@@ -1416,7 +1416,7 @@ flow writes both through the daemon, so a client never has to know the path.`,
 		},
 		Run: func(ctx *cmdkit.RunContext) error {
 			if len(ctx.Args) != 1 {
-				return fmt.Errorf("usage: doctor <gc [--dry-run] | schema | term | mem [-j] | provider [--id <aria>] [-c N] [-j] | librettos [--dry-run] | skills [-j] | ttl [-j]>")
+				return fmt.Errorf("usage: doctor <gc [--dry-run] | schema | term | mem [-j] | provider [--id <aria>] [-c N] [-j] | librettos [--dry-run] | toolcalls [--dry-run] | skills [-j] | ttl [-j]>")
 			}
 			switch ctx.Args[0] {
 			case "gc":
@@ -1431,12 +1431,14 @@ flow writes both through the daemon, so a client never has to know the path.`,
 				return runDoctorProvider(ctx.Flag("id"), ctx.Flag("count"), ctx.BoolFlag("json"))
 			case "librettos":
 				return runDoctorLibrettos(ctx.BoolFlag("dry-run"))
+			case "toolcalls":
+				return runDoctorToolCalls(ctx.BoolFlag("dry-run"))
 			case "skills":
 				return runDoctorSkills(ctx.BoolFlag("json"))
 			case "ttl":
 				return runDoctorTTL(ctx.BoolFlag("json"))
 			}
-			return fmt.Errorf("usage: doctor <gc [--dry-run] | schema | term | mem [-j] | provider [--id <aria>] [-c N] [-j] | librettos [--dry-run] | skills [-j] | ttl [-j]>")
+			return fmt.Errorf("usage: doctor <gc [--dry-run] | schema | term | mem [-j] | provider [--id <aria>] [-c N] [-j] | librettos [--dry-run] | toolcalls [--dry-run] | skills [-j] | ttl [-j]>")
 		},
 	})
 
 
@@ -341,3 +341,48 @@ func runDoctorLibrettos(dryRun bool) error {
 		map[bool]string{true: "; run without --dry-run", false: ""}[dryRun])
 	return nil
 }
+
+// runDoctorToolCalls closes tool invokes that no result ever answered.
+//
+// The door keeps this from happening going forward, so what this finds is
+// history written by a figaro older than the door. An aria carrying one is
+// refused by every provider on every send -- "tool_use ids were found without
+// tool_result blocks" -- and cannot be used again until it is closed.
+func runDoctorToolCalls(dryRun bool) error {
+	if cli, err := sdk.DialAngelus(transport.UnixEndpoint(angelusSocketPath())); err == nil {
+		cli.Close()
+		return fmt.Errorf("angelus is running; stop it first (figaro stop)")
+	}
+	be, err := store.NewXwalBackend(ariaRoot(), 0)
+	if err != nil {
+		return err
+	}
+	defer be.Close()
+
+	arias, repaired := 0, 0
+	for _, cv := range be.Conversations() {
+		n, err := be.UnmatchedToolCalls(cv.ID)
+		if err != nil || n == 0 {
+			continue
+		}
+		arias++
+		fmt.Printf("%-10s %d unanswered tool call(s)\n", cv.ID, n)
+		if dryRun {
+			continue
+		}
+		if fixed, err := be.RepairToolCalls(cv.ID); err != nil {
+			fmt.Fprintf(os.Stderr, "  %s: %v\n", cv.ID, err)
+		} else {
+			repaired += fixed
+		}
+	}
+	switch {
+	case arias == 0:
+		fmt.Println("no aria carries an unanswered tool call")
+	case dryRun:
+		fmt.Printf("\n%d aria(s) would be repaired; run without --dry-run\n", arias)
+	default:
+		fmt.Printf("\nclosed %d call(s) across %d aria(s)\n", repaired, arias)
+	}
+	return nil
+}
@@ -28,19 +28,19 @@ func unmatchedInvokes(rows []Entry[message.Message]) []string {
 	return open
 }
 
-// AN ORPHANED INVOKE BURIED IN HISTORY MUST STILL BE CLOSABLE.
+// THE DOOR IS BOUNDED, AND REPAIRING HISTORY IS NOT ITS JOB.
 //
-// Gluck, 0.28.1: "messages.98: tool_use ids were found without tool_result
-// blocks immediately after", on an aria whose tail was past 440. The door
-// stops NEW orphans -- it completes a set the moment anything else lands --
-// so a buried one can only come from history written before the door
-// existed, which every aria upgraded from an older figaro has.
+// Gluck's rule: the fig IR is correct BY CONSTRUCTION -- every append closes
+// what it opened -- so nothing may scan the history to find out. The only
+// invokes that can be open belong to the last round, and that is all the door
+// looks at.
 //
-// outstandingInvokes scanned BACKWARD FOR THE LAST invoke-bearing message and
-// examined only that one. With a well-formed round after it, the buried
-// orphan was invisible to the door, to CloseOpenToolCalls, and therefore to
-// every repair figaro has -- and the aria could never send again.
-func TestABuriedOrphanedInvokeIsClosed(t *testing.T) {
+// A buried orphan therefore SURVIVES the door, deliberately. It can only come
+// from history written before the door existed (Gluck, 0.28.1: "messages.98:
+// tool_use ids were found without tool_result blocks", on an aria past 440),
+// and that is damage, repaired once by RepairToolCalls -- not a tax on every
+// append forever.
+func TestTheDoorDoesNotScanHistoryForOrphans(t *testing.T) {
 	be, err := NewXwalBackend(t.TempDir(), 0)
 	require.NoError(t, err)
 	t.Cleanup(func() { be.Close() })
@@ -70,9 +70,16 @@ func TestABuriedOrphanedInvokeIsClosed(t *testing.T) {
 	}
 	require.Equal(t, []string{"toolu_buried"}, unmatchedInvokes(raw.Read()), "fixture")
 
+	// The door sees the last round, which is well formed, and closes nothing.
 	n, err := be.CloseOpenToolCalls(aria)
 	require.NoError(t, err)
-	require.Equal(t, 1, n, "the repair reported closing nothing")
+	require.Zero(t, n, "the door scanned past the current round")
+	require.Equal(t, []string{"toolu_buried"}, unmatchedInvokes(raw.Read()))
+
+	// The explicit repair is what heals damage, and it reports what it did.
+	fixed, err := be.RepairToolCalls(aria)
+	require.NoError(t, err)
+	require.Equal(t, 1, fixed, "the repair closed nothing")
 	require.Empty(t, unmatchedInvokes(raw.Read()),
 		"a buried orphan survived the repair, so this aria is refused by every "+
 			"provider on every send, forever")
 
@@ -34,6 +34,14 @@ type figIRLog struct {
 	loaded  bool
 }
 
+// roundLookback bounds the tail read that resolves outstanding invokes. THE
+// FIG IR IS CORRECT BY CONSTRUCTION: every append through this door closes
+// what it opened, so the only invokes that can be open when a door is created
+// belong to the LAST round -- an assistant message and the results after it.
+// A whole-history read to find them would be O(history) on a path every
+// append takes, to answer a question about the tail.
+const roundLookback = 64
+
 const (
 	// toolClosedNotice is the result text for an invoke the door had to close.
 	toolClosedNotice = "tool call closed without a result (interrupt, fork, or fault)"
@@ -45,10 +53,7 @@ const (
 func (l *figIRLog) Append(e Entry[message.Message]) (Entry[message.Message], error) {
 	l.mu.Lock()
 	defer l.mu.Unlock()
-	if !l.loaded {
-		l.pending = outstandingInvokes(l.Log.Read())
-		l.loaded = true
-	}
+	l.resolvePending()
 
 	results, others := splitToolResults(e.Payload)
 	var late []message.Content
@@ -133,10 +138,7 @@ func GuardIR(inner Log[message.Message]) Log[message.Message] {
 func (l *figIRLog) CloseOpenToolCalls() (int, error) {
 	l.mu.Lock()
 	defer l.mu.Unlock()
-	if !l.loaded {
-		l.pending = outstandingInvokes(l.Log.Read())
-		l.loaded = true
-	}
+	l.resolvePending()
 	if len(l.pending) == 0 {
 		return 0, nil
 	}
@@ -179,28 +181,42 @@ func (l *figIRLog) isPending(id string) bool {
 
 // outstandingInvokes reports the invokes of the last assistant message that
 // still lack results, which is the door's state after a restart or a fork.
-// outstandingInvokes is every invoke in the history with no result anywhere
-// after it. It reads the WHOLE history: it used to examine only the last
-// invoke-bearing message, so an orphan with a well-formed round after it was
-// invisible to every repair figaro has, and the aria was refused by every
-// provider on every send, forever (Gluck, 0.28.1: "messages.98: tool_use ids
-// were found without tool_result blocks"). The door prevents new ones, so
-// these come from history written before the door existed.
+// resolvePending reads what is open, ONCE, from the tail. Never at load: a
+// door that is created and never written costs nothing, and one that is
+// written resolves the current round rather than the history.
+func (l *figIRLog) resolvePending() {
+	if l.loaded {
+		return
+	}
+	l.pending = outstandingInvokes(TailSnapshot(l.Log, roundLookback))
+	l.loaded = true
+}
+
+// outstandingInvokes is the invokes of the last invoke-bearing message that
+// nothing after it answered. rows is a TAIL, not a history.
 func outstandingInvokes(rows []Entry[message.Message]) []message.Content {
+	at := -1
+	for i := len(rows) - 1; i >= 0; i-- {
+		if len(assistantInvokes(rows[i].Payload)) > 0 {
+			at = i
+			break
+		}
+	}
+	if at < 0 {
+		return nil
+	}
 	answered := map[string]bool{}
-	for _, e := range rows {
+	for _, e := range rows[at+1:] {
 		for _, c := range e.Payload.Content {
 			if c.Type == message.ContentToolResult {
 				answered[c.ToolCallID] = true
 			}
 		}
 	}
 	var open []message.Content
-	for _, e := range rows {
-		for _, inv := range assistantInvokes(e.Payload) {
-			if !answered[inv.ToolCallID] {
-				open = append(open, inv)
-			}
+	for _, inv := range assistantInvokes(rows[at].Payload) {
+		if !answered[inv.ToolCallID] {
+			open = append(open, inv)
 		}
 	}
 	return open
@@ -239,3 +255,64 @@ func keepContent(in []message.Content, keep func(message.Content) bool) []messag
 	}
 	return out
 }
+
+// UnmatchedToolCalls counts the invokes in an aria's history that no result
+// answered. Read-only; the audit half of RepairToolCalls.
+func (b *XwalBackend) UnmatchedToolCalls(ariaID string) (int, error) {
+	b.mu.Lock()
+	h, err := b.handleLocked(ariaID)
+	b.mu.Unlock()
+	if err != nil {
+		return 0, err
+	}
+	return len(unansweredInvokes(h.ir.Read())), nil
+}
+
+// unansweredInvokes is every invoke in rows with no result anywhere after it.
+func unansweredInvokes(rows []Entry[message.Message]) []message.Content {
+	answered := map[string]bool{}
+	for _, e := range rows {
+		for _, c := range e.Payload.Content {
+			if c.Type == message.ContentToolResult {
+				answered[c.ToolCallID] = true
+			}
+		}
+	}
+	var open []message.Content
+	for _, e := range rows {
+		for _, inv := range assistantInvokes(e.Payload) {
+			if !answered[inv.ToolCallID] {
+				open = append(open, inv)
+			}
+		}
+	}
+	return open
+}
+
+// RepairToolCalls closes every unanswered invoke in an aria's whole history
+// and reports how many it closed. It is the ONE place that reads the history
+// to find them: the door maintains the invariant going forward, so this
+// exists for arias whose records predate it. Run by `figaro doctor toolcalls`,
+// never on a read path.
+func (b *XwalBackend) RepairToolCalls(ariaID string) (int, error) {
+	b.mu.Lock()
+	h, err := b.handleLocked(ariaID)
+	b.mu.Unlock()
+	if err != nil {
+		return 0, err
+	}
+	open := unansweredInvokes(h.ir.Read())
+	if len(open) == 0 {
+		return 0, nil
+	}
+	closing := message.Message{Role: message.RoleInput}
+	for _, inv := range open {
+		closing.Content = append(closing.Content,
+			message.ToolResultContent(inv.ToolCallID, inv.ToolName, toolClosedNotice, true))
+	}
+	guard := &figIRLog{Log: h.ir, backend: b, ariaID: ariaID}
+	if _, err := guard.write(Entry[message.Message]{Payload: closing}); err != nil {
+		return 0, err
+	}
+	return len(open), nil
+}