobiographicalStrategy {
                 pinLevel: bound?.level,
                 pinMaxLevel: bound?.maxLevel,
                 l1Id: ch?.summaryId,
+                salience: AutobiographicalStrategy.staticSalience(msg),
             });
         }
         // Also include head and tail in PickerChunks (so token accounting matches)
@@ -2097,8 +2676,8 @@ export class AutobiographicalStrategy {
         for (let i = headStart; i < headEnd && i < messages.length; i++) {
             const msg = messages[i];
             const tokens = msgCap > 0
-                ? Math.min(store.estimateTokens(msg), msgCap + 50)
-                : store.estimateTokens(msg);
+                ? Math.min(pse[i], msgCap + 50)
+                : pse[i];
             pickerChunks.push({
                 id: msg.id,
                 sequence: i,
@@ -2112,8 +2691,8 @@ export class AutobiographicalStrategy {
         for (let i = effectiveRecentStart; i < messages.length; i++) {
             const msg = messages[i];
             const tokens = msgCap > 0
-                ? Math.min(store.estimateTokens(msg), msgCap + 50)
-                : store.estimateTokens(msg);
+                ? Math.min(pse[i], msgCap + 50)
+                : pse[i];
             pickerChunks.push({
                 id: msg.id,
                 sequence: i,
@@ -2160,6 +2739,14 @@ export class AutobiographicalStrategy {
         };
         const picker = this.buildPicker(pickerInputs);
         const result = picker.run(pickerInputs, foldingBudget);
+        // Every trust-region override is loud (design §13.4) — silence was half
+        // of the 2026-07-12 incident.
+        const plan = this._lastKvStable?.lastPlan();
+        if (plan?.override) {
+            console.error(`[kv-escalation] override=${plan.override} perturbation=${plan.perturbation}` +
+                ` tokens=${plan.tokens} budget=${foldingBudget.totalBudget}` +
+                ` (see adaptive-resolution-design.md §13.4)`);
+        }
         // Commit the new resolutions back to strategy state for next compile.
         // Persist to chronicle only if anything actually changed — avoids
         // unnecessary state-slot writes on no-op compiles (which is the common
@@ -2201,9 +2788,9 @@ export class AutobiographicalStrategy {
         // an OverBudgetError to the host rather than silently dropping entries.
         // The strategy has done all it can; the application has to decide what
         // to do next (raise budget, switch model, drop windows, etc.).
-        if (result.exhausted && result.finalTokens > totalBudget) {
+        if (result.exhausted && result.finalTokens > rejectionBudget) {
             throw new OverBudgetError({
-                budget: totalBudget,
+                budget: rejectionBudget,
                 actual: result.finalTokens,
                 diagnostics: {
                     headTokens,
@@ -2254,7 +2841,7 @@ export class AutobiographicalStrategy {
                         // (`maxMessageTokens` is for per-message caps on chat / tool
                         // results, not for sharded bodyGroup composites.)
                         const tokens = this.estimateTokens(content);
-                        if (totalTokens + tokens > maxTokens) {
+                        if (totalTokens + tokens > rejectionBudget) {
                             currentRun = null;
                             return false;
                         }
@@ -2287,7 +2874,7 @@ export class AutobiographicalStrategy {
                                 sourceRelation: 'derived',
                             };
                             const pairTokens = this.estimateTokens(questionEntry.content) + this.estimateTokens(answerEntry.content);
-                            if (totalTokens + pairTokens > maxTokens) {
+                            if (totalTokens + pairTokens > rejectionBudget) {
                                 currentRun = null;
                                 return false;
                             }
@@ -2357,8 +2944,8 @@ export class AutobiographicalStrategy {
             const resolution = result.finalResolutions.get(msg.id) ?? 0;
             if (resolution === 0) {
                 const content = msgCap > 0 ? this.truncateContent(msg.content, msgCap) : msg.content;
-                const tokens = msgCap > 0 ? Math.min(store.estimateTokens(msg), msgCap + 50) : store.estimateTokens(msg);
-                if (totalTokens + tokens > maxTokens)
+                const tokens = msgCap > 0 ? Math.min(pse[i], msgCap + 50) : pse[i];
+                if (totalTokens + tokens > rejectionBudget)
                     break;
                 entries.push({
                     index: entries.length,
@@ -2375,8 +2962,8 @@ export class AutobiographicalStrategy {
                 const ancestor = this.findAncestorAt(msg.id, resolution, chunksByMessageId, summariesById);
                 if (!ancestor) {
                     const content = msgCap > 0 ? this.truncateContent(msg.content, msgCap) : msg.content;
-                    const tokens = msgCap > 0 ? Math.min(store.estimateTokens(msg), msgCap + 50) : store.estimateTokens(msg);
-                    if (totalTokens + tokens > maxTokens)
+                    const tokens = msgCap > 0 ? Math.min(pse[i], msgCap + 50) : pse[i];
+                    if (totalTokens + tokens > rejectionBudget)
                         break;
                     entries.push({
                         index: entries.length,
@@ -2409,7 +2996,7 @@ export class AutobiographicalStrategy {
                     sourceRelation: 'derived',
                 };
                 const pairTokens = this.estimateTokens(questionEntry.content) + this.estimateTokens(answerEntry.content);
-                if (totalTokens + pairTokens > maxTokens)
+                if (totalTokens + pairTokens > rejectionBudget)
                     break;
                 entries.push(questionEntry);
                 entries.push(answerEntry);
@@ -2419,7 +3006,7 @@ export class AutobiographicalStrategy {
             }
         }
         // ----- 6. Emit tail entries newest-first eviction (matches existing behavior) -----
-        const tailStats = this.emitRecentNewestFirst(entries, store, messages, effectiveRecentStart, msgCap, maxTokens, totalTokens);
+        const tailStats = this.emitRecentNewestFirst(entries, store, messages, effectiveRecentStart, msgCap, rejectionBudget, totalTokens, pse);
         this.rsRaw('tail', tailStats.tokens, tailStats.messages);
         // ----- 7. Post-process: merge consecutive raw entries from the same bodyGroup -----
         // Both head and tail emission paths emit shards as separate ContextEntries.
@@ -2430,6 +3017,13 @@ export class AutobiographicalStrategy {
         const merged = this.mergeAdjacentBodyGroupRaw(entries, store);
         this.pruneToolEntries(merged);
         this.trimOrphanedToolUse(merged);
+        // Full pairing invariant over the final rendered context — catches the
+        // mid-list orphans the trailing/leading trims can't (bug 6.7). The adaptive
+        // path has the same mid-list orphan producers as hierarchical (budget
+        // `break`s between pair members, raw emission interleaved with recall
+        // pairs), and FKM defaults autobiographical strategies onto this path — so
+        // the guard has to run here too. It's a no-op on already-valid output.
+        this.enforceToolPairing(merged);
         // Strip stale images BEFORE placing markers and committing stats, so both
         // describe the post-strip context the agent actually receives.
         this.applyImageStripping(merged, store);
@@ -2440,8 +3034,91 @@ export class AutobiographicalStrategy {
         // placement is the dominant KV lever).
         this.placeCacheMarkers(merged, headMessageIds, tailMessageIds);
         this.rsEnd();
+        // Closed-loop calibration bookkeeping: the committed render stats total
+        // (in CURRENT calibrated units) is what this compile claims the request
+        // will cost — reportRealInputTokens compares provider usage against it.
+        this._storeView = store;
+        const rs = this.getRenderStats(store);
+        this._lastCompileEstimate =
+            rs.head.tokens + rs.tail.tokens + rs.middleRaw.tokens +
+                rs.summaries.l1.tokens + rs.summaries.l2.tokens + rs.summaries.l3.tokens;
+        this._calibrationArmed = true; // exactly one sample per compile
         return merged;
     }
+    _lastCompileEstimate = 0;
+    _storeView = null;
+    /**
+     * Closed-loop estimator calibration (2026-07-12). Feed the REAL input total
+     * for a request built from the latest compile (fresh + cache_read +
+     * cache_creation, minus non-window overhead the caller knows about, e.g.
+     * tool schemas). Maintains an EMA of real/estimated and applies it as the
+     * store's global multiplier, persisted across restarts. The per-class rates
+     * carry the shape; this carries the residual level.
+     */
+    reportRealInputTokens(realTotal) {
+        if (!Number.isFinite(realTotal) || realTotal <= 0)
+            return;
+        const est = this._lastCompileEstimate;
+        if (!est || est <= 0)
+            return;
+        // ARM-ONCE-PER-COMPILE (2026-07-12 regression fix). A turn makes MANY API
+        // calls — tool-use rounds and max_tokens continuations each append to the
+        // request — so only the FIRST completion after a compile was built from
+        // the window this estimate describes. Feeding later calls compares a grown
+        // request against the original estimate: ratios of 2.0-2.3 (est=224k
+        // real=504k) drove the multiplier 1.0 -> 2.37 in minutes, inflating every
+        // estimate (the fold floor went 62k -> 108k on unchanged content) and
+        // exhausting the picker on every wake. One sample per compile, always.
+        if (!this._calibrationArmed)
+            return;
+        this._calibrationArmed = false;
+        const ratio = realTotal / est;
+        // SANITY BAND: a representative sample sits near 1. Anything wilder is a
+        // structural mismatch (a request we didn't compile, a partial compile, a
+        // provider quirk) — never evidence about chars-per-token. Log, don't learn.
+        if (ratio < 0.6 || ratio > 1.8) {
+            console.error(`[estimator-calibration] REJECTED out-of-band sample real/est=${ratio.toFixed(2)} ` +
+                `(est=${Math.round(est / 1000)}k real=${Math.round(realTotal / 1000)}k) — ` +
+                `not a window-shaped request; multiplier stays ${this._calibration.toFixed(2)}`);
+            return;
+        }
+        const current = this._calibration;
+        const observed = ratio * current; // back out the multiplier already applied
+        const alpha = 0.2; // slow EMA: one wild request shouldn't yank the ruler
+        const next = current + alpha * (observed - current);
+        const clamped = Math.min(1.8, Math.max(0.6, next));
+        if (Math.abs(clamped - current) / current > 0.02) {
+            console.error(`[estimator-calibration] real/est=${ratio.toFixed(2)} ` +
+                `multiplier ${current.toFixed(2)} -> ${clamped.toFixed(2)} (est=${Math.round(est / 1000)}k real=${Math.round(realTotal / 1000)}k)`);
+        }
+        this._calibration = clamped;
+        this.applyCalibration();
+        try {
+            this.store?.setStateJson(this.calibrationStateId, { multiplier: this._calibration, at: Date.now() });
+        }
+        catch { /* persistence is best-effort */ }
+    }
+    _calibrationArmed = false;
+    _calibration = 1;
+    _calibrationLoaded = false;
+    applyCalibration() {
+        this._storeView?.setTokenCalibration?.(this._calibration);
+    }
+    /** Load the persisted multiplier once and push it into the store view. */
+    loadCalibration(store) {
+        this._storeView = store;
+        if (!this._calibrationLoaded) {
+            this._calibrationLoaded = true;
+            try {
+                const saved = this.store?.getStateJson(this.calibrationStateId);
+                if (saved && Number.isFinite(saved.multiplier)) {
+                    this._calibration = Math.min(1.8, Math.max(0.6, saved.multiplier));
+                }
+            }
+            catch { /* absent slot is fine */ }
+        }
+        this.applyCalibration();
+    }
     /**
      * Place up to four `cache_control` breakpoints across the final ordered
      * entries: the head/system boundary, the end of the folded history (the
@@ -2496,13 +3173,23 @@ export class AutobiographicalStrategy {
     mergeAdjacentBodyGroupRaw(entries, store) {
         if (entries.length === 0)
             return entries;
-        // Look up bodyGroupId by sourceMessageId via the message store.
-        const groupOf = (sourceMessageId) => {
+        // Look up bodyGroup metadata by sourceMessageId, memoized for the
+        // duration of this pass. Entries reference the same messages repeatedly
+        // (run-extension checks + the shardIndex sort comparator below), and
+        // store.get() also resolves blobs — fetch each message at most once.
+        const shardMeta = new Map();
+        const metaOf = (sourceMessageId) => {
             if (!sourceMessageId)
                 return undefined;
-            const m = store.get(sourceMessageId);
-            return m?.bodyGroupId;
+            let meta = shardMeta.get(sourceMessageId);
+            if (!meta) {
+                const m = store.get(sourceMessageId);
+                meta = { groupId: m?.bodyGroupId, shardIndex: m?.shardIndex };
+                shardMeta.set(sourceMessageId, meta);
+            }
+            return meta;
         };
+        const groupOf = (sourceMessageId) => metaOf(sourceMessageId)?.groupId;
         const out = [];
         let i = 0;
         while (i < entries.length) {
@@ -2531,9 +3218,9 @@ export class AutobiographicalStrategy {
             // ordering. (Head/tail emission keeps chronological order, but defending
             // against reorderings is cheap.)
             const sortedRun = [...run].sort((a, b) => {
-                const ma = a.sourceMessageId ? store.get(a.sourceMessageId) : null;
-                const mb = b.sourceMessageId ? store.get(b.sourceMessageId) : null;
-                return (ma?.shardIndex ?? 0) - (mb?.shardIndex ?? 0);
+                const sa = metaOf(a.sourceMessageId)?.shardIndex ?? 0;
+                const sb = metaOf(b.sourceMessageId)?.shardIndex ?? 0;
+                return sa - sb;
             });
             // Build merged text content. Non-text blocks (rare in shards) are
             // preserved on the first shard's entry only.
@@ -2579,13 +3266,83 @@ export class AutobiographicalStrategy {
      */
     buildPicker(inputs) {
         if (this.config.foldingStrategy === 'kv-stable') {
-            return new Picker(new KvStableStrategy(inputs, {
+            const strategy = new KvStableStrategy(inputs, {
                 reachTokens: this.config.kvStableReachTokens,
+                qualityGapRatio: this.config.kvStableQualityGapRatio,
                 mergeThreshold: this.config.mergeThreshold,
-            }));
+            });
+            this._lastKvStable = strategy;
+            return new Picker(strategy);
         }
+        this._lastKvStable = null;
         return this.getAdaptivePicker();
     }
+    /** The kv-stable strategy instance behind the most recent compile — kept for
+     *  `[kv-escalation]` observability (design §13.4: every override is loud). */
+    _lastKvStable = null;
+    /**
+     * Static salience prior (design §13.3) — "is the window the only copy?".
+     * Content whose payload is externalized folds cheap: tool blocks
+     * (re-derivable), fenced code (usually written to disk), images (the file/
+     * CDN keeps them), bare link drops. Conversation exists nowhere but the
+     * chronicle, so it stays at 1. Returns a value in [0.2, 1]; cheap,
+     * deterministic, computed per message at picker-input construction.
+     */
+    static staticSalience(msg) {
+        let totalChars = 0;
+        let externalChars = 0;
+        for (const block of msg.content) {
+            const b = block;
+            switch (b.type) {
+                case 'text': {
+                    const t = b.text ?? '';
+                    totalChars += t.length;
+                    // Fenced code blocks.
+                    const fences = t.split('```');
+                    for (let i = 1; i < fences.length; i += 2)
+                        externalChars += fences[i].length;
+                    // Bare link-drop lines (the URL is the payload).
+                    for (const line of t.split('\n')) {
+                        const trimmed = line.trim();
+                        if (/^https?:\/\/\S+$/.test(trimmed))
+                            externalChars += trimmed.length;
+                    }
+                    break;
+                }
+                case 'tool_use': {
+                    const n = JSON.stringify(b.input ?? {}).length;
+                    totalChars += n;
+                    externalChars += n;
+                    break;
+                }
+                case 'tool_result': {
+                    const n = typeof b.content === 'string'
+                        ? b.content.length
+                        : JSON.stringify(b.content ?? '').length;
+                    totalChars += n;
+                    externalChars += n;
+                    break;
+                }
+                case 'image': {
+                    // Estimate parity with the renderer's flat image cost; the payload
+                    // lives in the file/CDN, so it is fully externalized.
+                    totalChars += 6400; // ≈1600 tokens × 4 chars
+                    externalChars += 6400;
+                    break;
+                }
+                default: {
+                    const t = b.text ?? '';
+                    totalChars += t.length;
+                }
+            }
+        }
+        if (totalChars <= 0)
+            return 1;
+        const externalized = Math.min(1, externalChars / totalChars);
+        // Fully-externalized content bottoms out at 0.2 — cheap, never free
+        // (hard protections, not salience, are what make content unfoldable).
+        return Math.max(0.2, 1 - 0.8 * externalized);
+    }
     /**
      * Walk the summary tree to find the L_k ancestor of a message.
      * Returns null if no ancestor exists at that level (e.g., L_k not yet produced).
@@ -2735,6 +3492,85 @@ export class AutobiographicalStrategy {
         const { selected: l1Selected, tokensUsed: l1Used } = this.selectL1Summaries(shownL1, l1Effective, l1Remaining);
         selectedSummaries.push(...l1Selected);
         totalSummaryTokens += l1Used;
+        // Phase 3b: coverage repair (bug 6.9). getAntiRedundantSummaries excluded
+        // an L2 (or L3) when ALL of its children were in the CANDIDATE shown-set —
+        // computed before budget selection. If the budget then dropped some of
+        // those children (e.g. KnowledgeStrategy's research L1 cap), the covered
+        // history appears at NEITHER level: a silent memory hole. Re-include any
+        // excluded L2/L3 whose children did not all make the final selection.
+        // Some overlap with the children that DID survive is accepted — coverage
+        // beats perfect dedup here.
+        //
+        // Repairs are additionally bounded by a per-level ALLOWANCE (a fraction of
+        // that level's budget), not just the overall context budget. The
+        // excluded-with-partially-dropped-children state only arises from a store
+        // damaged mid-merge (the crash window at compressChunkHierarchical, or the
+        // legacy setMergedInto index-desync). On such a store MANY L2s can be in
+        // this state at once; without a cap, re-including all of them at full size
+        // would starve the recent window via Phase 4's newest-first eviction. When
+        // repairs exceed the allowance we stop re-including and warn — a corrupted
+        // store announces itself instead of silently trading recent messages for
+        // redundant summaries.
+        {
+            // Allowance = a fraction of the level budget, with a floor tied to the
+            // overall budget so a strategy that zeroes a level budget (e.g.
+            // KnowledgeStrategy prioritising L1) can still repair a handful of
+            // covering summaries, while a corrupted store with dozens of them stays
+            // bounded well short of the recent window.
+            const REPAIR_ALLOWANCE_FRACTION = 0.25;
+            const REPAIR_FLOOR_FRACTION = 0.05;
+            const repairFloor = maxTokens * REPAIR_FLOOR_FRACTION;
+            const l2RepairAllowance = Math.max(l2Budget * REPAIR_ALLOWANCE_FRACTION, repairFloor);
+            const l3RepairAllowance = Math.max(l3Budget * REPAIR_ALLOWANCE_FRACTION, repairFloor);
+            const selectedIds = new Set(selectedSummaries.map(s => s.id));
+            const shownL2Ids = new Set(shownL2.map(s => s.id));
+            const shownL3Ids = new Set(shownL3.map(s => s.id));
+            let l2RepairTokens = 0;
+            let l3RepairTokens = 0;
+            let l2RepairsSkipped = 0;
+            let l3RepairsSkipped = 0;
+            // L2s excluded by anti-redundancy: unmerged, not in shownL2.
+            for (const s of this.summaries) {
+                if (s.level !== 2 || s.mergedInto || shownL2Ids.has(s.id))
+                    continue;
+                if (s.sourceIds.every(id => selectedIds.has(id)))
+                    continue; // truly redundant
+                if (this.isOverBudget(totalTokens + totalSummaryTokens + s.tokens, maxTokens))
+                    continue;
+                if (l2RepairTokens + s.tokens > l2RepairAllowance) {
+                    l2RepairsSkipped++;
+                    continue;
+                }
+                selectedSummaries.push(s);
+                totalSummaryTokens += s.tokens;
+                l2RepairTokens += s.tokens;
+                selectedIds.add(s.id);
+            }
+            // L3s excluded by anti-redundancy — after L2 repair, so a repaired L2
+            // counts as selected coverage for its parent L3.
+            for (const s of this.summaries) {
+                if (s.level !== 3 || s.mergedInto || shownL3Ids.has(s.id))
+                    continue;
+                if (s.sourceIds.every(id => selectedIds.has(id)))
+                    continue;
+                if (this.isOverBudget(totalTokens + totalSummaryTokens + s.tokens, maxTokens))
+                    continue;
+                if (l3RepairTokens + s.tokens > l3RepairAllowance) {
+                    l3RepairsSkipped++;
+                    continue;
+                }
+                selectedSummaries.push(s);
+                totalSummaryTokens += s.tokens;
+                l3RepairTokens += s.tokens;
+                selectedIds.add(s.id);
+            }
+            if (l2RepairsSkipped > 0 || l3RepairsSkipped > 0) {
+                console.warn(`[AutobiographicalStrategy] coverage-repair allowance exceeded — ` +
+                    `skipped ${l2RepairsSkipped} L2 and ${l3RepairsSkipped} L3 re-inclusions ` +
+                    `(store likely corrupted mid-merge). Some covered history may render at ` +
+                    `no summary level this pass.`);
+            }
+        }
         // Emit summaries + pinned messages between head and recent windows.
         //
         // Default (positionedRecallPairs=true): one Q/A pair per summary,
@@ -2812,6 +3648,11 @@ export class AutobiographicalStrategy {
                 for (const item of items) {
                     if (item.kind === 'summary') {
                         const summary = item.summary;
+                        // Defensive: never emit a recall pair for an empty/bugged summary — an
+                        // empty assistant text block triggers a 400. (Production guards too,
+                        // but a legacy empty summary may already exist in the store.)
+                        if (!summary.content || !summary.content.trim())
+                            continue;
                         const headerText = this.buildRecallHeader(summary);
                         const questionEntry = {
                             index: entries.length,
@@ -2916,6 +3757,9 @@ export class AutobiographicalStrategy {
         const tailStats = this.emitRecentNewestFirst(entries, store, messages, effectiveRecentStart, msgCap, maxTokens, totalTokens);
         this.rsRaw('tail', tailStats.tokens, tailStats.messages);
         this.trimOrphanedToolUse(entries);
+        // Full pairing invariant over the final rendered context — catches the
+        // mid-list orphans the trailing/leading trims can't (bug 6.7).
+        this.enforceToolPairing(entries);
         this.pruneToolEntries(entries);
         // Strip stale images before committing stats so RenderStats.total reflects
         // the post-strip context (this path places no cache markers).
@@ -3189,24 +4033,81 @@ export class AutobiographicalStrategy {
         return out;
     }
     /**
-     * Rebuild chunk boundaries based on current messages.
+     * Rebuild the chunk list: persisted records own the past; the running-sum
+     * chunker only extends at the frontier, and a chunk is only ever created
+     * once it CLOSES (reaches targetChunkTokens). The trailing partial chunk
+     * is never created and never compressed — eager partial-tail compression
+     * minted a new near-duplicate L1 per rebuild while the tail grew (the
+     * prefix-generation families found fleet-wide in the 2026-07 audit).
      */
     rebuildChunks(store) {
-        const messagesToChunk = this.getCompressibleMessages(store);
-        // Preserve existing compressed chunks (legacy) and summary linkage (hierarchical)
-        const existingCompressed = new Map();
+        this.chunks = [];
+        this.compressionQueue = [];
+        // ---- 1. Materialize persisted records (they OWN their messages). ----
+        const byId = new Map();
+        for (const m of store.getAll())
+            byId.set(m.id, m);
+        const consumed = new Set();
+        let orphaned = 0;
+        for (const rec of this.chunkRecords) {
+            const msgs = [];
+            for (const id of rec.sourceIds) {
+                const m = byId.get(id);
+                if (m)
+                    msgs.push(m);
+            }
+            if (msgs.length === 0) {
+                orphaned++;
+                continue;
+            }
+            for (const m of msgs)
+                consumed.add(m.id);
+            const chunk = {
+                index: this.chunks.length,
+                startIndex: -1, // record-derived; filtered-array indices are not meaningful
+                endIndex: -1,
+                messages: msgs,
+                tokens: msgs.reduce((sum, m) => sum + (this.config.attachmentsIgnoreSize
+                    ? this.estimateTextOnlyTokens(m)
+                    : store.estimateTokens(m)), 0),
+                compressed: rec.compressed,
+                summaryId: rec.summaryId,
+                phaseType: rec.phaseType,
+                recordId: rec.id,
+            };
+            this.chunks.push(chunk);
+        }
+        // ---- 2. Fail closed on the chain-break signature. ----
+        // Most records resolving to zero live messages means message identity
+        // has been rebuilt/renumbered underneath us. Chunking "fresh" ground now
+        // would re-compress already-lived history into duplicate memories.
+        // Halt ALL compression until an operator reconciles the store.
+        if (this.chunkPersistenceEnabled && this.chunkRecords.length >= 3 &&
+            orphaned / this.chunkRecords.length > 0.5) {
+            this.chunkRecordsOrphaned = true;
+            this.compressionQueue = [];
+            if (!this._orphanWarned) {
+                this._orphanWarned = true;
+                console.error(`[autobiographical] FAIL-CLOSED: ${orphaned}/${this.chunkRecords.length} chunk ` +
+                    `records resolve to zero live messages (messages chain break / store ` +
+                    `reconciliation signature). Compression halted to prevent duplicate ` +
+                    `memory formation — reconcile the store before resuming.`);
+            }
+            return;
+        }
+        this.chunkRecordsOrphaned = false;
+        // Queue uncompressed record-backed chunks (crash-recovery: record was
+        // appended but the process died before its L1 landed).
         for (const chunk of this.chunks) {
-            if (chunk.compressed) {
-                const key = this.chunkKey(chunk);
-                existingCompressed.set(key, chunk);
+            if (!chunk.compressed && !(chunk.recordId && this._overlapBlocked.has(chunk.recordId))) {
+                this.compressionQueue.push(chunk.index);
             }
         }
-        // Rebuild chunks
-        this.chunks = [];
-        this.compressionQueue = [];
+        // ---- 3. Chunk the frontier: compressible messages not owned by any record. ----
+        const messagesToChunk = this.getCompressibleMessages(store)
+            .filter(m => !consumed.has(m.id));
         let currentChunk = [];
         let currentTokens = 0;
-        // Track start position in the filtered array for chunk boundary metadata
         let chunkFilteredStart = 0;
         for (let i = 0; i < messagesToChunk.length; i++) {
             const msg = messagesToChunk[i];
@@ -3229,22 +4130,53 @@ export class AutobiographicalStrategy {
                 continue;
             }
             if (shouldClose) {
-                const chunk = this.createChunk(this.chunks.length, chunkFilteredStart, i + 1, currentChunk, currentTokens, existingCompressed);
-                this.chunks.push(chunk);
-                if (!chunk.compressed) {
-                    this.compressionQueue.push(chunk.index);
+                const chunk = {
+                    index: this.chunks.length,
+                    startIndex: chunkFilteredStart,
+                    endIndex: i + 1,
+                    messages: [...currentChunk],
+                    tokens: currentTokens,
+                    compressed: false,
+                };
+                // Persist the boundary the moment it closes — from here on this
+                // span is owned and never re-keyed by config drift or restarts.
+                if (this.chunkPersistenceEnabled) {
+                    const record = {
+                        id: `c-${this.chunkIdCounter++}`,
+                        sourceIds: chunk.messages.map(m => m.id),
+                        compressed: false,
+                    };
+                    this.appendChunkRecord(record);
+                    chunk.recordId = record.id;
                 }
+                this.chunks.push(chunk);
+                this.compressionQueue.push(chunk.index);
                 currentChunk = [];
                 currentTokens = 0;
                 chunkFilteredStart = i + 1;
             }
         }
-        if (currentChunk.length >= 4) {
-            const chunk = this.createChunk(this.chunks.length, chunkFilteredStart, messagesToChunk.length, currentChunk, currentTokens, existingCompressed);
-            this.chunks.push(chunk);
-            if (!chunk.compressed) {
-                this.compressionQueue.push(chunk.index);
-            }
+        // NOTE: no trailing-partial chunk. An unclosed chunk is not a chunk —
+        // it compresses only after the running sum closes it.
+        // ---- 4. L1 holdback: keep the newest X closed chunks out of the
+        // speculative queue (default 1). The chunk at the live edge is the one
+        // most likely to still be in motion (edits, tool-result landings, the
+        // episode it belongs to still resolving); summarize it once a newer chunk
+        // has closed behind it. The queue is rebuilt on every message, so a
+        // held-back chunk is released automatically the moment it ages out of the
+        // window. Demand overrides: a picker `produce` op (enqueueL1ForRange)
+        // marks the chunk demanded, and demanded chunks are never held back —
+        // when folding actually NEEDS the L1, production must not be blocked.
+        const holdback = this.config.l1HoldbackChunks ?? 1;
+        if (holdback > 0 && this.chunks.length > 0) {
+            const cutoff = this.chunks.length - holdback;
+            this.compressionQueue = this.compressionQueue.filter((idx) => {
+                if (idx < cutoff)
+                    return true;
+                const ch = this.chunks[idx];
+                const lastId = ch?.messages[ch.messages.length - 1]?.id;
+                return lastId !== undefined && this._demandedL1Chunks.has(lastId);
+            });
         }
     }
     /**
@@ -3325,7 +4257,8 @@ export class AutobiographicalStrategy {
     applyImageStripping(entries, store) {
         const maxLive = this.config.maxLiveImages ?? 0; // 0 = unlimited count
         const depthTokens = this.config.imageStripDepthTokens ?? 0; // 0 = no depth strip
-        if (maxLive === 0 && depthTokens === 0)
+        const maxLiveBytes = this.config.maxLiveImageBytes ?? AutobiographicalStrategy.DEFAULT_MAX_LIVE_IMAGE_BYTES;
+        if (maxLive === 0 && depthTokens === 0 && maxLiveBytes === 0)
             return; // policy disabled
         const messages = store.getAll();
         const posById = new Map();
@@ -3357,6 +4290,7 @@ export class AutobiographicalStrategy {
             .filter(({ idx }) => this.hasImageBlock(entries[idx].content))
             .sort((a, b) => b.pos - a.pos);
         let keptImages = 0;
+        let keptImageBytes = 0;
         for (const { idx, pos } of ordered) {
             const entry = entries[idx];
             const tooDeep = depthTokens > 0 && (pos < 0 || pos < stripStart);
@@ -3364,26 +4298,86 @@ export class AutobiographicalStrategy {
             entry.content = entry.content.map((block) => {
                 if (block.type !== 'image')
                     return block;
+                const blockBytes = AutobiographicalStrategy.imageBlockBytes(block);
                 const overCount = maxLive > 0 && keptImages >= maxLive;
-                if (tooDeep || overCount) {
-                    // The renderer estimates an image at `tokenEstimate ?? 1600` (see
-                    // message-store/context-log). Hand that back to the bucket, less the
-                    // placeholder text that replaces it, so the stats match the output.
-                    const reclaimed = (block.tokenEstimate ?? 1600) - placeholderTokens;
-                    if (this._rs && reclaimed > 0)
-                        this._rs[bucket].tokens -= reclaimed;
+                const overBytes = maxLiveBytes > 0 && keptImageBytes + blockBytes > maxLiveBytes;
+                if (tooDeep || overCount || overBytes) {
+                    // Stats-neutral (2026-07-12): every budgeting site now tallies at
+                    // POST-STRIP prices (see postStripEstimates), so the bucket never
+                    // charged this image at full weight — reclaiming here would
+                    // double-decrement. The strip pass only swaps the block.
+                    void bucket;
+                    void placeholderTokens;
                     return { type: 'text', text: AutobiographicalStrategy.IMAGE_PLACEHOLDER };
                 }
                 keptImages++;
+                keptImageBytes += blockBytes;
                 return block;
             });
         }
     }
+    /**
+     * Post-strip token estimate per message index (2026-07-12 tail-starvation
+     * fix). Mirrors `applyImageStripping`: an image beyond the `maxLiveImages`
+     * newest (counted newest-first) or deeper than `imageStripDepthTokens` of
+     * raw estimate from the live end renders as a placeholder — so every place
+     * that BUDGETS messages (recent-window walk-back, head/tail sums, middle
+     * chunk sizes) must cost it as one. Pricing stripped images at their full
+     * estimate collapsed an image-dense tail to a fraction of its configured
+     * size (42k rendered of a 120k window), and pricing them post-strip in the
+     * walk-back alone made the picker's raw-priced tail overflow the budget
+     * (318k) — the estimate must be consistent EVERYWHERE.
+     */
+    postStripEstimates(store) {
+        const messages = store.getAll();
+        const out = new Array(messages.length);
+        const stripDepth = this.config.imageStripDepthTokens ?? 0;
+        const maxLive = this.config.maxLiveImages ?? 0;
+        const maxLiveBytes = this.config.maxLiveImageBytes ?? AutobiographicalStrategy.DEFAULT_MAX_LIVE_IMAGE_BYTES;
+        const stripActive = stripDepth > 0 || maxLive > 0 || maxLiveBytes > 0;
+        const placeholderTokens = Math.ceil(AutobiographicalStrategy.IMAGE_PLACEHOLDER.length / 4);
+        let liveImagesSeen = 0;
+        let liveImageBytes = 0;
+        let rawDepth = 0; // raw-estimate depth from the newest message (mirrors getImageStripStart)
+        for (let i = messages.length - 1; i >= 0; i--) {
+            const raw = store.estimateTokens(messages[i]);
+            let est = raw;
+            if (stripActive) {
+                for (const b of messages[i].content) {
+                    if (b.type !== 'image')
+                        continue;
+                    const bytes = AutobiographicalStrategy.imageBlockBytes(b);
+                    const beyondDepth = stripDepth > 0 && rawDepth > stripDepth;
+                    const beyondCount = maxLive > 0 && liveImagesSeen >= maxLive;
+                    const beyondBytes = maxLiveBytes > 0 && liveImageBytes + bytes > maxLiveBytes;
+                    if (beyondDepth || beyondCount || beyondBytes) {
+                        const imgEst = b.tokenEstimate ?? 1600;
+                        est -= Math.max(0, imgEst - placeholderTokens);
+                    }
+                    else {
+                        liveImagesSeen++;
+                        liveImageBytes += bytes;
+                    }
+                }
+            }
+            rawDepth += raw;
+            out[i] = est;
+        }
+        return out;
+    }
+    /** Byte wall default: 20MB of base64 (API total-request cap is 32MB). */
+    static DEFAULT_MAX_LIVE_IMAGE_BYTES = 20 * 1024 * 1024;
+    /** Base64 payload size of an image block (0 for non-base64 sources). */
+    static imageBlockBytes(b) {
+        const src = b.source;
+        return typeof src?.data === 'string' ? src.data.length : 0;
+    }
     getRecentWindowStart(store) {
         const messages = store.getAll();
+        const pse = this.postStripEstimates(store);
         let tokens = 0;
         for (let i = messages.length - 1; i >= 0; i--) {
-            tokens += store.estimateTokens(messages[i]);
+            tokens += pse[i];
             if (tokens > this.config.recentWindowTokens) {
                 let boundary = i + 1;
                 // Don't split a tool_use/tool_result pair: if the message at the boundary
@@ -3464,6 +4458,171 @@ export class AutobiographicalStrategy {
             }
         }
     }
+    /** Placeholder body for a stub tool_result inserted by enforceToolPairing. */
+    static STUB_TOOL_RESULT_TEXT = '[tool result unavailable — omitted during context compression]';
+    /**
+     * Final post-selection tool-pairing validator (bug 6.7).
+     *
+     * The Anthropic API requires every `tool_use` block to be answered by a
+     * matching `tool_result` in the immediately-following message, and every
+     * `tool_result` to answer a `tool_use` in the immediately-preceding
+     * message. Selection can violate this mid-list in ways the trailing
+     * (`trimOrphanedToolUse`) and leading orphan trims don't catch:
+     *
+     *   - a budget `break` cutting between a raw pin pair's two messages;
+     *   - the uncompressed-chunk fallback emitting a raw tool_result whose
+     *     tool_use chunk already compressed (or vice versa);
+     *   - a recall pair or pin interleaving between a tool_use and its result.
+     *
+     * Repair policy prefers preserving content over dropping:
+     *
+     *   - a tool_use whose result is missing from the next entry first triggers
+     *     a short look-ahead: if the genuine (displaced) result is a few entries
+     *     down it is MOVED up into position (see
+     *     {@link relocateOrDropMissingResults}); only when no real result exists
+     *     is a STUB tool_result emitted. Either way the result block is merged
+     *     into the next entry when that entry already carries results for this
+     *     cycle, or inserted as a new user entry;
+     *   - a tool_result whose tool_use is not in the immediately-preceding
+     *     entry (and was not relocated) is dropped — there is no safe way to
+     *     stub a tool_use, so the result's information content survives only if
+     *     its use is adjacent; an entry left empty is replaced with a
+     *     placeholder text block.
+     *
+     * Runs as a structural pass over the rendered context in BOTH render
+     * paths — `selectHierarchical` (downstream of `selectL1Summaries`, so
+     * subclass overrides like KnowledgeStrategy are covered) and
+     * `selectAdaptive` (the path FKM defaults onto). It's a no-op on
+     * already-valid output.
+     */
+    enforceToolPairing(entries) {
+        let prevUseIds = new Set();
+        for (let i = 0; i < entries.length; i++) {
+            const entry = entries[i];
+            // --- Rule A: every tool_result must answer a tool_use in the
+            // immediately-preceding entry (and only once). Drop orphans/dupes. ---
+            if (entry.content.some(b => b.type === 'tool_result')) {
+                const seen = new Set();
+                const filtered = entry.content.filter(b => {
+                    if (b.type !== 'tool_result')
+                        return true;
+                    if (!prevUseIds.has(b.toolUseId) || seen.has(b.toolUseId))
+                        return false;
+                    seen.add(b.toolUseId);
+                    return true;
+                });
+                if (filtered.length !== entry.content.length) {
+                    entry.content = filtered.length > 0
+                        ? filtered
+                        : [{ type: 'text', text: '[tool call omitted]' }];
+                }
+            }
+            // --- Rule B: every tool_use in the PREVIOUS entry must be answered
+            // by this entry. Stub any that aren't. ---
+            if (prevUseIds.size > 0) {
+                const answered = new Set();
+                for (const b of entry.content) {
+                    if (b.type === 'tool_result')
+                        answered.add(b.toolUseId);
+                }
+                const missing = [...prevUseIds].filter(id => !answered.has(id));
+                if (missing.length > 0) {
+                    // Look-ahead relocation: the genuine result for a "missing" id is
+                    // often sitting a few entries down, displaced by an interleaved
+                    // recall pair / pin (it will otherwise be dropped as an orphan by
+                    // Rule A when we reach it). Move the real block up into position and
+                    // only stub the ids for which no real result exists — so tool output
+                    // is preserved, not silently replaced by a placeholder.
+                    const results = this.relocateOrDropMissingResults(entries, i, missing);
+                    if (answered.size > 0) {
+                        // This entry already carries results for the cycle — prepend the
+                        // relocated/stub results so all results for the preceding tool_use
+                        // sit together (the API wants tool_result blocks at the head of
+                        // the message).
+                        entry.content = [...results, ...entry.content];
+                    }
+                    else {
+                        // Not a results entry at all — insert a synthetic user entry
+                        // between the tool_use entry and this one.
+                        entries.splice(i, 0, {
+                            index: i,
+                            participant: 'user',
+                            sourceRelation: 'derived',
+                            content: results,
+                        });
+                        // The stub entry (no tool_use blocks) is now at index i; the
+                        // current entry moved to i+1 and is re-processed next iteration
+                        // with an empty prevUseIds (its orphan results, if any, were
+                        // already filtered above and none survived — Rule A matched
+                        // against the same prevUseIds and answered.size === 0).
+                        prevUseIds = new Set();
+                        continue;
+                    }
+                }
+            }
+            prevUseIds = new Set();
+            for (const b of entry.content) {
+                if (b.type === 'tool_use')
+                    prevUseIds.add(b.id);
+            }
+        }
+        // Tail: an entry that mixes tool_use with other blocks can survive
+        // trimOrphanedToolUse (which only pops pure use-without-result tails).
+        if (prevUseIds.size > 0) {
+            entries.push({
+                index: entries.length,
+                participant: 'user',
+                sourceRelation: 'derived',
+                content: [...prevUseIds].map(id => ({
+                    type: 'tool_result',
+                    toolUseId: id,
+                    content: AutobiographicalStrategy.STUB_TOOL_RESULT_TEXT,
+                })),
+            });
+        }
+        // Reindex after any splices/appends.
+        for (let i = 0; i < entries.length; i++)
+            entries[i].index = i;
+    }
+    /**
+     * For each `missing` tool_use id (a use in the preceding entry with no
+     * adjacent result), return the result block to place next to it:
+     *
+     *   - if the genuine result exists within a short look-ahead window after
+     *     `afterIndex`, MOVE it up into position (removing it from its source
+     *     entry — replacing a now-empty entry with a placeholder) so the real
+     *     tool output survives the repair;
+     *   - otherwise emit a stub.
+     *
+     * tool_use ids are unique, so the single result carrying a given id is
+     * unambiguously the answer to that use — relocating it cannot break any
+     * other pairing. Results for `missing` ids never sit at or before
+     * `afterIndex` (that entry's results are already matched), so the search
+     * starts at `afterIndex + 1`.
+     */
+    relocateOrDropMissingResults(entries, afterIndex, missing) {
+        const LOOKAHEAD = 6;
+        const end = Math.min(entries.length, afterIndex + 1 + LOOKAHEAD);
+        return missing.map(id => {
+            for (let j = afterIndex + 1; j < end; j++) {
+                const src = entries[j];
+                const bi = src.content.findIndex(b => b.type === 'tool_result' && b.toolUseId === id);
+                if (bi === -1)
+                    continue;
+                const real = src.content[bi];
+                const rest = src.content.filter((_, k) => k !== bi);
+                src.content = rest.length > 0
+                    ? rest
+                    : [{ type: 'text', text: '[tool call omitted]' }];
+                return real;
+            }
+            return {
+                type: 'tool_result',
+                toolUseId: id,
+                content: AutobiographicalStrategy.STUB_TOOL_RESULT_TEXT,
+            };
+        });
+    }
     /**
      * Prune tool_use / tool_result blocks in-place:
      *  1. Truncate `tool_use.input` blocks whose serialized JSON exceeds