fix(engine): provider image-count cap ("Too many images: 9 (max 8)") kills the session instead of evicting old images from context #377

What happened

During a long research session with heavy image verification (reading rendered figures back via the image-read tool across many turns), the conversation accumulated 9 images in context. The next model request failed with a provider error:

Too many images: 9 (max 8)

The session became unusable until the user manually ran a compaction. The engine's compaction recovery copy (packages/opencode/src/session/compaction.ts:484) then told the model the attachments were "too large to process" — but nothing was too large: the trigger is the provider's per-request image count cap (9 > 8), not byte size, and the images were legitimate tool outputs (render verification), not user uploads.

Repro

1. In one session, read 9+ images via the image-capable read tool across successive turns (e.g. verifying regenerated figure renders).
2. Send the next message. The provider rejects the request with the image-count error; the session cannot proceed without a manual compact.

Expected behavior

The engine should degrade gracefully: on a provider image-count error (or proactively, before the request), evict the oldest images from context (or drop images from older tool results) and retry, with a user-visible note about what was evicted. A hard session-death requiring manual compaction is the worst outcome for long agentic runs, which naturally accumulate image evidence.

Suggested fix surface

• Detect the provider image-count error class distinctly from byte-size errors; the current compaction copy conflates them.
• Automatic media-eviction pass (oldest-first, keeping the most recent 8) before the request or on the error, without losing the text of the affected tool results.
• Optional config knob for the retained-image cap to match provider limits.

Context

• Amicode research-mode director session, 2026-10-17; hit while verifying a repeatedly-regenerated CSD figure. User had to compact mid-task to recover, losing working-set context (the campaign ledger made recovery safe, but it should not be needed for this).
• Engine: opencode fork at harmoniqs/opencode (vendored under Amicode); provider: baseten/zai-org/GLM-5.3 (image cap 8).