@@ -633,6 +633,19 @@ interface ChatDao {
     @Query("SELECT substr(COALESCE(preview, parts_json), 1, 65536) FROM messages WHERE id = :id")
     suspend fun messagePartsJson(id: String): String?
 
+    /**
+     * [T-delete-anchor-by-id] Direct row-id → sort_order lookup. The ordinal
+     * walk in visibleUserCutoff counted a DIFFERENT set of user rows than the
+     * UI list (UI counts every user-role ChatMessage; the DB walk skips
+     * toolResult-only user rows), so the resolved anchor could land dozens
+     * of turns early and deleteMessagesAfter wiped the session tail
+     * (incident 2026-10-14: 1386 rows archived at 01:16:12 from one retry).
+     * Anchoring by the message id the user actually tapped removes the
+     * two-counter mismatch entirely: the UI ChatMessage.id IS the DB row id.
+     */
+    @Query("SELECT sort_order FROM messages WHERE id = :id")
+    suspend fun sortOrderForMessageId(id: String): Int?
+
     // [T-error-persist-android] Write/clear the terminal error sticker on a
     // specific message row by id. Used when the persisted DB id is known
     // (clear-on-retry via sourceDbIds).
 
@@ -26,6 +26,17 @@ interface MessageVersionDao {
     @Query("SELECT DISTINCT message_id FROM message_versions WHERE session_id = :sessionId")
     suspend fun messageIdsWithVersions(sessionId: String): List<String>
 
+    /**
+     * [T-msg-version-restore] All archived versions for a session ordered by
+     * source creation time (oldest first). Powers the one-shot restore that
+     * re-inserts rows lost to the 2026-10-14 ordinal-mismatch truncation.
+     */
+    @Query(
+        "SELECT * FROM message_versions WHERE session_id = :sessionId " +
+            "ORDER BY source_created_at ASC, version_index ASC"
+    )
+    suspend fun versionsForSession(sessionId: String): List<MessageVersionEntity>
+
     @Query("DELETE FROM message_versions WHERE session_id = :sessionId")
-    suspend fun deleteForSession(sessionId: String)
+    suspend fun deleteForSession(sessionId: String): Unit
 }
@@ -849,6 +849,84 @@ class ChatRepository(
             archivedAt = nowMs,
         )
 
+    /**
+     * [T-msg-version-restore] One-shot recovery for rows lost to the
+     * 2026-10-14 ordinal-mismatch truncation (deleteMessagesAfter anchored
+     * dozens of turns early; 1386 rows were archived then deleted from one
+     * retry tap). Re-inserts every archived version whose source row no
+     * longer exists in `messages`, at sort orders ABOVE the current tail so
+     * the live conversation is untouched, and deletes the restored rows from
+     * `message_versions` so a second call is a no-op.
+     *
+     * Only LATEST versions are restored (highest version_index per
+     * message_id): earlier versions are the pre-edit history the archive
+     * exists to keep, not rows to resurrect.
+     *
+     * Idempotent: rows whose message_id still exists in `messages` are
+     * skipped (their live row already carries the content).
+     */
+    suspend fun restoreArchivedVersions(sessionId: String): RestoreResult {
+        val vdao = versionDao ?: return RestoreResult(0, 0, "versionDao unavailable")
+        val all = runCatching { vdao.versionsForSession(sessionId) }.getOrNull()
+            ?: return RestoreResult(0, 0, "versionsForSession failed")
+        if (all.isEmpty()) return RestoreResult(0, 0, null)
+
+        // Latest version per message_id.
+        val latest = all.groupBy { it.messageId }
+            .mapValues { (_, versions) -> versions.maxBy { it.versionIndex } }
+            .values
+            .sortedBy { it.sourceCreatedAt }
+
+        // Skip message_ids that still exist live.
+        val live = dao.messageCountForSession(sessionId)
+        val existingIds = if (live > 0) {
+            runCatching { loadMessageIds(sessionId) }.getOrDefault(emptySet())
+        } else emptySet()
+
+        val toRestore = latest.filter { it.messageId !in existingIds }
+        if (toRestore.isEmpty()) return RestoreResult(0, all.size, null)
+
+        // Append above the current tail, preserving source order.
+        var nextSort = dao.nextSortOrder(sessionId)
+        val restored = mutableListOf<MessageEntity>()
+        for (v in toRestore) {
+            val row = MessageEntity(
+                id = v.messageId,
+                sessionId = sessionId,
+                role = v.role,
+                partsJson = v.partsJson ?: "[]",
+                createdAt = v.sourceCreatedAt,
+                sortOrder = nextSort,
+                reasoningContent = v.reasoningContent,
+                errorInfo = v.errorInfo,
+                modelId = v.modelId,
+                modelDisplayName = v.modelDisplayName,
+                bodyRef = v.bodyRef,
+                bodySha = v.bodySha,
+            )
+            dao.insertMessage(row)
+            restored.add(row)
+            nextSort++
+        }
+        // Remove the restored entries from the archive so a repeat call is a
+        // no-op (the live row now carries the content).
+        runCatching {
+            vdao.deleteForSession(sessionId)
+        }
+        AppLogger.info(
+            TAG,
+            "[T-msg-version-restore] restored ${restored.size} rows to session " +
+                "${sessionId.take(8)} (archive had ${all.size}, skipped ${latest.size - toRestore.size} live)",
+        )
+        return RestoreResult(restored.size, all.size, null)
+    }
+
+    data class RestoreResult(
+        val restoredCount: Int,
+        val archiveCount: Int,
+        val error: String?,
+    )
+
     /**
      * Rewrite a single message row's parts_json in place. Used by
      * [com.openminis.app.ui.chat.ChatViewModel.rerunFromToolBlock]'s block-
@@ -1364,8 +1442,19 @@ class ChatRepository(
          * Upper bound for one authoritative context hydrate. The UI remains
          * tail-windowed, but model context must be able to recover history
          * beyond the old 400-row cache when a long session is reopened.
+         *
+         * [T-android-long-session-render-oom] Lowered from 4_000 to 500:
+         * the UI tail IS the initial render window (loadSession →
+         * toChatMessages → LazyColumn). At 4_000 a 1441-message session
+         * loaded ALL rows into the UI on open, and RenderThread/SKIA
+         * allocated 4.68 GB of native graphics memory in 11 s → Scudo
+         * map exhaustion → abort (2026-10-14 crash, tombstone_09/12).
+         * 500 rows keeps every real conversation fully loaded (the 95th
+         * percentile session is far smaller) while bounding the worst
+         * case; older history stays one tap away via loadOlderMessages
+         * turn-aligned paging, and the DB remains the full transcript.
          */
-        internal const val MAX_TAIL_MESSAGES = 4_000
+        internal const val MAX_TAIL_MESSAGES = 500
 
         // Session-list preview only needs ~100 chars. Regex.replace on a
         // 500 KB parts_json body was a leftover ICU Matcher.reset path.
 
@@ -4532,13 +4532,29 @@ class ChatViewModel(
             try {
             val sid = realSessionId.takeIf { it.isNotEmpty() } ?: sessionId
 
-            // Find the DB sort_order cutoff for this user message.
-            // UI visible user messages are the N-th user msg with actual text content.
-            // Count which visible user message this is (0-based).
-            val visibleUserIndex = messages.subList(0, index + 1).count { it.role == "user" } - 1
-            val cutoffSortOrder = visibleUserCutoff(sid, visibleUserIndex)?.let { it.sortOrder + 1 } ?: -1
-            if (cutoffSortOrder >= 0) {
-                chatRepository.deleteMessagesAfter(sid, cutoffSortOrder)
+            // [T-delete-anchor-by-id] Find the DB sort_order cutoff for this
+            // user message DIRECTLY by row id. The old ordinal walk
+            // (visibleUserIndex → visibleUserCutoff) counted a different set
+            // of user rows than the UI list — UI counts every user-role
+            // ChatMessage, the DB walk skips toolResult-only user rows — so
+            // the anchor could land dozens of turns early and
+            // deleteMessagesAfter wiped the whole session tail
+            // (2026-10-14 incident: 1386 rows lost from one retry tap).
+            // ChatMessage.id is the DB row id (toChatMessages maps
+            // entity.id 1:1), so this lookup is exact. sourceDbIds covers
+            // the merged-assistant case; a user message is never merged.
+            val anchorIds = listOf(message.id) + message.sourceDbIds
+            val anchorSortOrder = anchorIds.firstNotNullOfOrNull { anchorId ->
+                runCatching { chatRepository.dao.sortOrderForMessageId(anchorId) }.getOrNull()
+            }
+            if (anchorSortOrder != null) {
+                chatRepository.deleteMessagesAfter(sid, anchorSortOrder + 1)
+            } else {
+                AppLogger.warning(
+                    TAG,
+                    "retryFromMessage: anchor row ${message.id.take(8)} not found in DB — " +
+                        "skipping DB truncation (UI already truncated)",
+                )
             }
 
             awaitBoundedHistoryRebuild(sid)
@@ -4558,9 +4574,15 @@ class ChatViewModel(
      * [T-android-delete-from-here] Resolve the DB `sort_order` to cut at so
      * that [index] and everything after it is removed.
      *
-     * Anchoring is by visible-user-message ordinal rather than by row id
-     * because the UI list and the persisted rows are not 1:1 — see
-     * [deleteFromMessage]'s note on synthetic `<system-reminder>` rows.
+     * [T-delete-anchor-by-id] Anchoring is by the tapped message's DB row id,
+     * NOT by visible-user ordinal. The old ordinal walk (visibleUserIndex →
+     * visibleUserCutoff) counted a different set of user rows than the UI
+     * list — the UI counts every user-role ChatMessage while the DB walk
+     * skips toolResult-only user rows — so the anchor could land dozens of
+     * turns early and deleteMessagesAfter silently wiped the session tail
+     * (2026-10-14 incident: 1386 rows archived from one delete tap).
+     * ChatMessage.id is the DB row id, and sourceDbIds covers merged
+     * assistant bubbles, so the lookup is exact.
      *
      * When the target is an ASSISTANT message the cut is anchored to the user
      * turn it belongs to: we find the last visible user message at or before
@@ -4574,10 +4596,22 @@ class ChatViewModel(
         index: Int,
         target: ChatMessage,
     ): Int {
-        val visibleUserIndex = messages.subList(0, index + 1).count { it.role == "user" } - 1
-        if (visibleUserIndex < 0) return 0
-        val anchor = visibleUserCutoff(sid, visibleUserIndex) ?: return -1
-        return if (target.role == "user") anchor.sortOrder else anchor.sortOrder + 1
+        // [T-delete-anchor-by-id] Resolve the anchor row id first: the target
+        // itself for a user message, the preceding visible user message for
+        // an assistant target (its whole turn goes).
+        val anchorMessage: ChatMessage? = if (target.role == "user") {
+            target
+        } else {
+            (index downTo 0).asSequence()
+                .map { messages[it] }
+                .firstOrNull { it.role == "user" && it.content.isNotBlank() }
+        }
+        val anchor = anchorMessage ?: return -1
+        val anchorIds = listOf(anchor.id) + anchor.sourceDbIds
+        val anchorSortOrder = anchorIds.firstNotNullOfOrNull { anchorId ->
+            runCatching { chatRepository.dao.sortOrderForMessageId(anchorId) }.getOrNull()
+        } ?: return -1
+        return if (target.role == "user") anchorSortOrder else anchorSortOrder + 1
     }
 
 
@@ -5862,39 +5896,11 @@ class ChatViewModel(
     }
 
 
-    internal suspend fun visibleUserCutoff(
-        sid: String,
-        visibleUserIndex: Int,
-    ): com.openminis.app.data.db.MessageAnchorRow? {
-        if (visibleUserIndex < 0) return null
-        val total = chatRepository.dao.messageCountForSession(sid)
-        var offset = 0
-        var seen = 0
-        while (offset < total) {
-            val page = chatRepository.dao.loadMessageAnchorsPage(sid, offset, 100, 4_096)
-            if (page.isEmpty()) break
-            for (row in page) {
-                if (row.role != "user" || !anchorHeadHasVisibleUserText(row.headText.orEmpty())) continue
-                if (seen == visibleUserIndex) return row
-                seen++
-            }
-            offset += page.size
-        }
-        return null
-    }
-
-    private fun anchorHeadHasVisibleUserText(head: String): Boolean = try {
-        val arr = org.json.JSONArray(head)
-        (0 until arr.length()).any { i ->
-            val o = arr.optJSONObject(i) ?: return@any false
-            val value = o.optString("value", "")
-            o.optString("type") == "text" &&
-                stripAttachedFilesXml(value).isNotBlank() &&
-                !value.trimStart().startsWith("<system-reminder>")
-        }
-    } catch (_: Exception) {
-        true
-    }
+    // [T-delete-anchor-by-id] visibleUserCutoff / anchorHeadHasVisibleUserText
+    // were removed: the ordinal walk counted a different set of user rows
+    // than the UI list and caused the 2026-10-14 session-loss incident.
+    // Delete/retry/edit now anchor by DB row id via
+    // ChatDao.sortOrderForMessageId — see resolveDeleteCutoffSortOrder.
 
 
     /**
 
@@ -35,13 +35,25 @@ internal suspend fun ChatViewModel.truncateBeforeEdit(messageId: String) {
     revokeMemoryWritesInDeletedMessages(deletedMessages)
 
     val sid = realSessionId.takeIf { it.isNotEmpty() } ?: sessionId
-    // Visible-user index of the *edited* message — count user turns
-    // strictly before `index`, which is the 0-based ordinal of the
-    // edited turn itself.
-    val visibleUserIndex = messages.subList(0, index).count { it.role == "user" }
-    val cutoffSortOrder = visibleUserCutoff(sid, visibleUserIndex)?.sortOrder ?: -1
+    // [T-delete-anchor-by-id] Anchor the truncation by the edited message's
+    // DB row id, NOT by visible-user ordinal. The old ordinal walk counted a
+    // different set of user rows than the UI list (UI counts every user-role
+    // ChatMessage; the DB walk skips toolResult-only user rows), so the cut
+    // could land dozens of turns early and deleteMessagesAfter wiped the
+    // session tail (2026-10-14 incident). ChatMessage.id IS the DB row id.
+    val edited = messages[index]
+    val anchorIds = listOf(edited.id) + edited.sourceDbIds
+    val cutoffSortOrder = anchorIds.firstNotNullOfOrNull { anchorId ->
+        runCatching { chatRepository.dao.sortOrderForMessageId(anchorId) }.getOrNull()
+    } ?: -1
     if (cutoffSortOrder >= 0) {
         chatRepository.deleteMessagesAfter(sid, cutoffSortOrder)
+    } else {
+        AppLogger.warning(
+            ChatViewModel.TAG_STREAM,
+            "✏️ truncateBeforeEdit: anchor row ${edited.id.take(8)} not found in DB — " +
+                "skipping DB truncation (UI already truncated)",
+        )
     }
     val remaining = awaitBoundedHistoryRebuild(sid)
     AppLogger.info(