@@ -128,6 +128,28 @@ vi.mock('redis', () => ({ createClient: () => makeClient() }))
 import { FileDocStore, REDIS_AGENT_ORIGIN, REDIS_ORIGIN } from '@/handlers/file-doc-store'
 
 const REDIS_URL = 'redis://fake'
+
+interface StoreRoomInternals {
+  lastId: string
+  pendingDeltas: Array<{ id: string; bytes: number }>
+  realEdited: boolean
+  publishes: number
+  doc: Y.Doc
+  seededObserved: boolean
+}
+
+interface FileDocStoreInternals {
+  rooms: Map<string, StoreRoomInternals>
+  appendUpdate(name: string, update: Uint8Array, agent?: boolean): Promise<void>
+  write: { xTrim: (...args: unknown[]) => Promise<unknown> }
+  maybeCompact(name: string, force?: boolean): Promise<void>
+}
+
+/** Reaches the private state these tests assert on, without `any`. */
+function internals(store: object): FileDocStoreInternals {
+  return store as unknown as FileDocStoreInternals
+}
+
 const COMPACT_THRESHOLD_ENTRIES = 400
 const NAME = 'workspace-file-doc:file-1'
 
@@ -339,14 +361,15 @@ describe('FileDocStore', () => {
     const a = await newStore()
     // This task has integrated only up to entry 400 (all no-ops) — its local doc is empty and lags the
     // two peer entries. Inject that lagging room directly (a real edit was integrated → realEdited).
-    ;(a as any).rooms.set(NAME, {
+    internals(a).rooms.set(NAME, {
       doc: new Y.Doc(),
       lastId: '400-0',
       publishes: 0,
+      pendingDeltas: [],
       seededObserved: true,
       realEdited: true,
     })
-    await (a as any).maybeCompact(NAME)
+    await internals(a).maybeCompact(NAME)
 
     // A fresh catch-up must still reconstruct the peer content — compaction must not have trimmed 401/402.
     const doc = new Y.Doc()
@@ -392,11 +415,11 @@ describe('FileDocStore', () => {
     const a = await newStore()
     const doc = new Y.Doc()
     await a.attachRoom(NAME, doc)
-    const room = (a as any).rooms.get(NAME)
+    const room = internals(a).rooms.get(NAME)!
     expect(room.realEdited).toBe(false)
     // Kick off a real (non-agent) append but do NOT await it: realEdited must already be true before the
     // xAdd/expire awaits resolve, so any compaction racing on the awaits sees the real edit.
-    const pending = (a as any).appendUpdate(NAME, updateFor('real user edit'))
+    const pending = internals(a).appendUpdate(NAME, updateFor('real user edit'))
     expect(room.realEdited).toBe(true)
     await pending
     doc.destroy()
@@ -474,16 +497,16 @@ describe('FileDocStore', () => {
     const a = await newStore()
     const doc = new Y.Doc()
     await a.attachRoom(NAME, doc)
-    const room = (a as any).rooms.get(NAME)
+    const room = internals(a).rooms.get(NAME)!
     room.pendingDeltas = [{ id: '1-0', bytes: 9 * 1024 * 1024 }]
     room.realEdited = true
 
-    const write = (a as any).write
+    const write = internals(a).write
     const original = write.xTrim.bind(write)
     write.xTrim = async () => {
       throw new Error('redis blip')
     }
-    await (a as any).maybeCompact(NAME, true)
+    await internals(a).maybeCompact(NAME, true)
     write.xTrim = original
 
     // A failed fold must not disarm the trigger — otherwise the stream stays oversized until
@@ -496,19 +519,24 @@ describe('FileDocStore', () => {
     const a = await newStore()
     const doc = new Y.Doc()
     await a.attachRoom(NAME, doc)
-    const room = (a as any).rooms.get(NAME)
+    const room = internals(a).rooms.get(NAME)!
     room.realEdited = true
-    // The tailer has integrated up to 5-0, so MINID retains 9-0. Its bytes are still in Redis,
-    // and dropping them would disarm the byte trigger while the stream kept growing.
+    // The tailer has integrated up to 5-0, so `MINID 5-0` retains both 5-0 (the boundary is
+    // INCLUSIVE) and 9-0. Their bytes are still in Redis, and dropping them would disarm the
+    // byte trigger while the stream kept growing.
     room.lastId = '5-0'
     room.pendingDeltas = [
       { id: '3-0', bytes: 4 * 1024 * 1024 },
+      { id: '5-0', bytes: 6 * 1024 * 1024 },
       { id: '9-0', bytes: 7 * 1024 * 1024 },
     ]
 
-    await (a as any).maybeCompact(NAME, true)
+    await internals(a).maybeCompact(NAME, true)
 
-    expect(room.pendingDeltas).toEqual([{ id: '9-0', bytes: 7 * 1024 * 1024 }])
+    expect(room.pendingDeltas).toEqual([
+      { id: '5-0', bytes: 6 * 1024 * 1024 },
+      { id: '9-0', bytes: 7 * 1024 * 1024 },
+    ])
     doc.destroy()
   })
 
@@ -525,14 +553,15 @@ describe('FileDocStore', () => {
     state.backing!.seq = 400
 
     const a = await newStore()
-    ;(a as any).rooms.set(NAME, {
+    internals(a).rooms.set(NAME, {
       doc: agentDoc,
       lastId: '400-0',
       publishes: 0,
+      pendingDeltas: [],
       seededObserved: true,
       realEdited: false,
     })
-    await (a as any).maybeCompact(NAME)
+    await internals(a).maybeCompact(NAME)
 
     // The snapshot must carry the AGENT marker, NOT the snapshot marker, so a peer catch-up applies it as
     // REDIS_AGENT_ORIGIN and never marks the doc edited — the no-persist guarantee survives compaction.
@@ -691,21 +720,23 @@ describe('FileDocStore', () => {
     const b = await newStore()
     const docA = new Y.Doc()
     Y.applyUpdate(docA, peerUpdates[0]) // A integrated up to 401
-    ;(a as any).rooms.set(NAME, {
+    internals(a).rooms.set(NAME, {
       doc: docA,
       lastId: '401-0',
       publishes: 0,
+      pendingDeltas: [],
       seededObserved: true,
       realEdited: true,
     })
-    ;(b as any).rooms.set(NAME, {
+    internals(b).rooms.set(NAME, {
       doc: new Y.Doc(),
       lastId: '400-0',
       publishes: 0,
+      pendingDeltas: [],
       seededObserved: true,
       realEdited: true,
     })
-    await Promise.all([(a as any).maybeCompact(NAME), (b as any).maybeCompact(NAME)])
+    await Promise.all([internals(a).maybeCompact(NAME), internals(b).maybeCompact(NAME)])
 
     const doc = new Y.Doc()
     Y.applyUpdate(doc, (await a.getStreamState(NAME))!)
 
@@ -189,15 +189,17 @@ const streamKey = (name: string) => `${STREAM_PREFIX}${name}`
 /**
  * Unfolded delta bytes a compaction could actually reclaim right now.
  *
- * Only entries at or before `room.lastId` count: a fold trims to that boundary, so bytes past it
- * would survive the trim and re-arm the trigger immediately, forcing a full snapshot append per
- * publish that reclaims nothing. They stay in `pendingDeltas` and start counting once the tailer
- * has integrated them.
+ * Only entries strictly before `room.lastId` count. A fold trims with `MINID upTo`, which is
+ * inclusive, so everything from `upTo` onward survives it; counting those would re-arm the trigger
+ * the moment a fold finished and force a full snapshot append per publish that reclaims nothing.
+ * They stay in `pendingDeltas` and start counting once the tailer has moved past them.
  */
 function foldableDeltaBytes(room: StoreRoom): number {
   let bytes = 0
   for (const delta of room.pendingDeltas) {
-    if (!isAfterStreamId(delta.id, room.lastId)) bytes += delta.bytes
+    // Strictly before the boundary: MINID is inclusive, so the entry AT `lastId` survives the
+    // trim and folding cannot reclaim it.
+    if (isAfterStreamId(room.lastId, delta.id)) bytes += delta.bytes
   }
   return bytes
 }
@@ -835,7 +837,9 @@ export class FileDocStore {
         // MINID and its bytes are still in Redis, so it stays counted; dropping it would disarm the
         // trigger while the stream kept growing. Done after the trim, so a failed fold changes
         // nothing and leaves the trigger armed.
-        room.pendingDeltas = room.pendingDeltas.filter((delta) => isAfterStreamId(delta.id, upTo))
+        // `MINID upTo` is inclusive — it keeps the entry whose id EQUALS `upTo`, so that entry's
+        // bytes are still in Redis and must stay counted. Keeps exactly what survived the trim.
+        room.pendingDeltas = room.pendingDeltas.filter((delta) => !isAfterStreamId(upTo, delta.id))
       } finally {
         await this.releaseLock(key, token)
       }
 
@@ -66,16 +66,29 @@ const createRedisStub = () => {
     }),
     get: vi.fn().mockImplementation((key: string) => Promise.resolve(values.get(key) ?? null)),
     /**
-     * Stands in for `APPEND_EVENTS_SCRIPT`. It reproduces the script's observable
+     * Stands in for both Lua scripts, dispatching on the leading `DEL` that only
+     * `CLEAR_BUFFER_SCRIPT` has. It reproduces their observable
      * effects — dedupe, zadd, rank-trim, seq — so the read-path tests still exercise
      * real data, and exposes `budgetRefusal` so the refusal branch can be driven
      * without reimplementing the budget arithmetic here.
      */
     budgetRefusal: null as null | [number, string, number],
     eval: vi.fn().mockImplementation((...args: unknown[]) => {
+      const script = String(args[0])
       const numKeys = Number(args[1])
       const keys = args.slice(2, 2 + numKeys) as string[]
       const argv = args.slice(2 + numKeys) as Array<string | number>
+
+      // CLEAR_BUFFER_SCRIPT is the only one that opens with a DEL.
+      if (script.trimStart().startsWith("redis.call('DEL'")) {
+        for (const key of keys) {
+          values.delete(key)
+          sortedSets.delete(key)
+          counters.delete(key)
+        }
+        return Promise.resolve(1)
+      }
+
       if (api.budgetRefusal) return Promise.resolve(api.budgetRefusal)
 
       const [eventsKey, seqKey] = keys
@@ -404,18 +417,19 @@ describe('mothership-stream-outbox', () => {
     // retry that reuses the same streamId against bytes that no longer exist anywhere.
     await clearBuffer('stream-1', 'clear_outbox', { streamId: 'stream-1', userId: 'user-1' })
 
-    expect(mockRedis.del).toHaveBeenCalled()
+    // One script, so a concurrent append cannot land between the delete and the release and
+    // keep its events stored with its reservation already erased.
     const evalCall = mockRedis.eval.mock.calls.at(-1)
-    expect(evalCall?.[1]).toBe(2)
-    expect(evalCall?.[2]).toBe('execution:redis-budget:copilot_stream:stream-1')
-    expect(evalCall?.[3]).toBe('execution:redis-budget:user:user-1')
+    expect(evalCall?.[1]).toBe(5)
+    expect(evalCall?.[5]).toBe('execution:redis-budget:copilot_stream:stream-1')
+    expect(evalCall?.[6]).toBe('execution:redis-budget:user:user-1')
   })
 
   it('releases only the owner counter when no user is in scope', async () => {
     await clearBuffer('stream-1')
 
     const evalCall = mockRedis.eval.mock.calls.at(-1)
-    expect(evalCall?.[1]).toBe(1)
-    expect(evalCall?.[2]).toBe('execution:redis-budget:copilot_stream:stream-1')
+    expect(evalCall?.[1]).toBe(4)
+    expect(evalCall?.[5]).toBe('execution:redis-budget:copilot_stream:stream-1')
   })
 })
@@ -8,9 +8,9 @@ import {
   getRedisBudgetLimits,
   logRedisBudgetRefusal,
   parseRedisBudgetRefusal,
-  REDIS_BUDGET_RELEASE_SCRIPT,
   type RedisBudgetRefusal,
   renderRedisBudgetLua,
+  renderRedisBudgetReleaseLua,
 } from '@/lib/core/redis/byte-budget.server'
 import {
   type PersistedStreamEventEnvelope,
@@ -103,6 +103,13 @@ export async function allocateCursor(streamId: string): Promise<{
   return { seq, cursor: String(seq) }
 }
 
+/** Deletes a stream's buffer and releases its reservation together. KEYS: [events, seq, abort, budget...]. */
+const CLEAR_BUFFER_SCRIPT = `
+redis.call('DEL', KEYS[1], KEYS[2], KEYS[3])
+${renderRedisBudgetReleaseLua(3)}
+return 1
+`
+
 export async function resetBuffer(streamId: string, scope?: StreamBudgetScope): Promise<void> {
   await clearBuffer(streamId, 'reset_outbox', scope)
 }
@@ -112,19 +119,27 @@ export async function clearBuffer(
   operation = 'clear_outbox',
   scope?: StreamBudgetScope
 ): Promise<void> {
+  /*
+    Delete and release in ONE script. The counter outlives the data it accounts for
+    unless it is released here — these keys are deleted rather than expired, so a retry
+    reusing the same streamId would be refused against bytes that no longer exist. Doing
+    it in a second round trip would be its own hole: a concurrent append landing between
+    the two would keep its events stored with its reservation already erased.
+  */
+  const budgetKeys = getRedisBudgetKeys({
+    kind: 'copilot_stream',
+    id: streamId,
+    ...(scope?.userId ? { userId: scope.userId } : {}),
+  })
   await withRedisRetry({ operation, streamId }, async (redis) => {
-    await redis.del(getEventsKey(streamId), getSeqKey(streamId), getAbortKey(streamId))
-    /*
-      The counter outlives the data it accounts for unless it is released here: the keys
-      above are deleted rather than expired, so without this a retry reusing the same
-      streamId would be refused against bytes that no longer exist anywhere.
-    */
-    const budgetKeys = getRedisBudgetKeys({
-      kind: 'copilot_stream',
-      id: streamId,
-      ...(scope?.userId ? { userId: scope.userId } : {}),
-    })
-    await redis.eval(REDIS_BUDGET_RELEASE_SCRIPT, budgetKeys.length, ...budgetKeys)
+    await redis.eval(
+      CLEAR_BUFFER_SCRIPT,
+      3 + budgetKeys.length,
+      getEventsKey(streamId),
+      getSeqKey(streamId),
+      getAbortKey(streamId),
+      ...budgetKeys
+    )
   })
 }
 
 
@@ -202,25 +202,32 @@ end
 }
 
 /**
- * Releases an owner's whole reservation when its data is deleted rather than expired.
+ * Lua that releases an owner's whole reservation, for data that is deleted rather than
+ * left to expire.
  *
- * The owner counter is dropped and the user counter credited by exactly what the owner
- * held, in one script — crediting the user from a separately read value would let a
- * concurrent write land in between and be released twice.
+ * Rendered into the caller's own script, the same way {@link renderRedisBudgetLua} is, so
+ * the release commits together with the delete it accounts for. Releasing in a second
+ * round trip would let a concurrent write land in between and keep its bytes stored with
+ * its reservation already erased.
  *
- * KEYS: [ownerKey] or [ownerKey, userKey], as {@link getRedisBudgetKeys} returns them.
+ * Contract: budget keys are the **last** one or two entries of `KEYS`, in the order
+ * {@link getRedisBudgetKeys} returns them, and `baseKeyCount` is how many precede them.
  */
-export const REDIS_BUDGET_RELEASE_SCRIPT = `
-local owner_bytes = tonumber(redis.call('GET', KEYS[1]) or '0')
-redis.call('DEL', KEYS[1])
-if #KEYS >= 2 and owner_bytes > 0 then
-  local user_next = redis.call('DECRBY', KEYS[2], owner_bytes)
+export function renderRedisBudgetReleaseLua(baseKeyCount: number): string {
+  const ownerKey = `KEYS[${baseKeyCount + 1}]`
+  const userKey = `KEYS[${baseKeyCount + 2}]`
+
+  return `
+local owner_bytes = tonumber(redis.call('GET', ${ownerKey}) or '0')
+redis.call('DEL', ${ownerKey})
+if #KEYS >= ${baseKeyCount + 2} and owner_bytes > 0 then
+  local user_next = redis.call('DECRBY', ${userKey}, owner_bytes)
   if user_next <= 0 then
-    redis.call('DEL', KEYS[2])
+    redis.call('DEL', ${userKey})
   end
 end
-return owner_bytes
 `
+}
 
 /** Parses the `{0, resource, current}` refusal a guarded script returns. */
 export function parseRedisBudgetRefusal(