[tall-1997]

Root causes

1. Session loss (2026-10-14 incident — 1386 rows lost from one retry tap)

deleteFromMessage / retryFromMessage / truncateBeforeEdit resolved their deleteMessagesAfter cutoff via visible-user ordinal. The two counters disagreed:/n/n- UI side: counts EVERY user-role ChatMessage, including toolResult-only carrier rows that render as nothing

• DB side: visibleUserCutoff + anchorHeadHasVisibleUserText counts only user rows whose head has a text part

On any session with tool traffic (agent loop persists a synthetic user row per tool_result), ordinal N on the UI side resolved to a DB row dozens of turns early → deleteMessagesAfter archived + deleted the entire session tail.

2. Crash (tombstone_09/12 — RenderThread/SKIA 4.68 GB native in 11 s)

MAX_TAIL_MESSAGES = 4000: the UI tail IS the initial render window. A 1441-message session loaded every row into the UI on open → SKIA exhausted Scudo mappings → abort.

Fixes

Fix	Change
Anchor by row id	New ChatDao.sortOrderForMessageId; delete/retry/edit anchor by the tapped message DB row id (sourceDbIds covers merged bubbles). visibleUserCutoff / anchorHeadHasVisibleUserText removed.
Bound render window	MAX_TAIL_MESSAGES 4000 → 500. Older history stays one tap away via loadOlderMessages turn-aligned paging; DB remains the full transcript.
Recovery	ChatRepository.restoreArchivedVersions re-inserts rows lost to the ordinal-mismatch truncation from message_versions (latest version per message, above the current tail, idempotent).

Tests

• DeleteAnchorByIdTest — pins anchor-selection: user target → own id regardless of toolResult-only rows; assistant target → preceding visible user; blank user rows skipped; merged bubbles via sourceDbIds; cut-point arithmetic per caller.