Thank you, this log is exactly what I needed, and your observation about the 131072 boundary was a genuinely good catch. Here is where I got with it today.
I rebuilt your session shape on my second box: same context size, same two-bank config, a conversation that gets rewritten by history compression the way your harness does it. My driver replays your exact sequence: a truncate at 67k with a 1.5k suffix, tiny-suffix truncates at 85k and 122k, growth between each, then the crash shape, a truncate whose cut sits just under 131072 while the conversation’s committed length sits just over it, with a 7-8k suffix, on a bank that had already been truncated six times. I ran that against both v0.5.0 (your version) and v0.5.2, with speculation active and a second stream decoding during the admits. Every variant served cleanly, and a memory checker pass over the shorter shapes came back clean too.
The one thing in your log I cannot recreate quickly is time: your drafter mlock release at 09:48. That line comes from the adaptive drafter residency logic that only ever existed in v0.5.0. It unlocks the drafter weights under sustained memory pressure, which means for the rest of your session those pages were evictable, and a deep truncate replay is exactly the kind of page-cache surge that would evict and then refault them mid-serving. I removed that whole mechanism in v0.5.1 for unrelated reasons. Since you moved to v0.5.1 you changed two things at once, the version and FORK_PARTIAL=0, so the fix could be either one.
So here is my ask for the regression box you kindly offered: run stock v0.5.2 with partial forks left ON (just drop the FORK_PARTIAL setting, everything else as before) under the same Hermes workload. If it survives the timescale that used to trip v0.5.0 within hours, the residency removal was the fix and I will close this with a regression gate I have already built from your session shape (it now replays your four-truncate sequence including the 131072 straddle on every release). If it still trips, grab the same log window and I will ship you a diagnostic build with verbose truncate-path logging next.