@vellumai/assistant 0.10.4 → 0.10.5-dev.202607022329.d89bf2f

package/src/contacts/contact-store.ts

@@ -12,8 +12,6 @@ import { canonicalizeInboundIdentity } from "../util/canonicalize-identity.js";
 import { notifyContactsChanged } from "./notify-contacts-changed.js";
 import type {
   AssistantContactMetadata,
-  ChannelPolicy,
-  ChannelStatus,
   Contact,
   ContactChannel,
   ContactRole,
@@ -99,8 +97,6 @@ function parseContact(row: typeof contacts.$inferSelect): Contact {
     // gateway-owned; the serve layer stamps the real role from the gateway
     // guardian id set.
     role: "contact",
-    lastInteraction: null,
-    interactionCount: 0,
     createdAt: row.createdAt,
     updatedAt: row.updatedAt,
     contactType: row.contactType,
@@ -118,10 +114,6 @@ function parseChannel(
     address: row.address,
     isPrimary: row.isPrimary,
     externalChatId: row.externalChatId,
-    inviteId: row.inviteId,
-    lastSeenAt: row.lastSeenAt,
-    interactionCount: row.interactionCount,
-    lastInteraction: row.lastInteraction,
     updatedAt: row.updatedAt,
     createdAt: row.createdAt,
   };
@@ -140,32 +132,21 @@ function getChannelsForContact(contactId: string): ContactChannel[] {
 
 function withChannels(contact: Contact): ContactWithChannels {
   const channels = getChannelsForContact(contact.id);
-  // INFO telemetry aggregated from channel rows (not ACL): sum interaction
-  // counts, take the most recent interaction across channels.
-  const interactionCount = channels.reduce(
-    (sum, ch) => sum + ch.interactionCount,
-    0,
-  );
-  const lastInteraction =
-    channels.reduce((max, ch) => Math.max(max, ch.lastInteraction ?? 0), 0) ||
-    null;
-  return { ...contact, interactionCount, lastInteraction, channels };
+  return { ...contact, channels };
 }
 
 // ── Channel data type for syncChannels ───────────────────────────────
 
 interface SyncChannelData {
+  /** Explicit gateway-minted channel id. Lets the identity mirror key the
+   *  channel identically in both stores; omit to mint one. When a row with this
+   *  id already exists it is updated in place (address/owner rebind), so a
+   *  gateway re-auth is mirrored rather than colliding on the id. */
+  id?: string;
   type: string;
   address: string;
   isPrimary?: boolean;
   externalChatId?: string | null;
-  status?: ChannelStatus;
-  policy?: ChannelPolicy;
-  verifiedAt?: number | null;
-  verifiedVia?: string | null;
-  inviteId?: string | null;
-  revokedReason?: string | null;
-  blockedReason?: string | null;
 }
 
 // ── CRUD ─────────────────────────────────────────────────────────────
@@ -184,21 +165,20 @@ export const getContactInternal = getContact;
 /** INFO-only contact fields, joined locally by contact ID. */
 export interface ContactInfo {
   notes: string | null;
-  interactionCount: number;
 }
 
 /**
- * Look up a contact's INFO fields (notes, interaction count) by ID.
+ * Look up a contact's INFO `notes` field by ID.
  *
- * Carries no ACL state (status/policy/verification) — those are owned by the
- * gateway-stamped trust verdict. Returns null when the contact does not exist.
+ * Carries no ACL state (status/policy/verification) or interaction telemetry —
+ * those are owned by the gateway (ACL via the stamped trust verdict, telemetry
+ * via the verdict/rich reads). Returns null when the contact does not exist.
  */
 export function findContactInfoById(contactId: string): ContactInfo | null {
   const contact = getContact(contactId);
   if (!contact) return null;
   return {
     notes: contact.notes,
-    interactionCount: contact.interactionCount,
   };
 }
 
@@ -223,6 +203,11 @@ export function upsertContact(params: {
   role?: ContactRole;
   contactType?: ContactType;
   userFile?: string | null;
+  /** userFile to seed ONLY when inserting a new contact; ignored on update so
+   *  an existing persona-file pointer is never clobbered. Used by the identity
+   *  mirror to create faithful null-user_file stubs. `userFile` takes
+   *  precedence when both are supplied. */
+  userFileOnCreate?: string | null;
   channels?: SyncChannelData[];
   /** When true, conflicting channels on other contacts are reassigned to this
    *  contact instead of being skipped. Used by invite redemption to bind a
@@ -312,7 +297,9 @@ export function upsertContact(params: {
   const resolvedUserFile =
     params.userFile !== undefined
       ? params.userFile
-      : generateUserFileSlug(params.displayName);
+      : params.userFileOnCreate !== undefined
+        ? params.userFileOnCreate
+        : generateUserFileSlug(params.displayName);
   db.insert(contacts)
     .values({
       id: contactId,
@@ -338,6 +325,16 @@ export function upsertContact(params: {
   return { ...getContactInternal(contactId)!, created: true };
 }
 
+/**
+ * Delete a contact row (channels cascade via FK). Info-only: the gateway DB is
+ * the ACL source of truth, so this only removes the local identity mirror. A
+ * missing row is a harmless no-op.
+ */
+export function deleteContact(id: string): void {
+  getDb().delete(contacts).where(eq(contacts.id, id)).run();
+  notifyContactsChanged();
+}
+
 /**
  * Add new channels to a contact without removing existing ones.
  * When a channel already exists (same type+address), updates access/verification
@@ -352,6 +349,57 @@ function syncChannels(
   const db = getDb();
 
   for (const ch of channels) {
+    // Identity-mirror update-by-id: when the caller supplies the gateway's
+    // authoritative channel id and that row already exists, update it in place.
+    // The gateway can rebind the row's address (guardian re-auth) or owner
+    // (claimed channel) under a stable id, so a match by (contactId,type,address)
+    // would miss it and a fresh insert would collide on the primary key.
+    if (ch.id) {
+      const byId = db
+        .select()
+        .from(contactChannels)
+        .where(eq(contactChannels.id, ch.id))
+        .get();
+      if (byId) {
+        const crossContact = byId.contactId !== contactId;
+        // Never steal a channel the gateway left under another contact unless
+        // the caller opts into reassignment (mirrors the address-conflict path).
+        if (crossContact && !reassignConflicting) continue;
+
+        const updateSet: Record<string, unknown> = { updatedAt: now };
+        if (byId.address !== ch.address) {
+          // Rebinding to a new address: a DIFFERENT row may already hold
+          // (type, new-address), and idx_contact_channels_type_address would
+          // reject the move. Resolve it the same way the (contactId,type,address)
+          // path does — findConflictingChannel + the reassign gate. When
+          // reassigning, adopt the (type,address) identity onto this
+          // gateway-keyed row by removing the stale duplicate; otherwise leave
+          // the address so the existing mapping stands (onConflictDoNothing).
+          const conflicting = findConflictingChannel(db, ch.type, ch.address);
+          if (conflicting && conflicting.id !== ch.id) {
+            if (reassignConflicting) {
+              db.delete(contactChannels)
+                .where(eq(contactChannels.id, conflicting.id))
+                .run();
+              updateSet.address = ch.address;
+            }
+          } else {
+            updateSet.address = ch.address;
+          }
+        }
+        if (crossContact) updateSet.contactId = contactId;
+        if (ch.isPrimary !== undefined) updateSet.isPrimary = ch.isPrimary;
+        if (ch.externalChatId !== undefined)
+          updateSet.externalChatId = ch.externalChatId;
+
+        db.update(contactChannels)
+          .set(updateSet)
+          .where(eq(contactChannels.id, ch.id))
+          .run();
+        continue;
+      }
+    }
+
     // Match by (type, address) — the canonical identity for all channel types.
     // COLLATE NOCASE catches legacy rows that were lowercased by old write paths.
     const existing = db
@@ -373,7 +421,6 @@ function syncChannels(
       if (ch.isPrimary !== undefined) updateSet.isPrimary = ch.isPrimary;
       if (ch.externalChatId !== undefined)
         updateSet.externalChatId = ch.externalChatId;
-      if (ch.inviteId !== undefined) updateSet.inviteId = ch.inviteId;
 
       if (Object.keys(updateSet).length > 0) {
         updateSet.updatedAt = now;
@@ -398,7 +445,7 @@ function syncChannels(
         };
         if (ch.externalChatId !== undefined)
           reassignSet.externalChatId = ch.externalChatId;
-        if (ch.inviteId !== undefined) reassignSet.inviteId = ch.inviteId;
+        if (ch.isPrimary !== undefined) reassignSet.isPrimary = ch.isPrimary;
 
         db.update(contactChannels)
           .set(reassignSet)
@@ -412,13 +459,12 @@ function syncChannels(
 
     db.insert(contactChannels)
       .values({
-        id: uuid(),
+        id: ch.id ?? uuid(),
         contactId,
         type: ch.type,
         address: ch.address,
         isPrimary: ch.isPrimary ?? false,
         externalChatId: ch.externalChatId ?? null,
-        inviteId: ch.inviteId ?? null,
         createdAt: now,
         updatedAt: now,
       })

package/src/contacts/contacts-write.ts

@@ -1,9 +1,9 @@
 /**
  * Contacts write module.
  *
- * All mutations (member upserts, guardian bindings, revocations) write
- * directly to the contacts table, the single authoritative source for
- * identity and access-control state.
+ * Best-effort local mirror of contact identity/INFO fields. The gateway owns
+ * the ACL verdict (status, policy, verification); these writes never carry or
+ * mutate ACL state.
  */
 
 import {
@@ -13,18 +13,7 @@ import {
   getContactInternal,
   upsertContact,
 } from "./contact-store.js";
-import type { ContactWriteResult } from "./types.js";
-
-// ── Guardian operations ──────────────────────────────────────────────
-
-/**
- * No-op shim: the guardian channel ACL revoke is gateway-owned (relayed via
- * mark_channel_revoked). Retained while callers still invoke it; the return is
- * discarded.
- */
-export function revokeGuardianBinding(_channel: string): boolean {
-  return false;
-}
+import type { ContactType, ContactWriteResult } from "./types.js";
 
 // ── Member operations ────────────────────────────────────────────────
 
@@ -40,8 +29,33 @@ export function upsertContactChannel(params: {
   externalChatId?: string;
   displayName?: string;
   username?: string;
-  inviteId?: string;
   contactId?: string;
+  /** Explicit channel id for a NEW channel (identity-mirror path): reuse the
+   *  gateway-minted id so both stores key the channel identically. */
+  channelId?: string;
+  /** Classification for a newly created contact (e.g. 'assistant' for bots). */
+  contactType?: ContactType;
+  /** Notes seeded onto a newly created contact (e.g. bot/app provenance). */
+  notes?: string | null;
+  /** userFile to seed on contact CREATE only (identity-mirror stubs pass null
+   *  for a faithful null-user_file replica); ignored on update. */
+  userFileOnCreate?: string | null;
+  /** Refresh the contact display name from the supplied identity even when a
+   *  contactId is given. Used by the inbound identity-seed mirror, whose intent
+   *  is to keep the mirror name in sync with the platform profile. Defaults to
+   *  false: the invite-binding path preserves the guardian-curated name. */
+  refreshDisplayName?: boolean;
+  /** Reparent a conflicting existing channel (same (type,address) owned by a
+   *  DIFFERENT contact) to this contact. Invite-binding only. The inbound
+   *  identity-seed mirror must pass false so it matches the gateway insert's
+   *  onConflictDoNothing and never steals a channel from its existing contact.
+   *  Defaults to `!!contactId` to preserve the invite-binding callers that
+   *  don't set it explicitly. */
+  reassignConflictingChannels?: boolean;
+  /** Mark the channel primary. Omit to leave an existing channel's flag intact
+   *  and default a new channel to non-primary; the guardian-bootstrap mirror
+   *  passes true so the guardian's sole channel stays primary. */
+  isPrimary?: boolean;
 }): ContactWriteResult | null {
   let address: string;
 
@@ -57,9 +71,10 @@ export function upsertContactChannel(params: {
   let displayName = params.displayName ?? address;
 
   // When binding a channel to a specific contact (invite redemption), preserve
-  // the target contact's curated displayName instead of overwriting it
-  // with the raw platform identity.
-  if (params.contactId) {
+  // the target contact's curated displayName instead of overwriting it with the
+  // raw platform identity. The inbound identity-seed mirror opts out
+  // (refreshDisplayName) so a changed platform profile name refreshes the row.
+  if (params.contactId && !params.refreshDisplayName) {
     const targetContact = getContact(params.contactId);
     if (targetContact?.displayName?.trim().length) {
       displayName = targetContact.displayName;
@@ -69,18 +84,28 @@ export function upsertContactChannel(params: {
   upsertContact({
     id: params.contactId,
     displayName,
+    contactType: params.contactType,
+    notes: params.notes,
+    userFileOnCreate: params.userFileOnCreate,
     channels: [
       {
+        id: params.channelId,
         type: params.sourceChannel,
         address,
-        externalChatId: params.externalChatId ?? null,
-        inviteId: params.inviteId ?? null,
+        // Pass through undefined so syncChannels preserves an existing
+        // external_chat_id (COALESCE semantics); a new channel still defaults
+        // to null. An explicit value overwrites.
+        externalChatId: params.externalChatId,
+        isPrimary: params.isPrimary,
       },
     ],
-    // When a specific contactId is provided, reassign conflicting channels from
-    // other contacts. This enables invite redemption to bind a redeemer's
-    // existing channel identity to the invite's target contact.
-    reassignConflictingChannels: !!params.contactId,
+    // Reassign a conflicting channel from another contact only when the caller
+    // explicitly asks (invite redemption binding a redeemer's existing channel
+    // to the invite's target). Defaults to `!!contactId` for legacy callers;
+    // the inbound-seed mirror passes false so a first-seen race does not steal
+    // the channel from the contact the gateway insert kept.
+    reassignConflictingChannels:
+      params.reassignConflictingChannels ?? !!params.contactId,
   });
 
   // NOTE: We intentionally do NOT seed `users/<slug>.md` here. This is the

package/src/contacts/member-write-relay.ts

@@ -7,12 +7,14 @@
  */
 
 import {
+  CreateContactIpcResponseSchema,
   MarkChannelRevokedIpcResponseSchema,
   UpsertVerifiedChannelIpcResponseSchema,
 } from "@vellumai/gateway-client/gateway-ipc-contracts";
 
 import { log } from "../daemon/handlers/shared.js";
 import { ipcCallPersistent } from "../ipc/gateway-client.js";
+import { findContactChannel } from "./contact-store.js";
 import { revokeMember, upsertContactChannel } from "./contacts-write.js";
 import type { ContactWriteResult } from "./types.js";
 
@@ -25,8 +27,6 @@ export interface ActivateMemberChannelParams {
   contactId?: string;
   displayName?: string;
   username?: string;
-  inviteId?: string;
-  verifiedAt?: number;
   verifiedVia?: string;
   policy?: string;
 }
@@ -130,7 +130,6 @@ function mirrorLocalActivation(
       externalChatId: params.externalChatId,
       displayName: params.displayName,
       username: params.username,
-      inviteId: params.inviteId,
       contactId: params.contactId,
     });
   } catch (err) {
@@ -142,42 +141,127 @@ function mirrorLocalActivation(
   }
 }
 
-// ── Revoke ───────────────────────────────────────────────────────────
+// ── Block ────────────────────────────────────────────────────────────
+
+export interface BlockSenderChannelParams {
+  sourceChannel: string;
+  externalUserId: string;
+  displayName?: string;
+  /** Audit reason written to the gateway channel's revokedReason. */
+  reason?: string;
+}
 
 /**
- * Revoke a member channel gateway-first. The gateway owns the ACL outcome; the
- * memberId may be a plain channel ID or the composite contactId:channelId form
- * revokeMember accepts.
+ * Block a sender's channel gateway-first: ensure a contact/channel row exists
+ * for the (channel, address) pair, then mark it revoked so future inbound
+ * resolves as `unknown` and is hard-denied. Used by the introduction card's
+ * **Block** action for senders that may have no contact record yet.
  *
- * Returns the locally-resolved native contact/channel for the revoked id, or
- * null when no local row exists. The local read is best-effort and never gates
- * the gateway-owned downgrade.
+ * The gateway owns the verdict: `create_contact` preserves an existing row's
+ * status, and `mark_channel_revoked` is idempotent (already-revoked →
+ * didWrite:false) and refuses to downgrade a guardian channel. Fails closed —
+ * a relay failure surfaces as `revoked: false` so callers never report a block
+ * the gateway did not persist. The assistant-DB status update is a best-effort
+ * mirror.
  */
-export async function revokeMemberChannel(
-  memberId: string,
-  reason?: string,
-): Promise<ContactWriteResult | null> {
-  const channelId = memberId.includes(":") ? memberId.split(":")[1] : memberId;
-
-  // Always relay; the gateway owns the ACL outcome and mark_channel_revoked is
-  // idempotent (already-revoked → didWrite:false). Skipping on the local row
-  // status would suppress a needed revoke when the local read lags the gateway.
-  const result = await ipcCallPersistent("mark_channel_revoked", {
-    contactChannelId: channelId,
-    reason,
-  });
-  const parsed = MarkChannelRevokedIpcResponseSchema.parse(result);
-  if (!parsed.ok) {
-    throw new Error("mark_channel_revoked relay returned ok: false");
+export async function blockSenderChannel(
+  params: BlockSenderChannelParams,
+): Promise<{ revoked: boolean }> {
+  let channelId: string;
+  try {
+    const created = await ipcCallPersistent("create_contact", {
+      channelType: params.sourceChannel,
+      address: params.externalUserId,
+      ...(params.displayName ? { displayName: params.displayName } : {}),
+    });
+    channelId = CreateContactIpcResponseSchema.parse(created).channelId;
+  } catch (err) {
+    log.warn(
+      { err, sourceChannel: params.sourceChannel },
+      "create_contact relay failed — refusing block (no gateway channel row)",
+    );
+    return { revoked: false };
+  }
+  if (!channelId) {
+    log.error(
+      { sourceChannel: params.sourceChannel },
+      "create_contact returned no channel id — refusing block",
+    );
+    return { revoked: false };
   }
 
   try {
-    return revokeMember(memberId);
+    const result = await ipcCallPersistent("mark_channel_revoked", {
+      contactChannelId: channelId,
+      reason: params.reason,
+    });
+    const parsed = MarkChannelRevokedIpcResponseSchema.parse(result);
+    if (!parsed.ok) {
+      return { revoked: false };
+    }
   } catch (err) {
-    log.error(
-      { err, memberId },
-      "Local revoke read failed after gateway revoke; gateway downgrade stands",
+    log.warn(
+      { err, sourceChannel: params.sourceChannel },
+      "mark_channel_revoked relay failed — block did not land on the gateway",
+    );
+    return { revoked: false };
+  }
+
+  // Best-effort local mirror so the Contacts page reflects the downgrade.
+  // Resolved by logical (type, address) key — the local mirror row's id is
+  // not guaranteed to match the gateway channel id.
+  try {
+    const local = findContactChannel({
+      channelType: params.sourceChannel,
+      address: params.externalUserId,
+    });
+    if (local) {
+      revokeMember(local.channel.id);
+    }
+  } catch {
+    // The local row may not exist for a brand-new sender; the gateway
+    // outcome stands.
+  }
+  return { revoked: true };
+}
+
+// ── Seed unverified ──────────────────────────────────────────────────
+
+export interface SeedUnverifiedMemberChannelParams {
+  sourceChannel: string;
+  externalUserId: string;
+  displayName?: string;
+}
+
+/**
+ * Seed a contact channel for a sender at the `unverified` admission tier,
+ * gateway-first. Used when the guardian denies an access request: the sender
+ * becomes a known `unverified_contact` — no longer an unknown stranger — so
+ * subsequent inbound resolves as `unverified_contact` instead of re-running
+ * discovery.
+ *
+ * Delegates to the gateway `create_contact` IPC, which upserts via
+ * `ContactStore.upsertContact` (gateway DB is the ACL source of truth, with a
+ * best-effort assistant-DB mirror). A brand-new channel lands at status
+ * `unverified`; an existing channel's status is preserved, so a blocked,
+ * revoked, or already-active row is never reactivated or downgraded.
+ *
+ * Best-effort: the gateway owns the ACL verdict, so a failed relay is logged
+ * and swallowed — it must never fail the guardian's deny decision.
+ */
+export async function seedUnverifiedMemberChannel(
+  params: SeedUnverifiedMemberChannelParams,
+): Promise<void> {
+  try {
+    await ipcCallPersistent("create_contact", {
+      channelType: params.sourceChannel,
+      address: params.externalUserId,
+      ...(params.displayName ? { displayName: params.displayName } : {}),
+    });
+  } catch (err) {
+    log.warn(
+      { err, sourceChannel: params.sourceChannel },
+      "seed_unverified_channel relay failed (best-effort); sender not persisted as unverified_contact",
     );
-    return null;
   }
 }

package/src/contacts/types.ts

@@ -31,8 +31,6 @@ export interface Contact {
   /** Free-text notes about this contact (e.g. relationship, communication preferences). */
   notes: string | null;
   role: ContactRole;
-  lastInteraction: number | null;
-  interactionCount: number;
   createdAt: number;
   updatedAt: number;
   contactType: ContactType;
@@ -55,12 +53,6 @@ export interface ContactChannel {
   address: string;
   isPrimary: boolean;
   externalChatId: string | null;
-  inviteId: string | null;
-  // INFO telemetry (not ACL): interaction stats written locally by the gateway's
-  // handle-inbound mirror. Model-facing turn context reads these.
-  lastSeenAt: number | null;
-  interactionCount: number;
-  lastInteraction: number | null;
   updatedAt: number | null;
   createdAt: number;
 }

package/src/context/compactor.ts

@@ -22,7 +22,6 @@ import { optimizeImageForTransport } from "../agent/image-optimize.js";
 import type { CompactionConfig } from "../config/schemas/compaction.js";
 import type { LLMCallSite } from "../config/schemas/llm.js";
 import { filterMessagesForUntrustedActor } from "../daemon/message-provenance.js";
-import { stripHistoricalWebSearchResults } from "../daemon/web-search-history.js";
 import {
   getAttachmentContent,
   getAttachmentMetadataForMessage,
@@ -40,6 +39,7 @@ import type {
 import { type TrustClass } from "../runtime/actor-trust-resolver.js";
 import { resolveCapabilities } from "../runtime/capabilities.js";
 import { getLogger } from "../util/logger.js";
+import { preModelCallSanitize } from "./outbound-sanitize.js";
 import { stripInjectionsForCompaction } from "./strip-injections.js";
 import {
   estimatePromptTokens,
@@ -826,14 +826,20 @@ function extractTextFromResponse(content: ContentBlock[]): string {
     .join("\n");
 }
 
-// Build the outbound message list for a compaction provider call: convert
-// historical web_search_tool_result blocks to text, then append the
-// summarization instruction at the tail.
+// Build the outbound message list for a compaction provider call: apply the
+// same pre-send sanitization bundle as the agent loop's model calls
+// (`preModelCallSanitize` — old tool-result media stripped, AX trees
+// collapsed, historical web-search results converted to text), then append
+// the summarization instruction at the tail.
 //
-// Anthropic's opaque `encrypted_content` tokens are route-scoped and expire, so
-// replaying a stale one is rejected with `Invalid encrypted_content in
-// search_result block`. Sanitizing here — the single seam every compaction
-// provider call funnels through — keeps that error away from both the
+// Matching the loop's projection matters for two reasons. First, the summary
+// call's prefix stays byte-aligned with the agent's warm prompt cache — an
+// unsanitized history diverges from what the loop actually sent at the first
+// stripped block. Second, an unsanitized history carries every screenshot in
+// the conversation; enough images cross Anthropic's many-image threshold,
+// where a stricter per-image dimension cap applies and a single large
+// screenshot rejects the whole summary call. Sanitizing here — the single
+// seam every compaction provider call funnels through — covers both the
 // assistant-driven and emergency summarization calls. Only this outbound copy
 // is sanitized; tail resolution and the persisted compaction result read the
 // caller's original messages, so durable history keeps the rich blocks. The
@@ -842,7 +848,7 @@ function buildCompactionRequest(
   history: Message[],
   instruction: Message,
 ): Message[] {
-  return [...stripHistoricalWebSearchResults(history).messages, instruction];
+  return [...preModelCallSanitize(history), instruction];
 }
 
 // Token headroom a compaction summary call reserves on top of its history: room
@@ -945,11 +951,14 @@ export async function runAssistantDrivenCompaction(
   // Bound the summary call's own input to the context window. With no tool
   // pair to anchor an emergency split, an overflow recovery routes the full
   // history straight here, so the summary call must front-truncate itself or
-  // it overflows in turn. `args.messages` stays intact for tail resolution
-  // below — only the outbound request is truncated. A below-budget history is
-  // returned untouched, keeping the prefix aligned with the agent's warm cache.
+  // it overflows in turn. Truncation operates on the sanitized projection
+  // (what the request actually carries) so the budget estimate is honest —
+  // estimating on raw history would count media bytes the request strips.
+  // `args.messages` stays intact for tail resolution below — only the
+  // outbound request is truncated. A below-budget history is returned
+  // untouched, keeping the prefix aligned with the agent's warm cache.
   const summaryHistory = truncateHistoryToBudget({
-    messages: args.messages,
+    messages: preModelCallSanitize(args.messages),
     systemPrompt: args.systemPrompt,
     budgetTokens: compactionPrefixBudget(args.maxInputTokens),
     providerName: args.provider.tokenEstimationProvider ?? args.provider.name,
@@ -1371,9 +1380,14 @@ export async function runEmergencyCompaction(
   );
   // Bound the prefix to the context window so the summary call fits, reserving
   // budget for the instruction message and the emitted summary. Truncates from
-  // the front, keeping the recent portion the summary most needs.
+  // the front, keeping the recent portion the summary most needs. The prefix
+  // is sliced from the sanitized projection (sanitize-then-slice, matching the
+  // agent's own sends byte-for-byte for cache alignment) so the budget
+  // estimate counts what the request actually carries. All sanitize
+  // transforms are 1:1 per message, so `splitIndex` maps onto the sanitized
+  // array unchanged.
   const prefix = truncateHistoryToBudget({
-    messages: args.messages.slice(0, splitIndex),
+    messages: preModelCallSanitize(args.messages).slice(0, splitIndex),
     systemPrompt: args.systemPrompt,
     budgetTokens: compactionPrefixBudget(args.maxInputTokens),
     providerName: args.provider.tokenEstimationProvider ?? args.provider.name,