@animalabs/context-manager 0.5.9 → 0.5.10

package/src/strategies/autobiographical.ts

@@ -778,6 +778,11 @@ export class AutobiographicalStrategy implements ResettableStrategy {
     // Anthropic 400 "content must be non-empty". Never let them re-enter memory.
     const nonEmpty = loaded.filter(s => s && typeof s.content === 'string' && s.content.trim().length > 0);
     const droppedEmpty = loaded.length - nonEmpty.length;
+    const removedEmptyIds = new Set(
+      loaded
+        .filter(s => s && (typeof s.content !== 'string' || s.content.trim().length === 0))
+        .map(s => s.id),
+    );
     if (droppedEmpty > 0) console.warn(`[autobiographical] dropped ${droppedEmpty} empty summary(ies) on load`);
     // Dedupe by id, keeping the copy with mergedInto set (position of first
     // occurrence preserved). Duplicate-id copies with diverging merge state
@@ -792,7 +797,48 @@ export class AutobiographicalStrategy implements ResettableStrategy {
     }
     const dupes = nonEmpty.length - byId.size;
     if (dupes > 0) console.warn(`[autobiographical] deduped ${dupes} duplicate summary id(s) on load`);
-    this.summaries = [...byId.values()];
+    // Dropping an invalid parent is only half the repair. Its children may
+    // still carry `mergedInto: <dropped-id>`, which makes them simultaneously
+    // unavailable to the picker (no parent to render) and ineligible for a
+    // replacement merge (they still look merged). Clear every dangling edge
+    // and persist the canonicalized array so the poison does not return on
+    // every restart.
+    let danglingParents = 0;
+    this.summaries = [...byId.values()].map((summary) => {
+      if (!summary.mergedInto || byId.has(summary.mergedInto)) return summary;
+      danglingParents++;
+      const { mergedInto: _dropped, ...repaired } = summary;
+      return repaired as SummaryEntry;
+    });
+    if (droppedEmpty > 0 || dupes > 0 || danglingParents > 0) {
+      this.store.setStateJson(this.summariesStateId, this.summaries);
+      console.warn(
+        `[autobiographical] repaired summary state: removed ${droppedEmpty} empty, ` +
+          `deduped ${dupes}, cleared ${danglingParents} dangling parent pointer(s)`,
+      );
+    }
+
+    // An invalid L1 may also be referenced by a persisted chunk record. Make
+    // that chunk compressible again instead of leaving it permanently marked
+    // complete with no summary behind it.
+    if (this.chunkPersistenceEnabled && this.chunkRecords.length > 0) {
+      const validL1Ids = new Set(this.summaries.filter(s => s.level === 1).map(s => s.id));
+      let repairedChunkRecords = 0;
+      this.chunkRecords = this.chunkRecords.map((record) => {
+        if (!record.compressed || (record.summaryId && validL1Ids.has(record.summaryId))) {
+          return record;
+        }
+        repairedChunkRecords++;
+        const { summaryId: _dropped, ...rest } = record;
+        return { ...rest, compressed: false };
+      });
+      if (repairedChunkRecords > 0) {
+        this.store.setStateJson(this.chunksStateId, this.chunkRecords);
+        console.warn(
+          `[autobiographical] repaired ${repairedChunkRecords} chunk record(s) with missing L1 summaries`,
+        );
+      }
+    }
 
     const counter = this.store.getStateJson(this.counterStateId);
     this.summaryIdCounter = typeof counter === 'number' ? counter : 0;
@@ -801,6 +847,15 @@ export class AutobiographicalStrategy implements ResettableStrategy {
     this.mergeQueue = Array.isArray(queue)
       ? (queue as Array<{ level: SummaryLevel; sourceIds: string[] }>)
       : [];
+    const validMergeQueue = this.mergeQueue.filter(
+      merge => !merge.sourceIds.some(id => removedEmptyIds.has(id) && !byId.has(id)),
+    );
+    if (validMergeQueue.length !== this.mergeQueue.length) {
+      const removed = this.mergeQueue.length - validMergeQueue.length;
+      this.mergeQueue = validMergeQueue;
+      this.store.setStateJson(this.mergeQueueStateId, this.mergeQueue);
+      console.warn(`[autobiographical] removed ${removed} merge queue item(s) with missing sources`);
+    }
 
     const pinsState = this.store.getStateJson(this.pinsStateId);
     if (pinsState && typeof pinsState === 'object' && Array.isArray((pinsState as { pins?: unknown }).pins)) {
@@ -1071,6 +1126,11 @@ export class AutobiographicalStrategy implements ResettableStrategy {
    * Single point so subclasses inherit persistence.
    */
   protected pushSummary(entry: SummaryEntry): void {
+    if (typeof entry.content !== 'string' || entry.content.trim().length === 0) {
+      throw new Error(
+        `[autobiographical] refusing to persist empty summary ${entry.id} at L${entry.level}`,
+      );
+    }
     this.summaries.push(entry);
     this.store?.appendToStateJson(this.summariesStateId, entry);
   }
@@ -2131,6 +2191,17 @@ export class AutobiographicalStrategy implements ResettableStrategy {
     // (b) provide an alternative identity source that competes with the
     // structural one carried by the conversation itself. Anchoring
     // identity by the chronicle's actual head is more honest.
+    // Own the byte wall here rather than delegating to membrane's shed: cap
+    // the prompt's inline image bytes newest-first before the request is built.
+    // A tighter budget than the live window's: a compression prompt also
+    // carries the head, the whole recall frontier and the raw chunk, so the
+    // image share must leave room for all of it under the API's 32MB cap.
+    this.capCompressionImageBytes(
+      llmMessages as Array<{ content: ContentBlock[] }>,
+      this.config.maxCompressionImageBytes ??
+        AutobiographicalStrategy.DEFAULT_MAX_COMPRESSION_IMAGE_BYTES,
+    );
+
     const request: NormalizedRequest = {
       // EXPLICIT image-loss opt-in (2026-07-12): summarizer prompts replay
       // raw history that can carry more inline image bytes than the API's
@@ -2326,19 +2397,38 @@ export class AutobiographicalStrategy implements ResettableStrategy {
       withPos.push({ s, first: Math.min(first, last), last: Math.max(first, last) });
     }
     withPos.sort((a, b) => a.first - b.first);
+
+    // Split into contiguous runs (a gap larger than `gapLimit` starts a new one).
+    const runs: Array<typeof withPos> = [];
     let run: typeof withPos = [];
     let runEnd = -Infinity;
     for (const x of withPos) {
       if (run.length > 0 && x.first - runEnd > gapLimit) {
-        if (run.length >= threshold) break; // oldest qualifying run wins
+        runs.push(run);
         run = [];
         runEnd = -Infinity;
       }
       run.push(x);
       runEnd = Math.max(runEnd, x.last);
     }
-    if (run.length < threshold) return null;
-    return run.slice(0, threshold).map((x) => x.s);
+    if (run.length > 0) runs.push(run);
+    if (runs.length === 0) return null;
+
+    // ONLY THE NEWEST RUN CAN GROW (2026-07-12 starvation fix). Summaries are
+    // always produced at the live end, so any INTERIOR run is stranded: it can
+    // never reach `threshold` members, and waiting for it froze the whole
+    // pyramid (mythos: L1 frontier [913-981]x5 + [4039-4131]x5 separated by a
+    // 3058-message hole from the poison-node surgery — 10 unmerged L1s, 8
+    // unmerged L2s, merge queue empty, fold floor climbing to 117k until the
+    // picker died). Interior runs consolidate as soon as they have 2 members;
+    // only the newest run waits for the full threshold.
+    for (let i = 0; i < runs.length; i++) {
+      const r = runs[i];
+      const isNewest = i === runs.length - 1;
+      if (r.length >= threshold) return r.slice(0, threshold).map((x) => x.s);
+      if (!isNewest && r.length >= 2) return r.slice(0, threshold).map((x) => x.s);
+    }
+    return null;
   }
 
   protected checkMergeThreshold(): void {
@@ -2709,6 +2799,17 @@ export class AutobiographicalStrategy implements ResettableStrategy {
     const collapsed = this.collapseConsecutiveMessages(split);
     const cleaned = stripUnpairedToolBlocks(collapsed);
 
+    // Byte wall on the MERGE prompt too (2026-07-12). A merge expands its
+    // sources ONE LEVEL DEEPER — an L2 merge therefore replays the RAW
+    // messages under its L1s, images and all (including screenshots nested in
+    // tool_results). This is the path that kept tripping membrane's transport
+    // shed at 27MB after the L1 site was already capped. Own it here.
+    this.capCompressionImageBytes(
+      cleaned as Array<{ content: ContentBlock[] }>,
+      this.config.maxCompressionImageBytes ??
+        AutobiographicalStrategy.DEFAULT_MAX_COMPRESSION_IMAGE_BYTES,
+    );
+
     // NO system prompt — identity is established by the head window
     // (present at the start of llmMessages above) and by the prior
     // recall pairs. Same rationale as compressChunkHierarchical.
@@ -2873,7 +2974,7 @@ export class AutobiographicalStrategy implements ResettableStrategy {
     // this method prices a message the way the stripped render will cost it.
     const pse = this.postStripEstimates(store);
 
-    // ----- 1. Build head/tail sets and emit head entries -----
+    // ----- 1. Build head/tail sets and reserve the tail before emitting -----
     const headStart = this.getHeadWindowStartIndex(store);
     const headEnd = this.getHeadWindowEnd(store);
     const recentStart = this.getRecentWindowStart(store);
@@ -2883,14 +2984,45 @@ export class AutobiographicalStrategy implements ResettableStrategy {
     let headTokens = 0;
     let tailTokens = 0;
 
+    // Compute the fixed raw windows first. They are hard reservations, not
+    // best-effort phases: foldable history may use only the space left after
+    // every head and tail message has been accounted for.
+    for (let i = headStart; i < headEnd && i < messages.length; i++) {
+      const msg = messages[i];
+      const tokens = msgCap > 0 ? Math.min(pse[i], msgCap + 50) : pse[i];
+      headMessageIds.add(msg.id);
+      headTokens += tokens;
+    }
+    const effectiveRecentStart = Math.max(recentStart, headEnd);
+    for (let i = effectiveRecentStart; i < messages.length; i++) {
+      const msg = messages[i];
+      const tokens = msgCap > 0 ? Math.min(pse[i], msgCap + 50) : pse[i];
+      tailMessageIds.add(msg.id);
+      tailTokens += tokens;
+    }
+
+    if (headTokens + tailTokens > rejectionBudget) {
+      throw new OverBudgetError({
+        budget: rejectionBudget,
+        actual: headTokens + tailTokens,
+        diagnostics: {
+          headTokens,
+          tailTokens,
+          middleTokens: 0,
+          middleChunkCount: Math.max(0, effectiveRecentStart - headEnd),
+          deepestLevel: 0,
+        },
+      });
+    }
+
+    const prefixBudget = rejectionBudget - tailTokens;
     let totalTokens = 0;
 
-    // Emit head entries verbatim
+    // Emit the already-reserved head entries verbatim.
     for (let i = headStart; i < headEnd && i < messages.length; i++) {
       const msg = messages[i];
       const content = msgCap > 0 ? this.truncateContent(msg.content, msgCap) : msg.content;
       const tokens = msgCap > 0 ? Math.min(pse[i], msgCap + 50) : pse[i];
-      if (totalTokens + tokens > rejectionBudget) break;
       entries.push({
         index: entries.length,
         sourceMessageId: msg.id,
@@ -2899,23 +3031,12 @@ export class AutobiographicalStrategy implements ResettableStrategy {
         content,
       });
       totalTokens += tokens;
-      headMessageIds.add(msg.id);
-      headTokens += tokens;
       this.rsRaw('head', tokens);
     }
     // (Cache breakpoints are placed in one pass over the FINAL ordered entries
     // below — see placeCacheMarkers — capturing the stable folded prefix, not
     // just the head boundary.)
 
-    // Compute tail message IDs (will be emitted at end)
-    const effectiveRecentStart = Math.max(recentStart, headEnd);
-    for (let i = effectiveRecentStart; i < messages.length; i++) {
-      const msg = messages[i];
-      const tokens = msgCap > 0 ? Math.min(pse[i], msgCap + 50) : pse[i];
-      tailMessageIds.add(msg.id);
-      tailTokens += tokens;
-    }
-
     // ----- 2. Build PickerChunks for messages in the middle -----
     // For each compressible (non-head, non-tail) message we create one
     // PickerChunk. Its l1Id is determined by the existing chunks that
@@ -3084,12 +3205,10 @@ export class AutobiographicalStrategy implements ResettableStrategy {
       this.handleProducedOps(result.produced);
     }
 
-    // Hard-fail check: if the picker exhausted itself but the final render
-    // would still exceed the HARD budget (not just the soft target), surface
-    // an OverBudgetError to the host rather than silently dropping entries.
-    // The strategy has done all it can; the application has to decide what
-    // to do next (raise budget, switch model, drop windows, etc.).
-    if (result.exhausted && result.finalTokens > rejectionBudget) {
+    // Hard-fail whenever the picker's current plan exceeds the hard budget.
+    // A `produce` op only schedules a missing summary; it does not make the
+    // current raw plan feasible and must never authorize an inference.
+    if (result.finalTokens > rejectionBudget) {
       throw new OverBudgetError({
         budget: rejectionBudget,
         actual: result.finalTokens,
@@ -3163,7 +3282,7 @@ export class AutobiographicalStrategy implements ResettableStrategy {
             // (`maxMessageTokens` is for per-message caps on chat / tool
             // results, not for sharded bodyGroup composites.)
             const tokens = this.estimateTokens(content);
-            if (totalTokens + tokens > rejectionBudget) {
+            if (totalTokens + tokens > prefixBudget) {
               currentRun = null;
               return false;
             }
@@ -3195,7 +3314,7 @@ export class AutobiographicalStrategy implements ResettableStrategy {
                 sourceRelation: 'derived',
               };
               const pairTokens = this.estimateTokens(questionEntry.content) + this.estimateTokens(answerEntry.content);
-              if (totalTokens + pairTokens > rejectionBudget) {
+              if (totalTokens + pairTokens > prefixBudget) {
                 currentRun = null;
                 return false;
               }
@@ -3254,7 +3373,7 @@ export class AutobiographicalStrategy implements ResettableStrategy {
       if (resolution === 0) {
         const content = msgCap > 0 ? this.truncateContent(msg.content, msgCap) : msg.content;
         const tokens = msgCap > 0 ? Math.min(pse[i], msgCap + 50) : pse[i];
-        if (totalTokens + tokens > rejectionBudget) break;
+        if (totalTokens + tokens > prefixBudget) break;
         entries.push({
           index: entries.length,
           sourceMessageId: msg.id,
@@ -3270,7 +3389,7 @@ export class AutobiographicalStrategy implements ResettableStrategy {
         if (!ancestor) {
           const content = msgCap > 0 ? this.truncateContent(msg.content, msgCap) : msg.content;
           const tokens = msgCap > 0 ? Math.min(pse[i], msgCap + 50) : pse[i];
-          if (totalTokens + tokens > rejectionBudget) break;
+          if (totalTokens + tokens > prefixBudget) break;
           entries.push({
             index: entries.length,
             sourceMessageId: msg.id,
@@ -3302,7 +3421,7 @@ export class AutobiographicalStrategy implements ResettableStrategy {
           sourceRelation: 'derived',
         };
         const pairTokens = this.estimateTokens(questionEntry.content) + this.estimateTokens(answerEntry.content);
-        if (totalTokens + pairTokens > rejectionBudget) break;
+        if (totalTokens + pairTokens > prefixBudget) break;
         entries.push(questionEntry);
         entries.push(answerEntry);
         totalTokens += pairTokens;
@@ -3311,8 +3430,21 @@ export class AutobiographicalStrategy implements ResettableStrategy {
       }
     }
 
-    // ----- 6. Emit tail entries newest-first eviction (matches existing behavior) -----
+    // ----- 6. Emit the fully-reserved tail -----
     const tailStats = this.emitRecentNewestFirst(entries, store, messages, effectiveRecentStart, msgCap, rejectionBudget, totalTokens, pse);
+    if (tailStats.messages !== messages.length - effectiveRecentStart) {
+      throw new OverBudgetError({
+        budget: rejectionBudget,
+        actual: totalTokens + tailTokens,
+        diagnostics: {
+          headTokens,
+          tailTokens,
+          middleTokens: totalTokens - headTokens,
+          middleChunkCount: pickerChunks.length - headMessageIds.size - tailMessageIds.size,
+          deepestLevel,
+        },
+      });
+    }
     this.rsRaw('tail', tailStats.tokens, tailStats.messages);
 
     // ----- 7. Post-process: merge consecutive raw entries from the same bodyGroup -----
@@ -3335,6 +3467,33 @@ export class AutobiographicalStrategy implements ResettableStrategy {
     // Strip stale images BEFORE placing markers and committing stats, so both
     // describe the post-strip context the agent actually receives.
     this.applyImageStripping(merged, store);
+
+    // The newest stored message is the triggering turn for this compile. A
+    // structural repair may rewrite tool blocks, but it must never erase that
+    // turn. Body-group shards merge under the first shard's source id, so any
+    // surviving member of the same group proves the newest shard is present.
+    const newest = messages[messages.length - 1];
+    if (newest) {
+      const newestGroupIds = newest.bodyGroupId
+        ? new Set(messages.filter(m => m.bodyGroupId === newest.bodyGroupId).map(m => m.id))
+        : new Set([newest.id]);
+      const newestRetained = merged.some(
+        entry => entry.sourceMessageId && newestGroupIds.has(entry.sourceMessageId),
+      );
+      if (!newestRetained) {
+        throw new OverBudgetError({
+          budget: rejectionBudget,
+          actual: totalTokens + tailTokens,
+          diagnostics: {
+            headTokens,
+            tailTokens,
+            middleTokens: totalTokens - headTokens,
+            middleChunkCount: pickerChunks.length - headMessageIds.size - tailMessageIds.size,
+            deepestLevel,
+          },
+        });
+      }
+    }
     // Place ≤4 cache breakpoints across the FINAL ordered entries so the
     // provider can reuse the stable folded prefix — not just the head. With a
     // single head marker the cache hit is ~2%; well-placed breakpoints take the
@@ -4768,12 +4927,68 @@ export class AutobiographicalStrategy implements ResettableStrategy {
   /** Byte wall default: 20MB of base64 (API total-request cap is 32MB). */
   protected static readonly DEFAULT_MAX_LIVE_IMAGE_BYTES = 20 * 1024 * 1024;
 
+  /** Compression prompts carry head + recall frontier + raw chunk alongside
+   *  their images, so they get a tighter image budget than the live window. */
+  protected static readonly DEFAULT_MAX_COMPRESSION_IMAGE_BYTES = 12 * 1024 * 1024;
+
   /** Base64 payload size of an image block (0 for non-base64 sources). */
   protected static imageBlockBytes(b: unknown): number {
     const src = (b as { source?: { data?: string } }).source;
     return typeof src?.data === 'string' ? src.data.length : 0;
   }
 
+  /**
+   * Cap inline image bytes in a COMPRESSION prompt (2026-07-12). The main
+   * window enforces `maxLiveImageBytes` through the strip policy; the
+   * summarizer's raw-chunk replay had no such wall and leaned on membrane's
+   * byte shed instead — which is a transport backstop, not a policy owner
+   * (it fired at 27MB on a live merge). Keep images newest-first within the
+   * budget; older ones become the same loud placeholder the window uses, so
+   * the summarizer is told plainly that it is not seeing them.
+   * Returns the number of images replaced.
+   */
+  protected capCompressionImageBytes(
+    messages: Array<{ content: ContentBlock[] }>,
+    capBytes: number,
+  ): number {
+    if (capBytes <= 0) return 0;
+    let kept = 0;
+    let dropped = 0;
+    // Recurse into tool_result content: an agent that drives a shell/plotter/
+    // browser carries most of its image bytes NESTED in tool results, not as
+    // top-level blocks. Capping only the top level left those untouched and
+    // membrane's transport shed kept firing at 27MB (2026-07-12).
+    const capBlocks = (blocks: ContentBlock[]): ContentBlock[] =>
+      blocks.map((b) => {
+        if (b.type === 'image') {
+          const bytes = AutobiographicalStrategy.imageBlockBytes(b);
+          if (kept + bytes <= capBytes) {
+            kept += bytes;
+            return b;
+          }
+          dropped++;
+          return { type: 'text', text: AutobiographicalStrategy.IMAGE_PLACEHOLDER } as ContentBlock;
+        }
+        const nested = (b as { type: string; content?: unknown }).content;
+        if (b.type === 'tool_result' && Array.isArray(nested)) {
+          return { ...b, content: capBlocks(nested as ContentBlock[]) } as ContentBlock;
+        }
+        return b;
+      });
+    for (let i = messages.length - 1; i >= 0; i--) {
+      const m = messages[i];
+      if (!Array.isArray(m.content)) continue;
+      m.content = capBlocks(m.content);
+    }
+    if (dropped > 0) {
+      console.error(
+        `[autobiographical] compression prompt: replaced ${dropped} older image(s) with placeholders ` +
+          `to stay under the ${Math.round(capBytes / 1e6)}MB image-byte budget (kept ${Math.round(kept / 1e6)}MB, newest-first)`,
+      );
+    }
+    return dropped;
+  }
+
   protected getRecentWindowStart(store: MessageStoreView): number {
     const messages = store.getAll();
     const pse = this.postStripEstimates(store);

package/src/types/strategy.ts

@@ -344,9 +344,9 @@ export interface AutobiographicalConfig {
 
   /**
    * Fractional grace above the configured hard context budget before an
-   * exhausted adaptive picker rejects the compile. The solver still targets
-   * the original budget; this only absorbs coarse fold quanta and indivisible
-   * head/tail boundary overshoot. Default 0 (strict budget enforcement).
+   * adaptive plan rejects the compile. The solver still targets the original
+   * budget; this only absorbs coarse fold quanta and indivisible raw-window
+   * overshoot. Default 0 (strict budget enforcement).
    */
   overBudgetGraceRatio?: number;
 
@@ -382,6 +382,14 @@ export interface AutobiographicalConfig {
    */
   maxLiveImageBytes?: number;
 
+  /**
+   * Image byte budget for COMPRESSION prompts (summarizer). Tighter than the
+   * live window's: the prompt also carries the head, the recall frontier and
+   * the raw chunk. Newest-first; older images become loud placeholders.
+   * Default 12MB of base64.
+   */
+  maxCompressionImageBytes?: number;
+
   /**
    * Merge grouping: exclude candidates whose OWN source span exceeds this
    * many messages (replay-era summaries can span the entire chronicle and