diff --git a/changelog.d/403-truncation-image-slots.fixed.md b/changelog.d/403-truncation-image-slots.fixed.md
new file mode 100644
index 000000000..0f23518ab
--- /dev/null
+++ b/changelog.d/403-truncation-image-slots.fixed.md
@@ -0,0 +1,8 @@
+- A tool result stored over its inline cap no longer keeps every line shaped like a reference stub from past the cut (#403). Every `[ref_…] …` line past the cut was added back after the truncation notice, whether or not it named an image and with no limit, so a text result listing channel attachments was stored far over the cap: a 25,980-character result at a cap of 2,000 was stored at 25,168 characters. The lines past the cut were kept so that `save_recent_image`'s index counts every image the resident saw, and now the stored copy keeps what the live copy showed.
+  - A result with no inline image keeps nothing past its cut. Its live copy is the stored text, so the resident never saw what lies past the cut either. A truncated text result no longer lists the image stubs past the cut: the spill file holds them, and without a writable workspace they aren't kept, like the rest of the text past the cut. Such a reference's record is still in the registry, so running its tool again brings its stub back.
+  - A result carrying an inline image went to the model as blocks: every image and every reference's stub, whatever the text's length, and each text block cut at the cap on its own. Past its cut it keeps the image slots those blocks showed, placeholders and image-typed stubs, the newest 64 of them, the most images the tool-image ledger holds bytes for. A slot in the part of a text block that the live copy cut away isn't kept. When more than 64 fell past the cut, a note says how many were left out, and `save_recent_image` doesn't count those.
+  - History's own truncation, which cuts a script's tool results and those on the direct Agent API, keeps nothing past its cut either: each is read as its text.
+  - The stored copy's cut, history's own truncation, and the live copy's cut of a text block beside an image never leave part of a slot before their notice. A cut that would split a placeholder moves back to the placeholder's start, and one that would split a stub-shaped line moves back to the line's start when at most 677 characters of the line lie before the cut, since that part could still read as an image; a longer part can't, and stays. The live copy and the stored copy cut alike, so the stored copy counts exactly the slots the live copy showed.
+  - `save_recent_image` counts a reference stub as an image by the type its stored text shows, as it did after a restart or an eviction, and no longer by the registry's record while one exists. A stub counts the same whether or not the process still holds its record, and a reference issued again with testimony of another type no longer changes how an earlier stub counts.
+  - A save in the same batch as a long result counts it as its stored copy will be cut, and an error result, or one with no data, which history stores as its error text, counts that text's slots before it is stored as it does after.
+  - A slot is no longer than its writer writes it: a stub-shaped line longer than the longest stub the framework writes (677 characters), or a placeholder whose type or subtype is over 127 characters or whose size's number, ledger nonce or sequence is over 16 characters, is quoted text and counts nowhere. A tool image whose type or subtype is over 127 characters, the most RFC 6838 allows, is labelled `application/octet-stream`. A placeholder stored before with such a type no longer counts; only a server that sent one could have produced it.
diff --git a/src/framework.ts b/src/framework.ts
index 6d854a393..4eaf72802 100644
--- a/src/framework.ts
+++ b/src/framework.ts
@@ -1,6 +1,6 @@
 import { ToolPresentation, presentationTools, isPresentationTool, renderCatalogue, type PresentationSnapshot } from "./tool-presentation.js";
 import { dirname, join } from 'node:path';
-import { INLINE_WITHHELD_TEXT, REFERENCE_LIMITS, classifyBlock, isInlineContradiction, isReferenceExpired, referenceRegistry, referenceStubOrNull, referenceTypeLabel, sanitizeLabel, unfetchableReason } from './mcpl/references.js';
+import { INLINE_WITHHELD_TEXT, REFERENCE_LIMITS, classifyBlock, isInlineContradiction, isReferenceExpired, referenceRegistry, referenceStubOrNull, sanitizeLabel, unfetchableReason } from './mcpl/references.js';
 import { ReferenceFetcher, DEFAULT_FETCH_MAX_BYTES, EAGER_FETCH_TIMEOUT_MS } from './mcpl/reference-fetcher.js';
 import {
   appendFileSync, closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync,
@@ -110,15 +110,19 @@ import {
   toolResultDataToHistoryString,
   truncateForHistory,
   DEFAULT_TOOL_RESULT_INLINE_MAX_CHARS,
+  type HistoryBlockSpan,
 } from './tool-result-history.js';
 import {
   TOOL_IMAGE_REF_RE,
   ToolImageLedger,
-  formatPreservedImageSlots,
+  cutStoredToolResult,
+  formatKeptImageSlots,
   parseImagePlaceholders,
   sha256Hex,
-  splitPreservingImageSlots,
+  storedImageSlots,
+  toolResultCutAt,
   type ParsedImagePlaceholder,
+  type ShownRanges,
 } from './tool-image-ledger.js';
 import { randomUUID, createHash } from 'node:crypto';
 import { PyRunner, buildInjectedTools, formatLimit } from './code-execution/py-runner.js';
@@ -15909,23 +15913,9 @@ export class AgentFramework {
   }> {
     const spilled = new Map<string, { text: string; filePath: string | null }>();
     const dateLabel = new Date().toISOString().slice(0, 10);
-    const ledger = this.toolImageLedgerFor(agentName);
     for (const tc of toolResults) {
-      // Retain every image the result carries BEFORE the placeholder is
-      // written (issue #104): the placeholder embeds the ref, so the image
-      // stays reachable by provenance after the bytes leave the wire.
-      const raw = tc.result.isError
-        ? tc.result.error ?? 'Unknown error'
-        : nonErrorResultText(tc.result, undefined, {
-          imageRef: (blockIndex, image) => ledger.retain({
-            toolCallId: tc.id,
-            toolName: tc.name,
-            blockIndex,
-            data: image.data,
-            mediaType: image.mimeType,
-          }).ref,
-        });
-      spilled.set(tc.id, await this.spillOrTruncate(raw, maxChars, `${dateLabel}-${tc.id}`));
+      const { text, shown } = this.storedToolResultText(agentName, tc, maxChars);
+      spilled.set(tc.id, await this.spillOrTruncate(text, maxChars, `${dateLabel}-${tc.id}`, shown));
     }
     const blocks: ContentBlock[] = toolResults.map(tc => ({
       type: 'tool_result' as const,
@@ -15939,6 +15929,47 @@ export class AgentFramework {
     return { blocks, spilled };
   }
 
+  /**
+   * A tool result's text as its stored copy is written before any cut, and
+   * what its live copy showed beside that text (see cutStoredToolResult). An
+   * error result is its error text. Any other is serialized by
+   * nonErrorResultText, which retains each inline image BEFORE its
+   * placeholder is written (issue #104): the placeholder embeds the ref, so
+   * the image stays reachable by provenance after the bytes leave the wire.
+   *
+   * The live copy is the stored text itself unless the result is a content
+   * array carrying an inline image, which tryNativeToolResultContent sends
+   * as native blocks. It takes the same arrays the serializer takes block by
+   * block, and shows each image and each reference block's stub whole and
+   * each text block up to where it cuts that block at the cap (`maxChars`,
+   * toolResultCutAt), so those are the ranges of the text it showed.
+   */
+  private storedToolResultText(
+    agentName: string,
+    tc: CompletedToolCall,
+    maxChars: number | undefined,
+  ): { text: string; shown: ShownRanges | null } {
+    if (tc.result.isError) return { text: tc.result.error ?? 'Unknown error', shown: null };
+    const ledger = this.toolImageLedgerFor(agentName);
+    let blocks = null as HistoryBlockSpan[] | null;
+    const text = nonErrorResultText(tc.result, undefined, {
+      imageRef: (blockIndex, image) => ledger.retain({
+        toolCallId: tc.id,
+        toolName: tc.name,
+        blockIndex,
+        data: image.data,
+        mediaType: image.mimeType,
+      }).ref,
+      onBlocks: (spans) => { blocks = spans; },
+    });
+    if (!blocks?.some((block) => block.kind === 'image')) return { text, shown: null };
+    return {
+      text,
+      shown: blocks.map(({ kind, start, end }): [number, number] =>
+        [start, kind === 'text' && maxChars ? start + toolResultCutAt(text.slice(start, end), maxChars) : end]),
+    };
+  }
+
   /** Where a tool result labelled `label` is written: `<first writable
    *  mount>/tool-results/<label>.txt`, or null when there is no writable
    *  workspace. */
@@ -16070,15 +16101,21 @@ export class AgentFramework {
     content: string,
     cap: number | undefined,
     label: string,
+    /** What the live copy showed beside this text (storedToolResultText);
+     *  null when the live copy was this text. */
+    shown: ShownRanges | null = null,
   ): Promise<{ text: string; filePath: string | null }> {
     if (!cap || content.length <= cap) return { text: content, filePath: null };
     // The stored text is the only place save_recent_image discovers tool
-    // images, and the live wire delivers every image regardless of text
-    // length — so an image slot dropped by the cut is an image the resident
-    // saw that the index would silently slide past (issue #104). Keep the
-    // slots at or past the cut, re-appended after the notice.
-    const { head, tail } = splitPreservingImageSlots(content, cap);
-    const kept = formatPreservedImageSlots(tail);
+    // images. When the live wire delivered them beside the text, whatever
+    // its length, an image slot dropped by the cut is an image the resident
+    // saw that the index would silently slide past (issue #104), so the
+    // newest slots past the cut that the live copy showed are re-appended
+    // after the notice. Otherwise the live copy is this text, and nothing
+    // past the cut is kept (#403).
+    const cut = cutStoredToolResult(content, cap, shown);
+    const { head } = cut;
+    const kept = formatKeptImageSlots(cut);
 
     const written = await this.writeToolResultFile(label, content);
     if (written && written.error === undefined) {
@@ -16312,7 +16349,9 @@ export class AgentFramework {
    * convert to Membrane's native ToolResultContentBlock[]. Returns null when
    * the array is text-only (let JSON path handle it; saves a code path).
    * `maxChars`, when provided, caps each accompanying text block so an image
-   * inlined alongside an enormous text payload can't blow the context.
+   * inlined alongside an enormous text payload can't blow the context. A
+   * block is cut as the stored copy is (toolResultCutAt), never inside a
+   * slot, so the stored copy can keep exactly the slots this showed (#403).
    */
   private tryNativeToolResultContent(
     data: unknown,
@@ -16337,7 +16376,7 @@ export class AgentFramework {
         // rather than sending the whole array to the JSON fallback.
         let text = typeof b.text === 'string' ? b.text : NON_STRING_TEXT_PLACEHOLDER;
         if (maxChars && text.length > maxChars) {
-          text = safeSlice(text, 0, maxChars)
+          text = text.slice(0, toolResultCutAt(text, maxChars))
             + '\n\n[truncated — original was ' + text.length + ' chars'
             + (spillPath ? `; full serialized result: workspace file ${spillPath}` : '')
             + ']';
@@ -20859,36 +20898,28 @@ export class AgentFramework {
               consider({ kind: 'tool', ref: ph.ref, toolCallId, toolName, mediaType: ph.mediaType, messagesBack });
               continue;
             }
-            // Reference stub: the registry's claimed type (when this process
-            // still has the record), else the first image/ token in the
-            // stub's text, which can come from its name, says whether it was
-            // an image. Either is read as the stub shows a type, sanitized
-            // and bounded. Non-image references are not slots.
-            const claimed = referenceRegistry.get(ph.refId)?.testimony.mimeType ?? ph.mediaType ?? undefined;
-            const mediaType = referenceTypeLabel(claimed).toLowerCase();
-            if (!mediaType.startsWith('image/')) continue;
-            consider({ kind: 'reference', refId: ph.refId, mediaType, toolCallId, toolName, messagesBack });
+            // A reference stub whose text shows an image type: a slot that
+            // never saves (parseImagePlaceholders returns no other stub).
+            consider({ kind: 'reference', refId: ph.refId, mediaType: ph.mediaType, toolCallId, toolName, messagesBack });
           }
         };
 
         // Same-batch results (e.g. a snapshot dispatched alongside the save)
-        // are not in the store yet but ARE the newest images. Classify them
-        // with the very serializer the commit path will run — contradiction
-        // blocks withheld, uri-form blocks as reference stubs, unknown shapes
-        // as no slot at all — so the inventory means the same thing before
-        // and after commit. Retention is idempotent per block, so the
-        // placeholder written at commit time carries the same ref.
+        // are not in the store yet but ARE the newest images. Count them as
+        // their stored copies will count: the very text the commit path will
+        // serialize (contradiction blocks withheld, uri-form blocks as
+        // reference stubs, unknown shapes as no slot at all), cut at this
+        // agent's inline cap as spillOrTruncate will cut it, so the inventory
+        // means the same thing before and after commit. Retention is
+        // idempotent per block, so the placeholder written at commit time
+        // carries the same ref.
         const state = agent.state;
         if (state.status === 'waiting_for_tools') {
+          const cap = this.resolveToolResultInlineCap(agent).cap;
           for (let i = state.completed.length - 1; i >= 0 && collecting(); i--) {
             const tc = state.completed[i]!;
-            if (tc.result.isError) continue;
-            const text = toolResultDataToHistoryString(tc.result.data, undefined, {
-              imageRef: (blockIndex, image) => ledger.retain({
-                toolCallId: tc.id, toolName: tc.name, blockIndex, data: image.data, mediaType: image.mimeType,
-              }).ref,
-            });
-            considerToolResultImages(tc.id, tc.name, parseImagePlaceholders(text), 0);
+            const { text, shown } = this.storedToolResultText(agentName, tc, cap);
+            considerToolResultImages(tc.id, tc.name, storedImageSlots(text, cap, shown), 0);
           }
         }
 
diff --git a/src/mcpl/references.ts b/src/mcpl/references.ts
index 2043953a1..2d8021ac4 100644
--- a/src/mcpl/references.ts
+++ b/src/mcpl/references.ts
@@ -30,6 +30,10 @@ export const REFERENCE_LIMITS = { uri: 4096, mimeType: 255, name: 255, expiresAt
 export const DIGEST_PATTERN = /^sha256:[A-Za-z0-9_-]{43}$/;
 const MAX_SAFE = 9007199254740991; // 2^53 - 1
 const STUB_FIELD_CHARS = 120;
+/** A saved copy's path, as its stub shows it. */
+const SAVED_PATH_CHARS = 256;
+/** A reference id's random suffix (see ReferenceRegistry.register). */
+const REF_ID_SUFFIX_CHARS = 4;
 
 export type ReferenceDisposition = 'never' | 'ref';
 
@@ -261,7 +265,7 @@ export class ReferenceRegistry {
         return existing;
       }
     }
-    const refId = `ref_${(++this.counter).toString(36)}_${Math.random().toString(36).slice(2, 6)}`;
+    const refId = `ref_${(++this.counter).toString(36)}_${Math.random().toString(36).slice(2, 2 + REF_ID_SUFFIX_CHARS)}`;
     const record: ReferenceRecord = { refId, serverId, testimony, receivedAt: Date.now() };
     this.records.set(refId, record);
     this.byKey.set(testimony.uri, refId);
@@ -299,6 +303,22 @@ export function referenceTypeLabel(mimeType: string | undefined): string {
   return mimeType ? sanitizeLabel(mimeType, STUB_FIELD_CHARS) : '';
 }
 
+/**
+ * The longest line buildReferenceStub writes, in UTF-16 code units, from its
+ * own bounds: the longest id the registry mints, then the name, the type with
+ * the largest size it shows, and the origin, each at its bound, and the
+ * longest ending, a saved copy's path, with their separators. The other
+ * endings, the fetch hint and the reasons a fetch would be refused, are
+ * shorter. A line shaped like a stub but longer than this is quoted text the
+ * writer can't have written, and no image slot (tool-image-ledger.ts).
+ */
+export const REFERENCE_STUB_MAX_CHARS =
+  `[ref_${MAX_SAFE.toString(36)}_] `.length + REF_ID_SUFFIX_CHARS
+  + STUB_FIELD_CHARS
+  + ' — '.length + STUB_FIELD_CHARS + ', '.length + `${formatSizeBytes(MAX_SAFE)} claimed`.length
+  + ' — '.length + STUB_FIELD_CHARS
+  + ' — '.length + 'saved: '.length + SAVED_PATH_CHARS;
+
 /**
  * Build the model-visible stub for a reference. Output length is bounded by
  * host constants and independent of every server-supplied field length.
@@ -322,7 +342,7 @@ export function buildReferenceStub(t: ReferenceTestimony, provenance?: string, s
   if (record.fetchedPath) {
     // Already materialized by the host-mediated fetcher: hand the model the
     // workspace path (host-generated, §7.3) so existing tools just work.
-    parts.push(`saved: ${sanitizeLabel(record.fetchedPath, 256)}`);
+    parts.push(`saved: ${sanitizeLabel(record.fetchedPath, SAVED_PATH_CHARS)}`);
   } else {
     // A reference whose record shows the fetcher would refuse it says why,
     // rather than inviting a fetch_reference call.
diff --git a/src/tool-image-ledger.ts b/src/tool-image-ledger.ts
index e1191d91b..26489a03a 100644
--- a/src/tool-image-ledger.ts
+++ b/src/tool-image-ledger.ts
@@ -27,6 +27,7 @@
  */
 
 import { createHash, randomBytes } from 'node:crypto';
+import { REFERENCE_STUB_MAX_CHARS, referenceTypeLabel } from './mcpl/references.js';
 import { safeSlice } from './safe-slice.js';
 
 export interface RetainedToolImage {
@@ -189,8 +190,9 @@ function mintLedgerNonce(): string {
 /** Grammar of a ref this module mints: `img_<ledger nonce>_<sequence>`. */
 export const TOOL_IMAGE_REF_RE = /^img_[0-9a-z]+_\d+$/;
 
-/** RFC 6838 type/subtype token characters (lowercased); no parameters. */
-const MEDIA_TYPE_ESSENCE_RE = /^[a-z0-9!#$&^_.+-]+\/[a-z0-9!#$&^_.+-]+$/;
+/** RFC 6838 type/subtype token characters (lowercased), each name at most
+ *  127 characters (its section 4.2); no parameters. */
+const MEDIA_TYPE_ESSENCE_RE = /^[a-z0-9!#$&^_.+-]{1,127}\/[a-z0-9!#$&^_.+-]{1,127}$/;
 export const FALLBACK_MEDIA_TYPE = 'application/octet-stream';
 
 /**
@@ -228,21 +230,32 @@ export type ParsedImagePlaceholder =
     /** The placeholder exactly as it appears in the text. */
     text: string;
   }
-  /** An RFC-005 reference stub whose testimony says image — bytes live
+  /** An RFC-005 reference stub whose text shows an image type — bytes live
    *  behind fetch_reference, never in this ledger. Occupies a slot so the
    *  index cannot slide past it. */
   | {
     kind: 'reference';
     refId: string;
-    /** Mime sniffed from the stub text; null when the stub names none. */
-    mediaType: string | null;
+    /** The image type the stub shows, as a stub shows a type (sanitized and
+     *  bounded), lowercased: the first `image/` token in its text, which can
+     *  come from its name. */
+    mediaType: string;
     offset: number;
     /** The stub line exactly as it appears in the text. */
     text: string;
   };
 
-const PLACEHOLDER_RE = /\[image: ([a-z0-9!#$&^_.+-]+\/[a-z0-9!#$&^_.+-]+), (~?[\d.]+(?:B|KB|MB))(?:, ref (img_[0-9a-z]+_\d+))?\]/g;
-/** `[ref_1_ab3d] cam.png — image/png, 1.2MB claimed — from tool result — …` (one line). */
+/**
+ * `[image: image/png, ~691KB, ref img_k7x3q2_7]`. Each part is bounded by
+ * what formatToolImagePlaceholder writes, so text shaped like a placeholder
+ * but longer is no slot: a type and a subtype name at RFC 6838's 127
+ * characters each (normalizeMediaType writes none longer), and a size's
+ * number, a ledger nonce and a sequence at 16 characters each, a safe
+ * integer's digits.
+ */
+const PLACEHOLDER_RE = /\[image: ([a-z0-9!#$&^_.+-]{1,127}\/[a-z0-9!#$&^_.+-]{1,127}), (~?[\d.]{1,16}(?:B|KB|MB))(?:, ref (img_[0-9a-z]{1,16}_\d{1,16}))?\]/g;
+/** `[ref_1_ab3d] cam.png — image/png, 1.2MB claimed — from tool result — …`
+ *  (one line, at most REFERENCE_STUB_MAX_CHARS long: see parseImagePlaceholders). */
 const REFERENCE_STUB_RE = /^\[(ref_[0-9a-z]+_[0-9a-z]+)\] ([^\n]*)$/gm;
 const IMAGE_MIME_RE = /\bimage\/[a-z0-9!#$&^_.+-]+/i;
 
@@ -252,6 +265,13 @@ const IMAGE_MIME_RE = /\bimage\/[a-z0-9!#$&^_.+-]+/i;
  * untrusted — a tool result can quote someone else's placeholder verbatim —
  * so the caller MUST cross-check a resolved ref's provenance against the
  * tool_result block it was found in before handing out bytes.
+ *
+ * Decided from the text alone, so a stored result counts the same however
+ * long ago it was written, across restarts and registry evictions. A
+ * reference stub is a slot when its text shows an image type, and a
+ * non-image reference is no slot. A line shaped like a stub but longer than
+ * buildReferenceStub writes (REFERENCE_STUB_MAX_CHARS) is quoted text and no
+ * slot either, so a slot's text is bounded wherever it is kept.
  */
 export function parseImagePlaceholders(text: string): ParsedImagePlaceholder[] {
   const out: ParsedImagePlaceholder[] = [];
@@ -259,43 +279,142 @@ export function parseImagePlaceholders(text: string): ParsedImagePlaceholder[] {
     out.push({ kind: 'inline', mediaType: m[1]!, sizeLabel: m[2]!, ref: m[3] ?? null, offset: m.index ?? 0, text: m[0] });
   }
   for (const m of text.matchAll(REFERENCE_STUB_RE)) {
-    const mime = m[2]!.match(IMAGE_MIME_RE);
-    out.push({ kind: 'reference', refId: m[1]!, mediaType: mime ? mime[0].toLowerCase() : null, offset: m.index ?? 0, text: m[0] });
+    if (m[0].length > REFERENCE_STUB_MAX_CHARS) continue;
+    const shown = m[2]!.match(IMAGE_MIME_RE);
+    if (!shown) continue;
+    out.push({ kind: 'reference', refId: m[1]!, mediaType: referenceTypeLabel(shown[0]).toLowerCase(), offset: m.index ?? 0, text: m[0] });
   }
   out.sort((a, b) => a.offset - b.offset);
   return out;
 }
 
 /**
- * Cut `text` to at most `cap` chars WITHOUT losing or splitting an image
- * slot. The stored tool_result text is the only place the inventory
- * discovers tool images, while the live wire still delivers every image
- * regardless of text length — so a slot dropped by truncation is an image
- * the resident saw that the index silently slides past (the #104 failure,
- * one representation over). Returns the head to keep and the slots that
- * fell at or past the cut, to be re-appended verbatim after the truncation
- * notice. A slot straddling the cut moves the cut back to its start, so the
- * head never contains a partial slot (a partial reference-stub line would
- * otherwise still re-parse and be counted twice).
+ * The most image slots a stored copy keeps past its cut: a bound on what it
+ * carries there, set at the ledger's entry limit, the most images it holds
+ * bytes for. Serializing a result retains its images in order before their
+ * placeholders are written, and every agent's ledger is built with the
+ * defaults, so once a result is stored a save can reach bytes for at most
+ * its newest DEFAULT_TOOL_IMAGE_LEDGER_MAX_ENTRIES images, fewer when the
+ * ledger's limit on held characters binds first, and an inline image older
+ * than those can only fail. Image stubs and quoted placeholders count toward
+ * the bound too, so where they follow a result's images past the cut, the
+ * newest slots kept can leave out an image whose bytes the ledger still
+ * holds.
+ */
+export const MAX_KEPT_IMAGE_SLOTS = DEFAULT_TOOL_IMAGE_LEDGER_MAX_ENTRIES;
+
+/** The ranges `[start, end)` of a tool result's text that its live copy
+ *  showed beside its images: each text block up to where the live copy cut it
+ *  at the inline cap (toolResultCutAt), and every other block whole. They
+ *  come in text order and never overlap, as the blocks do, and
+ *  cutStoredToolResult relies on that. */
+export type ShownRanges = ReadonlyArray<readonly [number, number]>;
+
+/** A tool result's stored copy, cut at its inline cap. */
+export interface StoredCut {
+  /** The text before the cut. */
+  head: string;
+  /** The image slots past the cut that the stored copy re-appends after its
+   *  truncation notice, in text order: the newest MAX_KEPT_IMAGE_SLOTS of
+   *  those the live copy showed. */
+  kept: string[];
+  /** How many image slots past the cut the live copy showed. */
+  fell: number;
+}
+
+/**
+ * Where a tool result's text longer than `cap` is cut: by its stored copy
+ * (cutStoredToolResult), by history's own truncation (truncateForHistory),
+ * and by its live copy, for each text block beside an image
+ * (tryNativeToolResultContent, framework.ts), so the stored copy and the live
+ * copy cut alike. The text's length when it isn't longer than `cap`.
+ *
+ * The cut is made at the cap, or before it when the cap would split a
+ * surrogate pair (safeSlice's rule), and that is where the moves back are
+ * measured from. It moves back to the start of a placeholder it would split,
+ * and then to the start of a stub-shaped line it would split when at most
+ * REFERENCE_STUB_MAX_CHARS of the line lie before it, since that part could
+ * still read as a slot. So no slot straddles the cut, and the text before it
+ * never ends in part of one. A longer part, which can't parse as a slot,
+ * stays before the cut. Each move back lands on a `[`, so it splits no pair.
  */
-export function splitPreservingImageSlots(text: string, cap: number): { head: string; tail: string[] } {
-  const slots = parseImagePlaceholders(text);
-  let cutAt = cap;
-  for (const slot of slots) {
-    if (slot.offset < cutAt && slot.offset + slot.text.length > cutAt) cutAt = slot.offset;
+export function toolResultCutAt(text: string, cap: number): number {
+  if (text.length <= cap) return text.length;
+  let cutAt = safeSlice(text, 0, cap).length;
+  // Neither grammar crosses a newline, so only the line holding the cut can
+  // be split; it is read whole, as the parser reads it.
+  const lineStart = text.lastIndexOf('\n', cutAt - 1) + 1;
+  const newline = text.indexOf('\n', cutAt);
+  const line = text.slice(lineStart, newline === -1 ? text.length : newline);
+  for (const m of line.matchAll(PLACEHOLDER_RE)) {
+    const start = lineStart + (m.index ?? 0);
+    if (start < cutAt && start + m[0].length > cutAt) cutAt = start;
   }
-  return {
-    head: safeSlice(text, 0, cutAt),
-    tail: slots.filter((slot) => slot.offset >= cutAt).map((slot) => slot.text),
-  };
+  for (const m of line.matchAll(REFERENCE_STUB_RE)) {
+    const start = lineStart + (m.index ?? 0);
+    if (start < cutAt && start + m[0].length > cutAt && cutAt - start <= REFERENCE_STUB_MAX_CHARS) cutAt = start;
+  }
+  return cutAt;
 }
 
-/** Text to append after a truncation notice so the preserved slots stay
- *  parseable (each reference stub on its own line). Empty when none. */
-export function formatPreservedImageSlots(tail: string[]): string {
-  if (tail.length === 0) return '';
-  return `\n[${tail.length} image slot(s) fell past the cut; kept here in order so save_recent_image still counts them:]\n`
-    + tail.join('\n');
+/**
+ * Cut a tool result's text at its inline `cap` as its stored copy keeps it
+ * (toolResultCutAt): the stored copy keeps what the live copy showed. A text
+ * within the cap is all head, with nothing kept after it.
+ *
+ * `shown` is what the live copy showed beside the stored text: null when the
+ * live copy was the text itself, as for every result that carried no inline
+ * image. Then what the cut keeps is exactly what the resident saw, and
+ * nothing past it is kept (#403). A result that carried an inline image went
+ * to the model as native blocks (tryNativeToolResultContent, framework.ts),
+ * every image whatever the text's length, so its stored text is the only
+ * place save_recent_image's inventory finds them, and a slot dropped by the
+ * cut would be an image the resident saw that the index slides past (#104).
+ * The image slots past the cut that lie wholly within what the live copy
+ * showed are kept, the newest MAX_KEPT_IMAGE_SLOTS of them, since the
+ * inventory counts from the end.
+ */
+export function cutStoredToolResult(text: string, cap: number, shown: ShownRanges | null): StoredCut {
+  const cutAt = toolResultCutAt(text, cap);
+  const head = text.slice(0, cutAt);
+  if (shown === null) return { head, kept: [], fell: 0 };
+  // The slots and the ranges both come in text order, so one pass walks
+  // them together: a range that ends where a slot starts, or before, holds
+  // no later slot either.
+  const past: ParsedImagePlaceholder[] = [];
+  let r = 0;
+  for (const slot of parseImagePlaceholders(text)) {
+    if (slot.offset < cutAt) continue;
+    while (r < shown.length && shown[r]![1] <= slot.offset) r++;
+    const range = shown[r];
+    if (range && slot.offset >= range[0] && slot.offset + slot.text.length <= range[1]) past.push(slot);
+  }
+  return { head, kept: past.slice(-MAX_KEPT_IMAGE_SLOTS).map((slot) => slot.text), fell: past.length };
+}
+
+/** What a stored copy re-appends after its truncation notice: the kept
+ *  slots, each on its own line so a reference stub stays parseable, under a
+ *  note saying how many fell past the cut, and how many of those were left
+ *  out and aren't counted. Empty when none fell past the cut. */
+export function formatKeptImageSlots(cut: StoredCut): string {
+  if (cut.fell === 0) return '';
+  const leftOut = cut.fell - cut.kept.length;
+  const note = leftOut === 0
+    ? `${cut.fell} image slot(s) fell past the cut; kept here in order so save_recent_image still counts them:`
+    : `${cut.fell} image slot(s) fell past the cut. The last ${cut.kept.length} are kept here in order so `
+      + `save_recent_image still counts them; the ${leftOut} before them are left out, and it doesn't count them:`;
+  return `\n[${note}]\n${cut.kept.join('\n')}`;
+}
+
+/**
+ * The image slots a tool result's stored copy holds: its text's, or, when the
+ * text is longer than `cap`, those the cut keeps, in head and after the
+ * notice (cutStoredToolResult). The notice itself holds none. For counting a
+ * result before its stored copy is written, as it will count after.
+ */
+export function storedImageSlots(text: string, cap: number, shown: ShownRanges | null): ParsedImagePlaceholder[] {
+  const cut = cutStoredToolResult(text, cap, shown);
+  return parseImagePlaceholders(cut.head + formatKeptImageSlots(cut));
 }
 
 export function sha256Hex(bytes: Buffer): string {
diff --git a/src/tool-result-history.ts b/src/tool-result-history.ts
index bbba8ea6c..0b80a2dd6 100644
--- a/src/tool-result-history.ts
+++ b/src/tool-result-history.ts
@@ -16,7 +16,16 @@
 
 import { INLINE_WITHHELD_TEXT, isInlineContradiction, referenceStubOrNull } from './mcpl/references.js';
 import { NON_STRING_TEXT_PLACEHOLDER } from './mcpl/visible-content.js';
-import { formatPreservedImageSlots, formatToolImagePlaceholder, splitPreservingImageSlots } from './tool-image-ledger.js';
+import { formatToolImagePlaceholder, toolResultCutAt } from './tool-image-ledger.js';
+
+/** Where one block of a content array sits in its history text, and what
+ *  kind of block it was: text, an inline image (its placeholder), an RFC-005
+ *  reference (its stub), or inline data withheld for a contradiction. */
+export interface HistoryBlockSpan {
+  kind: 'text' | 'image' | 'reference' | 'withheld';
+  start: number;
+  end: number;
+}
 
 export interface HistorySerializeOptions {
   /**
@@ -26,6 +35,13 @@ export interface HistorySerializeOptions {
    * handle in history; null leaves the legacy ref-less form.
    */
   imageRef?: (blockIndex: number, image: { data: string; mimeType: string }) => string | null;
+  /**
+   * Called once a content array has been serialized block by block, rather
+   * than given up on for the fallback, with where each block sits in the
+   * joined text, before any cut at `maxChars`. The framework reads from it
+   * what a result's live copy showed (#403).
+   */
+  onBlocks?: (spans: HistoryBlockSpan[]) => void;
 }
 
 /**
@@ -81,14 +97,16 @@ export function nonErrorResultText(
   return toolResultDataToHistoryString(data, maxChars, options);
 }
 
-/** Bounded copy of an arbitrary string with the standard truncation notice.
- *  Image slots past the cut are re-appended, never dropped (issue #104). */
+/** Bounded copy of an arbitrary string with the standard truncation notice,
+ *  cut at the cap as a tool result's stored copy is (toolResultCutAt), so it
+ *  never ends in part of a slot. Each of its callers' readers sees this
+ *  very text, never the images behind a placeholder, so nothing past the cut
+ *  is kept for save_recent_image's index (#403). The framework stores a tool
+ *  result with spillOrTruncate, which keeps the slots past its cut that the
+ *  result's live copy showed. */
 export function truncateForHistory(str: string, maxChars: number): string {
   if (str.length <= maxChars) return str;
-  const { head, tail } = splitPreservingImageSlots(str, maxChars);
-  return head
-    + '\n\n[truncated — original was ' + str.length + ' chars]'
-    + formatPreservedImageSlots(tail);
+  return str.slice(0, toolResultCutAt(str, maxChars)) + '\n\n[truncated — original was ' + str.length + ' chars]';
 }
 
 /**
@@ -98,37 +116,47 @@ export function truncateForHistory(str: string, maxChars: number): string {
  */
 function tryHistoryStringFromContentArray(data: unknown, options?: HistorySerializeOptions): string | null {
   if (!Array.isArray(data)) return null;
-  const parts: string[] = [];
+  const parts: Array<{ kind: HistoryBlockSpan['kind']; text: string }> = [];
   for (const [blockIndex, raw] of data.entries()) {
     if (!raw || typeof raw !== 'object') return null;
     const b = raw as { type?: unknown; text?: unknown; data?: unknown; mimeType?: unknown };
     if (b.type === 'text') {
       // A text that isn't a string shows as the converters' placeholder,
       // rather than sending the whole array to the JSON fallback.
-      parts.push(typeof b.text === 'string' ? b.text : NON_STRING_TEXT_PLACEHOLDER);
+      parts.push({ kind: 'text', text: typeof b.text === 'string' ? b.text : NON_STRING_TEXT_PLACEHOLDER });
     } else if (isInlineContradiction(b)) {
       // RFC-005 vector 2: checked before the data branch so inline data
       // claiming bulk disposition is withheld, not rendered.
-      parts.push(INLINE_WITHHELD_TEXT);
+      parts.push({ kind: 'withheld', text: INLINE_WITHHELD_TEXT });
     } else if (b.type === 'image' && typeof b.data === 'string' && typeof b.mimeType === 'string') {
       // Decoded byte estimate from base64 length (3/4 ratio, rounded).
       const approxBytes = Math.floor(b.data.length * 3 / 4);
       const ref = options?.imageRef?.(blockIndex, { data: b.data, mimeType: b.mimeType }) ?? null;
-      parts.push(formatToolImagePlaceholder(b.mimeType, formatSize(approxBytes), ref));
+      parts.push({ kind: 'image', text: formatToolImagePlaceholder(b.mimeType, formatSize(approxBytes), ref) });
     } else if (b.type === 'resource' || ((b.type === 'image' || b.type === 'audio') && typeof (b as { uri?: unknown }).uri === 'string')) {
       // RFC-005 reference block: a bounded stub, never the raw block JSON
       // (which used to inline the URI — and the whole array — into history).
-      // Image-typed stubs still occupy a slot in save_recent_image's
-      // inventory (a failing one — bytes live behind fetch_reference), so
-      // the index never slides past an image the resident saw.
+      // A stub that shows an image type occupies a slot in
+      // save_recent_image's inventory (a failing one — bytes live behind
+      // fetch_reference), so the index never slides past an image the
+      // resident saw.
       const stub = referenceStubOrNull(b, 'from tool result');
       if (stub === null) return null;
-      parts.push(stub);
+      parts.push({ kind: 'reference', text: stub });
     } else {
       return null;
     }
   }
-  return parts.join('\n');
+  if (options?.onBlocks) {
+    const spans: HistoryBlockSpan[] = [];
+    let start = 0;
+    for (const part of parts) {
+      spans.push({ kind: part.kind, start, end: start + part.text.length });
+      start += part.text.length + 1; // the newline that joins them
+    }
+    options.onBlocks(spans);
+  }
+  return parts.map((part) => part.text).join('\n');
 }
 
 function formatSize(bytes: number): string {
diff --git a/test/save-recent-image.test.ts b/test/save-recent-image.test.ts
index 3e3018117..b0fc6ac05 100644
--- a/test/save-recent-image.test.ts
+++ b/test/save-recent-image.test.ts
@@ -17,7 +17,11 @@
  *
  * Second review round (#140) added three more representations of the same
  * failure, each pinned below:
- *   6. truncation/spill never drops an image slot from the stored text.
+ *   6. truncation/spill never drops an image slot the resident saw, and
+ *      keeps none they didn't see: a result carrying images keeps past its
+ *      cut the image slots its live copy showed, the newest 64 of them; a
+ *      text result, whose live copy is its stored text, keeps none past the
+ *      cut; and no cut ends in part of a slot (#403).
  *   7. a save dispatched in the same batch as the snapshot waits for it.
  *   8. refs are namespaced per ledger — a stale ref resolves to nothing,
  *      and a direct `ref` is saved through its occurrence in context.
@@ -41,16 +45,26 @@ import { AgentFramework } from '../src/index.js';
 import { WorkspaceModule } from '../src/modules/workspace/index.js';
 import {
   FALLBACK_MEDIA_TYPE,
+  MAX_KEPT_IMAGE_SLOTS,
   TOOL_IMAGE_REF_RE,
   ToolImageLedger,
-  formatPreservedImageSlots,
+  cutStoredToolResult,
+  formatKeptImageSlots,
   formatToolImagePlaceholder,
   normalizeMediaType,
   parseImagePlaceholders,
-  splitPreservingImageSlots,
+  type ShownRanges,
 } from '../src/tool-image-ledger.js';
-import { toolResultDataToHistoryString, truncateForHistory } from '../src/tool-result-history.js';
-import { UNBOUND_REASON, classifyBlock, referenceRegistry, type ReferenceTestimony } from '../src/mcpl/references.js';
+import { toolResultDataToHistoryString, truncateForHistory, type HistoryBlockSpan } from '../src/tool-result-history.js';
+import {
+  INLINE_WITHHELD_TEXT,
+  REFERENCE_STUB_MAX_CHARS,
+  UNBOUND_REASON,
+  buildReferenceStub,
+  classifyBlock,
+  referenceRegistry,
+  type ReferenceTestimony,
+} from '../src/mcpl/references.js';
 import { createMockResponse, MockMembrane } from './helpers/mock-membrane.js';
 
 const PNG = Buffer.from(
@@ -62,6 +76,35 @@ const sha = (b: Buffer): string => createHash('sha256').update(b).digest('hex');
 const REF_1 = /^img_[0-9a-z]+_1$/;
 /** ~30k chars — past the smallest allowed inline cap (1000) many times over. */
 const LONG_TEXT = 'line of scan output\n'.repeat(1500);
+/** A channel attachment as the framework renders a reference, one line each
+ *  (#403's probe): image-typed for an even `i`, text/plain for an odd one. */
+const attachmentLine = (i: number): string => (i % 2 === 0
+  ? `[ref_${i.toString(36)}_ab3d] item${i}.png — image/png, ~10KB claimed — attachment on channel message — fetch with fetch_reference`
+  : `[ref_${i.toString(36)}_ab3d] item${i}.txt — text/plain, ~10KB claimed — attachment on channel message — fetch with fetch_reference`);
+/** 3,000 characters of channel text, then 200 attachment lines, 100 of them
+ *  images: all past the smallest allowed inline cap. */
+const LISTING = ['x'.repeat(3000), ...Array.from({ length: 200 }, (_, i) => attachmentLine(i))].join('\n');
+/** 100 referenced frames, each image-typed and named for its number. */
+const FRAMES = Array.from({ length: 100 }, (_, i) => ({
+  type: 'image', uri: `https://cam.example/sri-frame-${i}.png`, name: `frame-${i}.png`, mimeType: 'image/png', sizeBytes: 1200,
+}));
+/** A caption after a picture, quoting two attachment lines: the first within
+ *  the smallest allowed inline cap (1000) of its own block, the second past it. */
+const CAPTION = `caption\n${attachmentLine(0)}\n${'y'.repeat(1200)}\n${attachmentLine(2)}`;
+/** A caption whose own cap (1000) falls 49 characters into a quoted
+ *  reference line, after the placeholder that line quotes. */
+const QUOTING_CAPTION = `${'y'.repeat(950)}\n[ref_7_ab3d] quoting [image: image/png, 68B] — image/png, ~1KB claimed — from tool result — fetch with fetch_reference`;
+/** A quoted line shaped like a stub, too long to be a slot whole, that shows
+ *  an image type early. */
+const QUOTED_LINE = `[ref_9_ab3d] quoted — image/png ${'z'.repeat(1500)}`;
+/** Text results whose inline cap (1000) falls inside a stub-shaped line: an
+ *  attachment line, after its type; the quoted line, 499 characters in; and
+ *  the quoted line from the text's start, 1000 characters in. */
+const SPLIT_TEXTS = {
+  split_stub: `${'x'.repeat(900)}\n${attachmentLine(0)}`,
+  split_quoted: `${'x'.repeat(500)}\n${QUOTED_LINE}`,
+  giant_line: QUOTED_LINE,
+} as const;
 
 /** World module: `snap` returns a native PNG image block; the other tools
  *  are the review's representations of the same result, one shape each. */
@@ -82,6 +125,17 @@ class SnapModule implements Module {
       { name: 'snap_sandwich', description: 'Picture, long scan, picture.', inputSchema: schema },
       { name: 'snap_contradiction', description: 'RFC-005 vector-2 image.', inputSchema: schema },
       { name: 'snap_uri', description: 'RFC-005 reference image.', inputSchema: schema },
+      { name: 'listing', description: 'A channel listing, as text.', inputSchema: schema },
+      { name: 'listing_parts', description: 'Channel text, then an attachment line, as two text blocks.', inputSchema: schema },
+      { name: 'snap_listing', description: 'A channel listing, then a picture.', inputSchema: schema },
+      { name: 'snap_frames', description: 'A scan, 100 referenced frames, then a picture.', inputSchema: schema },
+      { name: 'snap_captioned', description: 'A scan, a picture, then a caption.', inputSchema: schema },
+      { name: 'snap_mystery', description: 'A picture beside a block of no known shape.', inputSchema: schema },
+      { name: 'snap_quoting', description: 'A picture, then a caption quoting a reference line.', inputSchema: schema },
+      { name: 'snap_named_ref', description: 'A picture, then a referenced one with a long name.', inputSchema: schema },
+      ...Object.keys(SPLIT_TEXTS).map((name) => ({ name, description: 'Text cut inside a stub-shaped line.', inputSchema: schema })),
+      { name: 'quiet_failure', description: 'A failure not flagged as an error.', inputSchema: schema },
+      { name: 'loud_failure', description: 'An error result.', inputSchema: schema },
     ];
   }
   async handleToolCall(call: { name: string }): Promise<ToolResult> {
@@ -109,6 +163,44 @@ class SnapModule implements Module {
           success: true,
           data: [{ type: 'text', text: 'cam' }, { type: 'image', uri: 'https://cam.example/latest.png', mimeType: 'image/png', sizeBytes: 1200 }],
         };
+      case 'listing':
+        return { success: true, data: [{ type: 'text', text: LISTING }] };
+      case 'listing_parts':
+        return { success: true, data: [{ type: 'text', text: 'x'.repeat(1500) }, { type: 'text', text: attachmentLine(0) }] };
+      case 'snap_listing':
+        return { success: true, data: [{ type: 'text', text: LISTING }, png] };
+      case 'snap_frames':
+        return { success: true, data: [{ type: 'text', text: 'x'.repeat(1500) }, ...FRAMES, png] };
+      case 'snap_captioned':
+        return { success: true, data: [{ type: 'text', text: 'x'.repeat(1500) }, png, { type: 'text', text: CAPTION }] };
+      case 'snap_mystery':
+        // A block of no known shape: both converters give the array up, so
+        // its live copy is its JSON, as stored.
+        return {
+          success: true,
+          data: [png, { type: 'text', text: `${'x'.repeat(1500)}\n[image: image/png, 68B]` }, { type: 'mystery' }],
+        };
+      case 'snap_quoting':
+        return { success: true, data: [png, { type: 'text', text: QUOTING_CAPTION }] };
+      case 'split_stub':
+      case 'split_quoted':
+      case 'giant_line':
+        return { success: true, data: [{ type: 'text', text: SPLIT_TEXTS[call.name as keyof typeof SPLIT_TEXTS] }] };
+      case 'quiet_failure':
+        // No data, so its error text is what history stores, and it quotes
+        // a placeholder from before retention existed.
+        return { success: false, error: 'camera busy; last frame: [image: image/png, 68B]' };
+      case 'loud_failure':
+        // An error result is stored as its error text, whatever data it
+        // carries beside it.
+        return { success: false, isError: true, error: 'camera down; last frame: [image: image/png, 68B]', data: [png] };
+      case 'snap_named_ref':
+        // A picture, then a referenced one whose stub, with its long name,
+        // is longer than a small inline cap.
+        return {
+          success: true,
+          data: [png, { type: 'image', uri: 'https://cam.example/sri-named.png', name: `${'n'.repeat(200)}.png`, mimeType: 'image/png', sizeBytes: 1200 }],
+        };
       default:
         if (this.snapDelayMs > 0) await new Promise((r) => setTimeout(r, this.snapDelayMs));
         return { success: true, data: [{ type: 'text', text: 'watchtower, facing north' }, png] };
@@ -147,6 +239,9 @@ async function startTurn(opts: {
   ledger?: ToolImageLedger;
   seedHistory?: (framework: AgentFramework) => void;
   toolResultInlineMaxChars?: number;
+  /** The agent's resolved inline cap, below the configurable minimum, as a
+   *  small strategy bound gives one. */
+  inlineCap?: number;
   world?: (module: SnapModule) => void;
   workspace?: (workspace: WorkspaceModule) => void;
 }): Promise<Harness> {
@@ -172,6 +267,10 @@ async function startTurn(opts: {
     ...(opts.toolResultInlineMaxChars !== undefined ? { toolResultInlineMaxChars: opts.toolResultInlineMaxChars } : {}),
   });
   workspace.initStore(framework.getStore());
+  if (opts.inlineCap !== undefined) {
+    const cap = opts.inlineCap;
+    (framework as unknown as { resolveToolResultInlineCap: () => { cap: number } }).resolveToolResultInlineCap = () => ({ cap });
+  }
   // Install the ledger up front so tests know the nonce its refs will carry.
   const ledger = opts.ledger ?? new ToolImageLedger();
   (framework as unknown as { toolImageLedgers: Map<string, ToolImageLedger> })
@@ -626,6 +725,41 @@ describe('save_recent_image provenance (issue #104)', () => {
     }
   });
 
+  it("a reference stub is a slot by the type its text shows, whatever the registry's record says now", async () => {
+    // The stored stub showed image/png. The reference was then issued again
+    // with testimony saying text/plain, which replaces an unfetched record's.
+    // The resident saw an image reference, so index 0 is its slot, as it is
+    // after a restart, with no record at all.
+    const uri = 'https://example.invalid/sri-reissued.png';
+    const first = classifyBlock({ type: 'image', uri, mimeType: 'image/png' });
+    const record = referenceRegistry.register((first as { testimony: ReferenceTestimony }).testimony);
+    const again = classifyBlock({ type: 'resource', uri, mimeType: 'text/plain' });
+    referenceRegistry.register((again as { testimony: ReferenceTestimony }).testimony);
+    assert.strictEqual(referenceRegistry.get(record.refId)?.testimony.mimeType, 'text/plain');
+    const h = await startTurn({
+      prefix: 'sri-reference-reissued-',
+      responses: [[saveCall('call_save', { path: 'files/reissued.png', index: 0 })], done],
+      seedHistory: (framework) => {
+        framework.getAgent('prime')!.getContextManager().addMessage('user', [{
+          type: 'tool_result',
+          toolUseId: 'call_cam',
+          toolName: 'mcpl--vst--camera',
+          content: `[${record.refId}] reissued.png — image/png — from tool result — fetch with fetch_reference`,
+          isError: false,
+        }] as ContentBlock[]);
+      },
+    });
+    try {
+      const result = await waitForToolResult(h.framework, 'call_save');
+      assert.strictEqual(result.isError, true, `index 0 is the reference, not the older GIF: ${result.content}`);
+      assert.match(result.content, new RegExp(`index 0 is a reference \\(${record.refId}, image/png, from mcpl--vst--camera`));
+      assert.strictEqual(await fileBytes(h, 'files/reissued.png'), null);
+    } finally {
+      await h.framework.stop();
+      rmSync(h.tempDir, { recursive: true, force: true });
+    }
+  });
+
   it('truncation past the inline cap keeps the image slot: index 0 is still the snapshot', async () => {
     // [30k text, image] at the smallest allowed cap. The wire delivered the
     // image; the stored text must still carry its slot after the cut.
@@ -686,6 +820,285 @@ describe('save_recent_image provenance (issue #104)', () => {
     }
   });
 
+  it('a text result is cut at the cap with no image slot kept past it: its live copy is that text (#403)', async () => {
+    const h = await startTurn({
+      prefix: 'sri-text-cut-',
+      toolResultInlineMaxChars: 1000,
+      responses: [
+        [
+          { type: 'tool_use', id: 'call_listing', name: 'world--listing', input: {} } as ContentBlock,
+          { type: 'tool_use', id: 'call_parts', name: 'world--listing_parts', input: {} } as ContentBlock,
+        ],
+        [saveCall('call_save', { path: 'files/avatar.gif', index: 0 })],
+        done,
+      ],
+    });
+    try {
+      const stored = await waitForToolResult(h.framework, 'call_listing');
+      assert.strictEqual(stored.content.slice(0, 1000), LISTING.slice(0, 1000), 'the head is the first 1000 characters');
+      assert.match(stored.content.slice(1000), /^\n\n\[truncated — showing 1000 of \d+ chars; full content: workspace file [^\]]+\]$/);
+      // A content array of text blocks alone is a text result too: its live
+      // copy is its stored text, not its blocks each cut at the cap.
+      const parts = await waitForToolResult(h.framework, 'call_parts');
+      assert.match(parts.content.slice(1000), /^\n\n\[truncated — showing 1000 of 1611 chars; full content: workspace file [^\]]+\]$/);
+      // The image-typed lines past each cut were never shown, so none
+      // counts: index 0 is the older GIF.
+      const gif = saved(await waitForToolResult(h.framework, 'call_save'));
+      assert.strictEqual(gif[0]!.source, 'attachment');
+      assert.strictEqual(gif[0]!.sha256, sha(GIF));
+    } finally {
+      await h.framework.stop();
+      rmSync(h.tempDir, { recursive: true, force: true });
+    }
+  });
+
+  it('a result carrying an image keeps past its cut only the image slots its live copy showed (#403)', async () => {
+    const h = await startTurn({
+      prefix: 'sri-image-cut-',
+      toolResultInlineMaxChars: 1000,
+      responses: [
+        [{ type: 'tool_use', id: 'call_snap_listing', name: 'world--snap_listing', input: {} } as ContentBlock],
+        [saveCall('call_save_newest', { path: 'files/snap.png', index: 0 })],
+        [saveCall('call_save_older', { path: 'files/avatar.gif', index: 1 })],
+        done,
+      ],
+    });
+    try {
+      const stored = await waitForToolResult(h.framework, 'call_snap_listing');
+      // The live copy showed the listing up to the cap, all filler, and the
+      // snapshot: of the slots past the cut, it showed only the snapshot's.
+      assert.match(stored.content, /\n\[1 image slot\(s\) fell past the cut; kept here in order so save_recent_image still counts them:\]\n\[image: image\/png, /);
+      assert.deepStrictEqual(parseImagePlaceholders(stored.content).map((s) => (s.kind === 'inline' ? s.ref : s.text)), [refOf(h, 1)]);
+      assert.doesNotMatch(stored.content, /\[ref_/);
+      // Index 0 is the snapshot and index 1 the older GIF, as a resident
+      // counting what they saw would count.
+      const newest = saved(await waitForToolResult(h.framework, 'call_save_newest'));
+      assert.strictEqual(newest[0]!.toolCallId, 'call_snap_listing');
+      assert.strictEqual(newest[0]!.sha256, sha(PNG));
+      const older = saved(await waitForToolResult(h.framework, 'call_save_older'));
+      assert.strictEqual(older[0]!.source, 'attachment');
+      assert.strictEqual(older[0]!.sha256, sha(GIF));
+    } finally {
+      await h.framework.stop();
+      rmSync(h.tempDir, { recursive: true, force: true });
+    }
+  });
+
+  it(`a result carrying an image keeps the newest ${MAX_KEPT_IMAGE_SLOTS} of the image slots its live copy showed past its cut`, async () => {
+    const h = await startTurn({
+      prefix: 'sri-frames-cut-',
+      toolResultInlineMaxChars: 1000,
+      responses: [
+        [{ type: 'tool_use', id: 'call_frames', name: 'world--snap_frames', input: {} } as ContentBlock],
+        [saveCall('call_save_newest', { path: 'files/snap.png', index: 0 })],
+        [saveCall('call_save_past', { path: 'files/avatar.gif', index: MAX_KEPT_IMAGE_SLOTS })],
+        done,
+      ],
+    });
+    try {
+      const stored = await waitForToolResult(h.framework, 'call_frames');
+      // The live copy showed every frame's stub whole, and the snapshot,
+      // whatever the scan's length: 101 slots past the cut.
+      assert.match(stored.content, /\n\[101 image slot\(s\) fell past the cut\. The last 64 are kept here in order so save_recent_image still counts them; the 37 before them are left out, and it doesn't count them:\]\n/);
+      assert.deepStrictEqual(
+        parseImagePlaceholders(stored.content).map((s) => (s.kind === 'inline' ? s.ref : /frame-(\d+)\.png/.exec(s.text)?.[1])),
+        [...Array.from({ length: 63 }, (_, n) => String(37 + n)), refOf(h, 1)],
+        'the newest 63 frames, then the snapshot',
+      );
+      // Index 0 is the snapshot. Index 64 is past every kept slot, so it is
+      // the older GIF.
+      const newest = saved(await waitForToolResult(h.framework, 'call_save_newest'));
+      assert.strictEqual(newest[0]!.toolCallId, 'call_frames');
+      assert.strictEqual(newest[0]!.sha256, sha(PNG));
+      const past = saved(await waitForToolResult(h.framework, 'call_save_past'));
+      assert.strictEqual(past[0]!.source, 'attachment');
+      assert.strictEqual(past[0]!.sha256, sha(GIF));
+    } finally {
+      await h.framework.stop();
+      rmSync(h.tempDir, { recursive: true, force: true });
+    }
+  });
+
+  it('the live copy cuts a text block beside an image as the stored copy cuts, and the index counts what it showed', async () => {
+    const h = await startTurn({
+      prefix: 'sri-live-cut-',
+      toolResultInlineMaxChars: 1000,
+      responses: [
+        [{ type: 'tool_use', id: 'call_quoting', name: 'world--snap_quoting', input: {} } as ContentBlock],
+        [saveCall('call_save_snap', { path: 'files/snap.png', index: 0 })],
+        [saveCall('call_save_gif', { path: 'files/avatar.gif', index: 1 })],
+        done,
+      ],
+    });
+    try {
+      const snap = saved(await waitForToolResult(h.framework, 'call_save_snap'));
+      // The caption's cap falls inside its quoted reference line, after the
+      // placeholder the line quotes. The live copy's cut moves back to the
+      // line's start, so the resident saw the picture and the caption up to
+      // that line, and no part of it.
+      const [round] = h.membrane.lastStream!.receivedToolResults as Array<Array<{ toolUseId: string; content: unknown }>>;
+      const live = round!.find((r) => r.toolUseId === 'call_quoting')!.content as Array<{ type: string; text?: string }>;
+      assert.deepStrictEqual(live.map((b) => b.type), ['image', 'text']);
+      const caption = live[1]!.text!;
+      assert.ok(
+        caption.startsWith(`${'y'.repeat(950)}\n\n\n[truncated — original was ${QUOTING_CAPTION.length} chars`),
+        caption.slice(940, 1010),
+      );
+      assert.doesNotMatch(caption, /\[ref_|\[image:/);
+      // The stored copy counts what the live copy showed: index 0 is the
+      // picture, and index 1 the older GIF.
+      const stored = await waitForToolResult(h.framework, 'call_quoting');
+      assert.deepStrictEqual(parseImagePlaceholders(stored.content).map((s) => (s.kind === 'inline' ? s.ref : s.text)), [refOf(h, 1)]);
+      assert.strictEqual(snap[0]!.toolCallId, 'call_quoting');
+      assert.strictEqual(snap[0]!.sha256, sha(PNG));
+      const gif = saved(await waitForToolResult(h.framework, 'call_save_gif'));
+      assert.strictEqual(gif[0]!.source, 'attachment');
+      assert.strictEqual(gif[0]!.sha256, sha(GIF));
+    } finally {
+      await h.framework.stop();
+      rmSync(h.tempDir, { recursive: true, force: true });
+    }
+  });
+
+  it('at an inline cap shorter than a reference stub, the stub the live copy showed whole is kept past the cut', async () => {
+    const h = await startTurn({
+      prefix: 'sri-small-cap-',
+      inlineCap: 100,
+      responses: [
+        [{ type: 'tool_use', id: 'call_named', name: 'world--snap_named_ref', input: {} } as ContentBlock],
+        [saveCall('call_save_png', { path: 'files/one.png', index: 1 })],
+        [saveCall('call_save_gif', { path: 'files/two.gif', index: 2 })],
+        done,
+      ],
+    });
+    try {
+      // The live copy cuts only text blocks at the cap, and showed the
+      // reference's stub whole beside the picture; the stored text is cut
+      // inside that stub, so the stub is kept after the notice.
+      const stored = await waitForToolResult(h.framework, 'call_named');
+      const slots = parseImagePlaceholders(stored.content);
+      assert.deepStrictEqual(slots.map((s) => s.kind), ['inline', 'reference'], stored.content);
+      assert.ok(slots[1]!.text.length > 100, 'the stub is longer than the cap');
+      assert.match(stored.content, /\n\[1 image slot\(s\) fell past the cut; kept here in order so save_recent_image still counts them:\]\n\[ref_/);
+      // Index 0 is the reference, index 1 the picture, index 2 the older GIF.
+      // (Receipts are cut at this cap too, so the files say what was saved.)
+      await waitForToolResult(h.framework, 'call_save_png');
+      assert.ok((await fileBytes(h, 'files/one.png'))?.equals(PNG), 'index 1 is the picture');
+      await waitForToolResult(h.framework, 'call_save_gif');
+      assert.ok((await fileBytes(h, 'files/two.gif'))?.equals(GIF), 'index 2 is the older GIF');
+    } finally {
+      await h.framework.stop();
+      rmSync(h.tempDir, { recursive: true, force: true });
+    }
+  });
+
+  it("past its cut, a result carrying an image keeps a later block's slot its live copy showed, and none it cut away", async () => {
+    const h = await startTurn({
+      prefix: 'sri-captioned-cut-',
+      toolResultInlineMaxChars: 1000,
+      responses: [
+        [{ type: 'tool_use', id: 'call_captioned', name: 'world--snap_captioned', input: {} } as ContentBlock],
+        [saveCall('call_save_snap', { path: 'files/snap.png', index: 1 })],
+        [saveCall('call_save_gif', { path: 'files/avatar.gif', index: 2 })],
+        done,
+      ],
+    });
+    try {
+      const stored = await waitForToolResult(h.framework, 'call_captioned');
+      // The stored text is cut in the scan. The live copy cut each text block
+      // at the cap on its own: it showed the snapshot and the caption's first
+      // attachment line, and cut the caption before its second.
+      assert.deepStrictEqual(
+        parseImagePlaceholders(stored.content).map((s) => (s.kind === 'inline' ? s.ref : s.text)),
+        [refOf(h, 1), attachmentLine(0)],
+      );
+      assert.doesNotMatch(stored.content, /item2\.png/);
+      // Index 0 is the quoted attachment line, index 1 the snapshot and
+      // index 2 the older GIF.
+      const snap = saved(await waitForToolResult(h.framework, 'call_save_snap'));
+      assert.strictEqual(snap[0]!.toolCallId, 'call_captioned');
+      assert.strictEqual(snap[0]!.sha256, sha(PNG));
+      const gif = saved(await waitForToolResult(h.framework, 'call_save_gif'));
+      assert.strictEqual(gif[0]!.source, 'attachment');
+      assert.strictEqual(gif[0]!.sha256, sha(GIF));
+    } finally {
+      await h.framework.stop();
+      rmSync(h.tempDir, { recursive: true, force: true });
+    }
+  });
+
+  it('a result whose array the converters give up on keeps nothing past its cut: its live copy is its stored text', async () => {
+    const h = await startTurn({
+      prefix: 'sri-mystery-cut-',
+      toolResultInlineMaxChars: 1000,
+      responses: [
+        [
+          { type: 'tool_use', id: 'call_mystery', name: 'world--snap_mystery', input: {} } as ContentBlock,
+          saveCall('call_save_batch', { path: 'files/batch.gif', index: 0 }),
+        ],
+        [saveCall('call_save_after', { path: 'files/after.gif', index: 0 })],
+        done,
+      ],
+    });
+    try {
+      const stored = await waitForToolResult(h.framework, 'call_mystery');
+      // Stored, and shown, as its JSON cut at the cap: the placeholder its
+      // text quotes past the cap was never shown, before the commit or after.
+      assert.match(stored.content, /^\[\{"type":"image","data":"/);
+      assert.doesNotMatch(stored.content, /fell past the cut/);
+      assert.deepStrictEqual(parseImagePlaceholders(stored.content), []);
+      for (const id of ['call_save_batch', 'call_save_after']) {
+        const receipt = saved(await waitForToolResult(h.framework, id));
+        assert.strictEqual(receipt[0]!.source, 'attachment', id);
+        assert.strictEqual(receipt[0]!.sha256, sha(GIF), id);
+      }
+    } finally {
+      await h.framework.stop();
+      rmSync(h.tempDir, { recursive: true, force: true });
+    }
+  });
+
+  it("a text result's cut never ends in part of a slot, before its commit or after (#403)", async () => {
+    const call = (id: string, name: string): ContentBlock =>
+      ({ type: 'tool_use', id, name: `world--${name}`, input: {} }) as ContentBlock;
+    const names = Object.keys(SPLIT_TEXTS) as Array<keyof typeof SPLIT_TEXTS>;
+    const h = await startTurn({
+      prefix: 'sri-split-cut-',
+      toolResultInlineMaxChars: 1000,
+      responses: [
+        ...names.map((name) => [call(`call_${name}`, name), saveCall(`call_save_${name}`, { path: `files/${name}.gif`, index: 0 })]),
+        [saveCall('call_save_after', { path: 'files/after.gif', index: 0 })],
+        done,
+      ],
+    });
+    try {
+      // A cut inside the attachment line, or 499 characters into the quoted
+      // line, moves back to the line's start. 1000 characters into the quoted
+      // line, the part before the cut can't be a slot, and the cut stays.
+      const heads: Record<keyof typeof SPLIT_TEXTS, number> = { split_stub: 901, split_quoted: 501, giant_line: 1000 };
+      for (const name of names) {
+        const stored = await waitForToolResult(h.framework, `call_${name}`);
+        const text = SPLIT_TEXTS[name];
+        assert.strictEqual(stored.content.slice(0, heads[name]), text.slice(0, heads[name]), name);
+        assert.ok(
+          stored.content.slice(heads[name]).startsWith(`\n\n[truncated — showing ${heads[name]} of ${text.length} chars; `),
+          `${name}: ${stored.content.slice(heads[name], heads[name] + 80)}`,
+        );
+        assert.deepStrictEqual(parseImagePlaceholders(stored.content), [], name);
+      }
+      // So every save, in the batch with its result and after every commit,
+      // reaches past them to the GIF.
+      for (const id of [...names.map((name) => `call_save_${name}`), 'call_save_after']) {
+        const receipt = saved(await waitForToolResult(h.framework, id));
+        assert.strictEqual(receipt[0]!.source, 'attachment', id);
+        assert.strictEqual(receipt[0]!.sha256, sha(GIF), id);
+      }
+    } finally {
+      await h.framework.stop();
+      rmSync(h.tempDir, { recursive: true, force: true });
+    }
+  });
+
   it('a save dispatched in the SAME batch as the snapshot waits for it and saves it', async () => {
     // One tool_use round: [snap, save]. Module calls are only enqueued while
     // the save runs at once — without the barrier the inventory is empty at
@@ -777,6 +1190,79 @@ describe('save_recent_image provenance (issue #104)', () => {
     }
   });
 
+  it('a save in the same batch counts a cut result as its stored copy will, image or text', async () => {
+    const listingCall = (id: string, name: string): ContentBlock =>
+      ({ type: 'tool_use', id, name: `world--${name}`, input: {} }) as ContentBlock;
+    const h = await startTurn({
+      prefix: 'sri-same-batch-cut-',
+      toolResultInlineMaxChars: 1000,
+      responses: [
+        // A text result: none of its image-typed lines past the cut counts.
+        [listingCall('call_listing', 'listing'), saveCall('call_save_text', { path: 'files/text.gif', index: 0 })],
+        // A result carrying an image: of the slots past its cut, only the
+        // snapshot's counts, the one its live copy showed.
+        [listingCall('call_snap_listing', 'snap_listing'), saveCall('call_save_image', { path: 'files/image.gif', index: 1 })],
+        // One whose live copy showed 101 slots past its cut: the newest 64
+        // count, then the snapshot above.
+        [
+          listingCall('call_frames', 'snap_frames'),
+          saveCall('call_save_frames', { path: 'files/frames.gif', index: MAX_KEPT_IMAGE_SLOTS + 1 }),
+        ],
+        [saveCall('call_save_after', { path: 'files/after.gif', index: MAX_KEPT_IMAGE_SLOTS + 1 })],
+        done,
+      ],
+    });
+    try {
+      for (const id of ['call_save_text', 'call_save_image', 'call_save_frames', 'call_save_after']) {
+        const receipt = saved(await waitForToolResult(h.framework, id));
+        assert.strictEqual(receipt[0]!.source, 'attachment', `${id} reaches past the counted slots to the GIF`);
+        assert.strictEqual(receipt[0]!.sha256, sha(GIF));
+      }
+    } finally {
+      await h.framework.stop();
+      rmSync(h.tempDir, { recursive: true, force: true });
+    }
+  });
+
+  it("a same-batch error result, or one with no data, counts its error text's slots, as its stored copy will", async () => {
+    const failing = (id: string, name: string): ContentBlock =>
+      ({ type: 'tool_use', id, name: `world--${name}`, input: {} }) as ContentBlock;
+    const h = await startTurn({
+      prefix: 'sri-same-batch-error-text-',
+      responses: [
+        [failing('call_quiet', 'quiet_failure'), saveCall('call_save_quiet', { path: 'files/quiet.png', index: 0 })],
+        [failing('call_loud', 'loud_failure'), saveCall('call_save_loud', { path: 'files/loud.png', index: 0 })],
+        [
+          saveCall('call_save_loud_after', { path: 'files/loud-after.png', index: 0 }),
+          saveCall('call_save_quiet_after', { path: 'files/quiet-after.png', index: 1 }),
+        ],
+        done,
+      ],
+    });
+    try {
+      // Each stored text is its error text, which quotes a placeholder
+      // written before retention existed: before the commit and after it,
+      // each is an unsaveable slot, never the older GIF.
+      for (const [id, index, call, tool] of [
+        ['call_save_quiet', 0, 'call_quiet', 'quiet_failure'],
+        ['call_save_loud', 0, 'call_loud', 'loud_failure'],
+        ['call_save_loud_after', 0, 'call_loud', 'loud_failure'],
+        ['call_save_quiet_after', 1, 'call_quiet', 'quiet_failure'],
+      ] as const) {
+        const result = await waitForToolResult(h.framework, id);
+        assert.strictEqual(result.isError, true, `${id}: ${result.content}`);
+        assert.ok(
+          result.content.includes(`index ${index} is a tool-result image from world--${tool} (call ${call}) recorded without a retention ref`),
+          `${id}: ${result.content}`,
+        );
+      }
+      assert.strictEqual(await fileBytes(h, 'files/quiet.png'), null);
+    } finally {
+      await h.framework.stop();
+      rmSync(h.tempDir, { recursive: true, force: true });
+    }
+  });
+
   it('a placeholder from a previous process (other nonce) is a defined miss by index AND by ref', async () => {
     const h = await startTurn({
       prefix: 'sri-stale-',
@@ -947,42 +1433,129 @@ describe('ToolImageLedger', () => {
     }
   });
 
-  it('splitting for truncation keeps every slot at or past the cut, and never leaves a partial one in the head', () => {
+  it('the serializer says where each block of an array sits in its text, and nothing when it gives the array up', () => {
+    const data = [
+      { type: 'text', text: 'two frames' },
+      { type: 'image', data: PNG.toString('base64'), mimeType: 'image/png' },
+      { type: 'image', uri: 'https://cam.example/sri-spans.png', mimeType: 'image/png' },
+      { type: 'image', data: PNG.toString('base64'), mimeType: 'image/png', disposition: 'ref' },
+    ];
+    const reported: HistoryBlockSpan[][] = [];
+    const text = toolResultDataToHistoryString(data, undefined, { onBlocks: (spans) => { reported.push(spans); } });
+    assert.strictEqual(reported.length, 1);
+    const spans = reported[0]!;
+    assert.deepStrictEqual(spans.map((s) => s.kind), ['text', 'image', 'reference', 'withheld']);
+    const parts = spans.map((s) => text.slice(s.start, s.end));
+    assert.strictEqual(parts.join('\n'), text, 'the blocks, joined as the text joins them');
+    assert.strictEqual(parts[0], 'two frames');
+    assert.match(parts[1]!, /^\[image: image\/png, \d+B\]$/);
+    assert.match(parts[2]!, /^\[ref_[0-9a-z]+_[0-9a-z]+\] image\/png — from tool result — /);
+    assert.strictEqual(parts[3], INLINE_WITHHELD_TEXT);
+    // A block of no known shape: the array is given up for its JSON.
+    toolResultDataToHistoryString([...data, { type: 'mystery' }], undefined, { onBlocks: (s) => { reported.push(s); } });
+    assert.strictEqual(reported.length, 1);
+  });
+
+  it('a cut never splits a slot, and keeps past it only the image slots its live copy showed', () => {
     const png = '[image: image/png, ~12KB, ref img_abc123_1]';
     const stub = '[ref_1_ab3d] cam.png — image/jpeg, 1.2MB claimed — from tool result — fetch with fetch_reference';
-    const text = `head text\n${png}\nmiddle text that is long enough\n${stub}\ntail\n[image: image/gif, 4B, ref img_abc123_2]`;
+    const gif = '[image: image/gif, 4B, ref img_abc123_2]';
+    const text = `head text\n${png}\nmiddle text that is long enough\n${stub}\ntail\n${gif}`;
+    const all: ShownRanges = [[0, text.length]];
+    const notice = '\n\n[truncated — original was N chars]';
+    const slotsOf = (s: string): string[] => parseImagePlaceholders(s).map((p) => p.text);
     // Cut exactly at the start of the middle text: png stays, stub + gif move.
     const cut1 = text.indexOf('middle');
-    const a = splitPreservingImageSlots(text, cut1);
-    assert.strictEqual(a.head, text.slice(0, cut1));
-    assert.deepStrictEqual(a.tail, [stub, '[image: image/gif, 4B, ref img_abc123_2]']);
-    // Cut in the middle of the stub line: the cut moves back to the stub's start.
-    const cut2 = text.indexOf('1.2MB');
-    const b = splitPreservingImageSlots(text, cut2);
-    assert.strictEqual(b.head, text.slice(0, text.indexOf(stub)));
-    assert.deepStrictEqual(b.tail, [stub, '[image: image/gif, 4B, ref img_abc123_2]']);
-    // Cut in the middle of the png placeholder.
-    const cut3 = text.indexOf('~12KB');
-    const c = splitPreservingImageSlots(text, cut3);
-    assert.strictEqual(c.head, 'head text\n');
-    assert.strictEqual(c.tail.length, 3);
-    // Head + preserved tail parse to exactly the original slots, in order.
-    for (const cut of [cut1, cut2, cut3, 1, text.length - 3]) {
-      const { head, tail } = splitPreservingImageSlots(text, cut);
-      const rejoined = head + '\n\n[truncated — original was N chars]' + formatPreservedImageSlots(tail);
+    assert.deepStrictEqual(cutStoredToolResult(text, cut1, all), { head: text.slice(0, cut1), kept: [stub, gif], fell: 2 });
+    // Cut inside the stub line, in its id or past its type: the cut moves back
+    // to the line's start.
+    for (const inside of ['_ab3d', '1.2MB']) {
       assert.deepStrictEqual(
-        parseImagePlaceholders(rejoined).map((p) => p.text),
-        parseImagePlaceholders(text).map((p) => p.text),
-        `cut at ${cut}`,
+        cutStoredToolResult(text, text.indexOf(inside), all),
+        { head: text.slice(0, text.indexOf(stub)), kept: [stub, gif], fell: 2 },
+        inside,
       );
     }
-    // The generic history truncation uses the same rule.
-    const truncated = truncateForHistory(text, cut3);
-    assert.strictEqual(parseImagePlaceholders(truncated).length, 3);
-    assert.match(truncated, /\[truncated — original was \d+ chars\]/);
+    // Cut inside the png placeholder: the cut moves back to its start.
+    assert.deepStrictEqual(cutStoredToolResult(text, text.indexOf('~12KB'), all), { head: 'head text\n', kept: [png, stub, gif], fell: 3 });
+    // Wherever the cut falls, the head holds whole slots only, and with the
+    // kept ones they are exactly the text's, in order. A live copy that was
+    // this text has the same head, and nothing past it.
+    for (let cut = 1; cut < text.length; cut++) {
+      const cutShown = cutStoredToolResult(text, cut, all);
+      const whole = parseImagePlaceholders(text).filter((p) => p.offset + p.text.length <= cutShown.head.length);
+      assert.deepStrictEqual(slotsOf(cutShown.head + notice), whole.map((p) => p.text), `head at ${cut}`);
+      assert.deepStrictEqual(slotsOf(cutShown.head + notice + formatKeptImageSlots(cutShown)), slotsOf(text), `cut at ${cut}`);
+      assert.deepStrictEqual(cutStoredToolResult(text, cut, null), { head: cutShown.head, kept: [], fell: 0 }, `as text at ${cut}`);
+    }
+    // Only a slot lying wholly within what the live copy showed is kept: a
+    // range ending before the gif, and one ending inside the stub.
+    assert.deepStrictEqual(cutStoredToolResult(text, cut1, [[0, text.indexOf('\ntail')]]), { head: text.slice(0, cut1), kept: [stub], fell: 1 });
+    assert.deepStrictEqual(
+      cutStoredToolResult(text, cut1, [[0, text.indexOf('1.2MB')], [text.indexOf(gif), text.length]]),
+      { head: text.slice(0, cut1), kept: [gif], fell: 1 },
+    );
+    // A slot wholly between two ranges, before one inside the second: the
+    // walk passes the gap without passing the range after it.
+    assert.deepStrictEqual(
+      cutStoredToolResult(text, cut1, [[0, text.indexOf(stub)], [text.indexOf('tail'), text.length]]),
+      { head: text.slice(0, cut1), kept: [gif], fell: 1 },
+    );
+    // Ranges that touch, with a slot starting where the first ends: the
+    // second holds it.
+    assert.deepStrictEqual(
+      cutStoredToolResult(text, cut1, [[0, text.indexOf(gif)], [text.indexOf(gif), text.length]]),
+      { head: text.slice(0, cut1), kept: [stub, gif], fell: 2 },
+    );
+    // Every reader of the generic history truncation reads it as text: it
+    // cuts as the stored copy cuts, and keeps nothing past the cut.
+    assert.strictEqual(truncateForHistory(text, cut1), `${text.slice(0, cut1)}\n\n[truncated — original was ${text.length} chars]`);
+    assert.strictEqual(
+      truncateForHistory(text, text.indexOf('1.2MB')),
+      `${text.slice(0, text.indexOf(stub))}\n\n[truncated — original was ${text.length} chars]`,
+    );
+  });
+
+  it('a cut moves back off a stub-shaped line only while the part before it could read as a slot', () => {
+    const text = `intro\n${QUOTED_LINE}\nafter`;
+    const start = text.indexOf(QUOTED_LINE);
+    assert.deepStrictEqual(parseImagePlaceholders(text), [], 'the quoted line is no slot whole');
+    for (const before of [1, 20, REFERENCE_STUB_MAX_CHARS]) {
+      assert.strictEqual(cutStoredToolResult(text, start + before, null).head, 'intro\n', `${before} before the cut`);
+    }
+    // A character more, and that part is too long to parse as a slot: the cut
+    // stays where it fell.
+    const giant = cutStoredToolResult(text, start + REFERENCE_STUB_MAX_CHARS + 1, null);
+    assert.strictEqual(giant.head, text.slice(0, start + REFERENCE_STUB_MAX_CHARS + 1));
+    assert.deepStrictEqual(parseImagePlaceholders(`${giant.head}\n\n[truncated]`), []);
+    // A line begins where the parser begins one, after a carriage return too.
+    const cr = `intro\nnote\r[ref_9_ab3d] cam.png — image/png, 1KB claimed — from tool result — fetch with fetch_reference\nafter`;
+    assert.strictEqual(parseImagePlaceholders(cr).length, 1);
+    assert.strictEqual(cutStoredToolResult(cr, cr.indexOf('1KB'), null).head, cr.slice(0, cr.indexOf('[ref_9')));
+  });
+
+  it('a cut never splits a surrogate pair, and moves back from where it can fall', () => {
+    const astral = '\u{1F600}'; // two UTF-16 code units
+    // In plain text, a cap between the pair's two units cuts before the pair.
+    const plain = `${'a'.repeat(9)}${astral}after`;
+    assert.strictEqual(cutStoredToolResult(plain, 10, null).head, 'a'.repeat(9));
+    assert.strictEqual(truncateForHistory(plain, 10), `${'a'.repeat(9)}\n\n[truncated — original was ${plain.length} chars]`);
+    // A quoted stub-shaped line, too long to be a slot, whose pair sits at
+    // its REFERENCE_STUB_MAX_CHARS-th unit: a cap between the pair's units
+    // cuts before it, with REFERENCE_STUB_MAX_CHARS of the line before the
+    // cut, a part that could read as a slot, so the cut moves back to the
+    // line's start.
+    const prefix = '[ref_9_ab3d] quoted — image/png ';
+    const line = `${prefix}${'z'.repeat(REFERENCE_STUB_MAX_CHARS - prefix.length)}${astral}${'z'.repeat(100)}`;
+    const text = `intro\n${line}\nafter`;
+    const start = text.indexOf(line);
+    assert.deepStrictEqual(parseImagePlaceholders(text), [], 'the quoted line is no slot whole');
+    const cut = cutStoredToolResult(text, start + REFERENCE_STUB_MAX_CHARS + 1, null);
+    assert.strictEqual(cut.head, 'intro\n');
+    assert.deepStrictEqual(parseImagePlaceholders(`${cut.head}\n\n[truncated]`), []);
   });
 
-  it('parses image-typed reference stubs as slots, in text order with inline placeholders', () => {
+  it('parses image-typed reference stubs as slots, in text order with inline placeholders, and no other stub', () => {
     const text = [
       'frame one',
       '[image: image/png, ~12KB, ref img_abc123_3]',
@@ -995,10 +1568,65 @@ describe('ToolImageLedger', () => {
       [
         ['inline', 'img_abc123_3', 'image/png'],
         ['reference', 'ref_1_ab3d', 'image/jpeg'],
-        ['reference', 'ref_2_zz9q', null],
       ],
     );
   });
+
+  it('a slot is no longer than its writer writes one: a character more and it is no slot', () => {
+    const longestId = (stub: string): string =>
+      stub.replace(/^\[ref_[0-9a-z]+_[0-9a-z]+\]/, `[ref_${Number.MAX_SAFE_INTEGER.toString(36)}_zzzz]`);
+    const testimony = (name: string, extra: Partial<ReferenceTestimony> = {}): ReferenceTestimony => ({
+      uri: `https://example.invalid/sri-longest-${name}.png`,
+      name: 'n'.repeat(400),
+      mimeType: `image/${'p'.repeat(240)}`,
+      sizeBytes: Number.MAX_SAFE_INTEGER,
+      rejectedFields: [],
+      truncatedFields: [],
+      ...extra,
+    });
+    // The longest stub buildReferenceStub writes: every label at its bound,
+    // the largest size, a saved copy's path, and the longest id.
+    const saved = testimony('saved');
+    referenceRegistry.register(saved, 'srv').fetchedPath = `files/${'q'.repeat(600)}`;
+    const longest = longestId(buildReferenceStub(saved, 'o'.repeat(400), 'srv'));
+    assert.strictEqual(longest.length, REFERENCE_STUB_MAX_CHARS);
+    assert.strictEqual(parseImagePlaceholders(longest).length, 1);
+    assert.strictEqual(parseImagePlaceholders(`${longest}q`).length, 0);
+    // Its other endings are shorter: an expired reference's reasons, and an
+    // unsaved one, whether its record holds a server or not.
+    const endings: Array<[string, Partial<ReferenceTestimony>, string | undefined]> = [
+      ['passed', { expiresAt: '2001-01-01T00:00:00Z' }, 'srv'],
+      ['unparseable', { expiresAt: 'whenever' }, 'srv'],
+      ['rejected', { rejectedFields: ['expiresAt'] }, 'srv'],
+      ['bound', {}, 'srv'],
+      ['unbound', {}, undefined],
+    ];
+    for (const [name, extra, serverId] of endings) {
+      const stub = longestId(buildReferenceStub(testimony(name, extra), 'o'.repeat(400), serverId));
+      assert.ok(stub.length < REFERENCE_STUB_MAX_CHARS, `${name}: ${stub.length}`);
+      assert.strictEqual(parseImagePlaceholders(stub).length, 1, name);
+    }
+    // A placeholder: RFC 6838 bounds a type or subtype name at 127
+    // characters, so normalizeMediaType keeps the longest essence and refuses
+    // one character more, and the size and ref take a safe integer's digits.
+    const type = `${'a'.repeat(127)}/${'b'.repeat(127)}`;
+    assert.strictEqual(normalizeMediaType(type), type);
+    assert.strictEqual(normalizeMediaType(`a${type}`), FALLBACK_MEDIA_TYPE);
+    assert.strictEqual(normalizeMediaType(`${type}b`), FALLBACK_MEDIA_TYPE);
+    const digits = '9'.repeat(16);
+    const placeholder = (t: string, size: string, ref: string): string => `[image: ${t}, ${size}, ref ${ref}]`;
+    assert.strictEqual(placeholder(type, `~${digits}MB`, `img_${'z'.repeat(16)}_${digits}`), formatToolImagePlaceholder(type, `~${digits}MB`, `img_${'z'.repeat(16)}_${digits}`));
+    assert.strictEqual(parseImagePlaceholders(placeholder(type, `~${digits}MB`, `img_${'z'.repeat(16)}_${digits}`)).length, 1);
+    for (const longer of [
+      placeholder(`a${type}`, `~${digits}MB`, 'img_abc123_1'),
+      placeholder(`${type}b`, `~${digits}MB`, 'img_abc123_1'),
+      placeholder('image/png', `~${digits}9MB`, 'img_abc123_1'),
+      placeholder('image/png', '~1KB', `img_${'z'.repeat(17)}_1`),
+      placeholder('image/png', '~1KB', `img_abc123_${digits}9`),
+    ]) {
+      assert.strictEqual(parseImagePlaceholders(longer).length, 0, longer.slice(0, 60));
+    }
+  });
 });
 
 it('a write that throws before its tree entry names the images already saved', async () => {