A deterministic context packer
Allocate system, tools, evidence, history, and scratch against 8K, 32K, and 128K caps. Implement a compaction order that never evicts the schema. Isolate one untrusted chunk. Cache a stable prefix (even if you only simulate the cache with a hash of the prefix). Overflow must be visible.