diff --git a/.env.example b/.env.example
index 491fdd6..6f19c90 100644
--- a/.env.example
+++ b/.env.example
@@ -171,10 +171,11 @@ R2_MAX_BYTES=10485760
 # window.__CONFIG__ (see app/layout.tsx).
 R2_ALLOWED_CONTENT_TYPES=image/png,image/jpeg,image/webp
 # Attachments feature toggle — gates the assistant-ui `<Composer />`
-# attachment UI. Default false; flip to "true" once every required
-# R2_* above is set. Frontend and backend must be in sync: if this
-# stays "false" the composer hides the attachment widget, but routes
-# still answer when called. Read in browser via window.__CONFIG__.
+# attachment UI AND the Settings → Account avatar upload (both backed by
+# R2). Default false; flip to "true" once every required R2_* above is
+# set. Frontend and backend must be in sync: if this stays "false" the
+# composer hides the attachment widget + the avatar upload is disabled,
+# but routes still answer when called. Read in browser via window.__CONFIG__.
 ATTACHMENTS_ENABLED=false
 
 
diff --git a/app/api/avatar/presign/route.ts b/app/api/avatar/presign/route.ts
new file mode 100644
index 0000000..63320e4
--- /dev/null
+++ b/app/api/avatar/presign/route.ts
@@ -0,0 +1,91 @@
+import { NextResponse } from "next/server";
+import { randomBytes } from "node:crypto";
+
+import { R2NotConfiguredError, buildPublicUrl, presignPut } from "@/lib/r2/client";
+import { safeFilename } from "@/lib/attachments/keys";
+import { PresignBody } from "@/lib/attachments/validators";
+import { withAuth } from "@/lib/auth/with-auth";
+
+// ponytail: avatars go to R2 under the user's own path, NOT base64 into
+// user.image. A base64 data URL there flows through the memory auth-overlay
+// (mergeMemory) into every <memory> system block uncapped — issue #28's
+// 372K-token blow-up. This route hands back a presigned PUT + the public
+// URL; the client stores only the URL. No DB row (avatars aren't chat
+// attachments — no dedup / retention sweep needed).
+
+const ID_ALPHABET = "0123456789abcdefghijklmnopqrstuvwxyz";
+const ID_LEN = 12;
+
+function generateId(): string {
+  const bytes = randomBytes(ID_LEN);
+  let out = "";
+  for (let i = 0; i < ID_LEN; i++) out += ID_ALPHABET[bytes[i] % ID_ALPHABET.length];
+  return out;
+}
+
+function maxBytes(): number {
+  const parsed = process.env.R2_MAX_BYTES ? Number(process.env.R2_MAX_BYTES) : NaN;
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : 10 * 1024 * 1024;
+}
+
+function notConfiguredResponse(): NextResponse {
+  return NextResponse.json(
+    {
+      code: "AVATAR_UPLOADS_NOT_CONFIGURED",
+      message: "Set the R2_* env vars to enable avatar uploads (see docs/ATTACHMENTS.md).",
+    },
+    { status: 503 },
+  );
+}
+
+export const POST = withAuth(async (req, { user }) => {
+  let body: unknown;
+  try {
+    body = await req.json();
+  } catch {
+    return NextResponse.json({ code: "BAD_REQUEST", error: "invalid JSON" }, { status: 400 });
+  }
+
+  const parsed = PresignBody.safeParse(body);
+  if (!parsed.success) {
+    return NextResponse.json({ code: "BAD_REQUEST", error: parsed.error.issues }, { status: 400 });
+  }
+
+  // ponytail: image/* only, and explicitly NOT svg — an SVG can carry
+  // inline <script>/<foreignObject>, and with Content-Disposition: inline
+  // on a public bucket a leaked URL becomes an XSS page in the bucket
+  // origin. (attachments enforces R2_ALLOWED_CONTENT_TYPES, which omits
+  // svg by default; we mirror that intent here.)
+  const contentType = parsed.data.contentType.toLowerCase();
+  if (!contentType.startsWith("image/") || contentType === "image/svg+xml") {
+    return NextResponse.json({ code: "CONTENT_TYPE_NOT_ALLOWED", contentType }, { status: 400 });
+  }
+
+  const cap = maxBytes();
+  if (parsed.data.sizeBytes > cap) {
+    return NextResponse.json(
+      { code: "FILE_TOO_LARGE", maxBytes: cap, sizeBytes: parsed.data.sizeBytes },
+      { status: 400 },
+    );
+  }
+
+  const key = `u/${user.id}/avatar/${generateId()}-${safeFilename(parsed.data.name)}`;
+
+  let uploadUrl: string;
+  try {
+    uploadUrl = await presignPut({ key, contentLength: parsed.data.sizeBytes });
+  } catch (e) {
+    if (e instanceof R2NotConfiguredError) return notConfiguredResponse();
+    throw e;
+  }
+
+  return NextResponse.json(
+    {
+      key,
+      uploadUrl,
+      publicUrl: buildPublicUrl(key),
+      uploadHeaders: { "Content-Type": contentType, "Content-Disposition": "inline" },
+    },
+    { status: 201 },
+  );
+});
diff --git a/app/api/avatar/route.ts b/app/api/avatar/route.ts
new file mode 100644
index 0000000..a32345b
--- /dev/null
+++ b/app/api/avatar/route.ts
@@ -0,0 +1,55 @@
+import { NextResponse } from "next/server";
+
+import { R2NotConfiguredError, deleteObject, getR2PublicBaseUrl } from "@/lib/r2/client";
+import { withAuth } from "@/lib/auth/with-auth";
+
+// ponytail: avatars have no DB row, so nothing sweeps the old R2 object when
+// the user deletes or replaces their avatar — it would leak forever at its
+// public URL. This route deletes the object behind an avatar URL, owner-
+// scoped: the key must live under u/<user.id>/avatar/. External avatar URLs
+// (a github/google-hosted image) aren't ours → 204 no-op. Idempotent: an
+// already-gone object is a success.
+
+function notConfiguredResponse(): NextResponse {
+  return NextResponse.json(
+    {
+      code: "AVATAR_UPLOADS_NOT_CONFIGURED",
+      message: "Set the R2_* env vars to enable avatar uploads (see docs/ATTACHMENTS.md).",
+    },
+    { status: 503 },
+  );
+}
+
+export const DELETE = withAuth(async (req, { user }) => {
+  let body: unknown;
+  try {
+    body = await req.json();
+  } catch {
+    return NextResponse.json({ code: "BAD_REQUEST", error: "invalid JSON" }, { status: 400 });
+  }
+
+  const url = (body as { url?: unknown })?.url;
+  if (typeof url !== "string" || url.length === 0) {
+    return NextResponse.json({ code: "BAD_REQUEST", error: "url required" }, { status: 400 });
+  }
+
+  let base: string;
+  try {
+    base = getR2PublicBaseUrl();
+  } catch (e) {
+    if (e instanceof R2NotConfiguredError) return notConfiguredResponse();
+    throw e;
+  }
+
+  // Not one of our R2 objects (e.g. an OAuth-hosted avatar) → nothing to do.
+  if (!url.startsWith(`${base}/`)) return new NextResponse(null, { status: 204 });
+
+  const key = url.slice(base.length + 1);
+  const prefix = `u/${user.id}/avatar/`;
+  if (!key.startsWith(prefix)) {
+    return NextResponse.json({ code: "FORBIDDEN" }, { status: 403 });
+  }
+
+  await deleteObject(key).catch(() => undefined);
+  return new NextResponse(null, { status: 204 });
+});
diff --git a/app/api/memory/profile/route.ts b/app/api/memory/profile/route.ts
index 96211b1..7454c9d 100644
--- a/app/api/memory/profile/route.ts
+++ b/app/api/memory/profile/route.ts
@@ -1,7 +1,12 @@
 import { NextResponse } from "next/server";
 
 import { withAuth } from "@/lib/auth/with-auth";
-import { getAuthInfo, getMemoryDoc, getRecentThreadSummaries } from "@/lib/memory/queries";
+import {
+  EMPTY_AUTH_INFO,
+  getAuthInfo,
+  getMemoryDoc,
+  getRecentThreadSummaries,
+} from "@/lib/memory/queries";
 
 // ponytail: rule #9 — withAuth wraps every handler. The handler
 // returns store and auth as separate fields so the frontend can
@@ -19,12 +24,7 @@ export const GET = withAuth(async (_req, { user }) => {
   try {
     const [store, auth, threads] = await Promise.all([
       getMemoryDoc(user.id).catch(() => ({})),
-      getAuthInfo(user.id).catch(() => ({
-        name: null,
-        email: null,
-        image: null,
-        socials: [] as Array<{ provider: string }>,
-      })),
+      getAuthInfo(user.id).catch(() => EMPTY_AUTH_INFO),
       getRecentThreadSummaries(user.id).catch(() => []),
     ]);
     return NextResponse.json({ store, auth, threads });
diff --git a/backend/memory/recall.ts b/backend/memory/recall.ts
index 2c28fb4..9ca41e0 100644
--- a/backend/memory/recall.ts
+++ b/backend/memory/recall.ts
@@ -1,7 +1,7 @@
 import { LRUCache } from "lru-cache";
 import type { RunnableConfig } from "@langchain/core/runnables";
 
-import { getAuthInfo, getMemoryDoc } from "@/lib/memory/queries";
+import { EMPTY_AUTH_INFO, getAuthInfo, getMemoryDoc } from "@/lib/memory/queries";
 import { mergeMemory } from "@/lib/memory/merge";
 import type { MemoryDoc } from "@/lib/memory/queries";
 
@@ -50,12 +50,7 @@ export function extractThreadId(
 export async function loadMemory(userId: string): Promise<LoadedMemory> {
   const [doc, auth] = await Promise.all([
     getMemoryDoc(userId).catch(() => ({})),
-    getAuthInfo(userId).catch(() => ({
-      name: null,
-      email: null,
-      image: null,
-      socials: [] as Array<{ provider: string }>,
-    })),
+    getAuthInfo(userId).catch(() => EMPTY_AUTH_INFO),
   ]);
   return { memory: mergeMemory(doc, auth) };
 }
diff --git a/backend/memory/template.ts b/backend/memory/template.ts
index b49450c..f23ab2b 100644
--- a/backend/memory/template.ts
+++ b/backend/memory/template.ts
@@ -14,7 +14,7 @@ import { formatSummaryText } from "@/lib/langgraph/format-summary";
 
 // ponytail: the system prompt carries TWO dynamic blocks:
 //   <memory>    = the user's saved profile (keys + values), plus OAuth
-//                 overlay (name / email / image / socials) when set.
+//                 overlay (name / email / avatar / socials) when set.
 //   <threads>   = compressed Q&A history for THIS thread, pulled from
 //                 the store at invoke time. Mounts the historical
 //                 content the model would otherwise lose when older
diff --git a/backend/tool/memory/save-memory-tool.ts b/backend/tool/memory/save-memory-tool.ts
index 803b7e6..338252b 100644
--- a/backend/tool/memory/save-memory-tool.ts
+++ b/backend/tool/memory/save-memory-tool.ts
@@ -2,8 +2,8 @@ import { tool } from "@langchain/core/tools";
 import { immutableJSONPatch } from "immutable-json-patch";
 
 import { MEMORY_PROFILE_MAX_BYTES } from "@/lib/memory/constants";
-import { getAuthInfo, getMemoryDoc, putMemoryDoc } from "@/lib/memory/queries";
-import { mergeMemory, type AuthInfo, type MemoryDoc } from "@/lib/memory/merge";
+import { getAuthInfo, getMemoryDoc, putMemoryDoc, EMPTY_AUTH_INFO } from "@/lib/memory/queries";
+import { mergeMemory, type MemoryDoc } from "@/lib/memory/merge";
 import { SaveMemoryInputSchema, type SaveMemoryInput } from "@/lib/memory/validators";
 import { assertProfileSize, MemorySizeError } from "@/backend/memory/profile-size";
 import { invalidateMemory } from "@/backend/memory/recall";
@@ -33,7 +33,21 @@ function extractUserId(config?: { configurable?: { userId?: unknown } }): string
   return typeof raw === "string" && raw.length > 0 ? raw : null;
 }
 
-const EMPTY_AUTH: AuthInfo = { name: null, email: null, image: null, socials: [] };
+// ponytail: base64 blobs (esp. `data:...;base64,` avatars/images) are the
+// exact payload that blew the context window in issue #28 — a single one
+// dwarfs the whole profile. Reject any string value that's a data URL or a
+// long uninterrupted base64 run. Walks arrays/objects too so it can't slip
+// in nested. Threshold 512 avoids flagging wallet addresses / hashes / IDs.
+const DATA_URL_RE = /data:[^,]*;base64,/i;
+// Covers both standard (+/) and url-safe (-_) base64 alphabets.
+const LONG_BASE64_RE = /[A-Za-z0-9+/_-]{512,}={0,2}/;
+
+function containsBase64(value: unknown): boolean {
+  if (typeof value === "string") return DATA_URL_RE.test(value) || LONG_BASE64_RE.test(value);
+  if (Array.isArray(value)) return value.some(containsBase64);
+  if (value && typeof value === "object") return Object.values(value).some(containsBase64);
+  return false;
+}
 
 async function impl(
   input: SaveMemoryInput,
@@ -46,7 +60,7 @@ async function impl(
 
   const [storeDoc, auth] = await Promise.all([
     getMemoryDoc(userId),
-    getAuthInfo(userId).catch(() => EMPTY_AUTH),
+    getAuthInfo(userId).catch(() => EMPTY_AUTH_INFO),
   ]);
   // ponytail: patches operate on the merged view (store + auth
   // overlay) — same shape the model sees in <memory>. Validating
@@ -56,6 +70,11 @@ async function impl(
   // model.
   const effective = mergeMemory(storeDoc, auth);
   for (const patch of patches) {
+    if (patch.op !== "remove" && containsBase64(patch.value)) {
+      throw new MemoryPatchError(
+        `path ${patch.path} value looks like base64 / data-URL content; save_memory does not store binary blobs`,
+      );
+    }
     if ((patch.op === "replace" || patch.op === "remove") && !(patch.path.slice(1) in effective)) {
       throw new MemoryPatchError(`path ${patch.path} not found in memory`);
     }
@@ -159,6 +178,7 @@ CONSTRAINTS (DO NOT):
 - DO NOT save model inferences or questions about the user.
 - DO NOT save sensitive content the user wouldn't want surfaced later (passwords, financial details, medical info, intimate relationships) — use judgment.
 - DO NOT save external data returned by tools (weather, prices, balances, fetched URLs) — only the user's input portion.
+- DO NOT save base64 / data-URL blobs, images, or any large binary-encoded string (avatars, file contents) — they blow up the context window; store a URL or short reference instead.
 - DO NOT call more than once per turn (group multiple updates into one patch set).
 - DO NOT save the same or similar content under two keys (e.g. use "ask_location_cache" instead of both "ask_location_cache" and "ask_location_result").
 
diff --git a/components/auth/settings/account/change-avatar.tsx b/components/auth/settings/account/change-avatar.tsx
index 92e619e..913eddf 100644
--- a/components/auth/settings/account/change-avatar.tsx
+++ b/components/auth/settings/account/change-avatar.tsx
@@ -1,6 +1,5 @@
 "use client";
 
-import { fileToBase64 } from "@better-auth-ui/core";
 import { useAuth, useSession, useUpdateUser } from "@better-auth-ui/react";
 import { Trash2, Upload } from "lucide-react";
 import { type ChangeEvent, useRef, useState } from "react";
@@ -22,6 +21,48 @@ export type ChangeAvatarProps = {
   className?: string;
 };
 
+// ponytail: avatars upload to R2 and we store ONLY the public URL. The
+// old base64 fallback wrote a data URL into user.image, which the memory
+// auth-overlay injected into every <memory> system block uncapped —
+// issue #28's 372K-token blow-up. Gated on ATTACHMENTS_ENABLED (same R2
+// backing as chat attachments — no separate flag). Off → uploads disabled.
+// Read at render (matches app/assistant.tsx) — window.__CONFIG__ is
+// injected beforeInteractive.
+function avatarUploadsEnabled(): boolean {
+  return typeof window !== "undefined" && window.__CONFIG__?.ATTACHMENTS_ENABLED === "true";
+}
+
+// ponytail: presign → PUT → return the public URL. Errors bubble to the
+// caller's try/catch, which toasts them.
+async function uploadAvatarToR2(file: File): Promise<string> {
+  const presignRes = await fetch("/api/avatar/presign", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ name: file.name, contentType: file.type, sizeBytes: file.size }),
+  });
+  if (!presignRes.ok) {
+    throw new Error("Avatar upload is not available right now.");
+  }
+  const { uploadUrl, publicUrl, uploadHeaders } = await presignRes.json();
+  const putRes = await fetch(uploadUrl, { method: "PUT", headers: uploadHeaders, body: file });
+  if (!putRes.ok) {
+    throw new Error("Failed to upload avatar.");
+  }
+  return publicUrl;
+}
+
+// ponytail: delete the R2 object behind a previous avatar URL. Owner-scoped
+// + idempotent server-side; external (OAuth-hosted) URLs are a no-op there.
+// Best-effort — a failed cleanup shouldn't block the user's action.
+async function deleteAvatarFromR2(url: string | null | undefined): Promise<void> {
+  if (!url) return;
+  await fetch("/api/avatar", {
+    method: "DELETE",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ url }),
+  }).catch(() => undefined);
+}
+
 export function ChangeAvatar({ className }: ChangeAvatarProps) {
   const { authClient, localization, avatar } = useAuth();
   const { data: session } = useSession(authClient);
@@ -33,6 +74,14 @@ export function ChangeAvatar({ className }: ChangeAvatarProps) {
   const [isDeleting, setIsDeleting] = useState(false);
 
   const isPending = updatePending || isUploading || isDeleting;
+  const canUpload = avatarUploadsEnabled();
+
+  // ponytail: pending upload URL — if a SECOND upload starts before the
+  // first's `updateUser` lands, the first upload's URL lands here and the
+  // second upload's onSuccess cleans IT up (instead of the original avatar).
+  // Without this, rapid re-uploads would all race on `previousImage` and
+  // every prior in-flight upload would orphan in R2.
+  const pendingUploadRef = useRef<string | null>(null);
 
   async function handleFileChange(e: ChangeEvent<HTMLInputElement>) {
     const file = e.target.files?.[0];
@@ -40,26 +89,53 @@ export function ChangeAvatar({ className }: ChangeAvatarProps) {
 
     e.target.value = "";
 
+    if (!canUpload) {
+      toast.error(
+        "Avatar uploads are disabled — set the R2_* env vars and ATTACHMENTS_ENABLED=true.",
+      );
+      return;
+    }
+
+    const previousImage = session?.user.image;
     setIsUploading(true);
 
     try {
       const resized = (await avatar.resize?.(file, avatar.size, avatar.extension)) || file;
 
-      const image = (await avatar.upload?.(resized)) || (await fileToBase64(resized));
+      const image = await uploadAvatarToR2(resized);
+      pendingUploadRef.current = image;
 
       updateUser(
         { image },
         {
-          onSuccess: () => toast.success(localization.settings.avatarChangedSuccess),
+          onSuccess: () => {
+            // ponytail: clean up whatever was the avatar BEFORE this upload
+            // succeeded. If a second upload raced us, that's the one
+            // pendingUploadRef now points to — we delete it instead of
+            // the user's actual current avatar.
+            const toDelete =
+              pendingUploadRef.current === image ? previousImage : pendingUploadRef.current;
+            pendingUploadRef.current = null;
+            void deleteAvatarFromR2(toDelete);
+            toast.success(localization.settings.avatarChangedSuccess);
+          },
+          onError: () => {
+            // ponytail: Better Auth refused the update — the new R2 object
+            // has no DB row pointing at it and the retention sweep excludes
+            // avatars, so we MUST clean it up ourselves or it orphans.
+            if (pendingUploadRef.current === image) pendingUploadRef.current = null;
+            void deleteAvatarFromR2(image);
+          },
         },
       );
     } catch (error) {
+      pendingUploadRef.current = null;
       if (error instanceof Error) {
         toast.error(error.message);
       }
+    } finally {
+      setIsUploading(false);
     }
-
-    setIsUploading(false);
   }
 
   async function handleDelete() {
@@ -72,7 +148,7 @@ export function ChangeAvatar({ className }: ChangeAvatarProps) {
           if (currentImage) {
             setIsDeleting(true);
             try {
-              await avatar.delete?.(currentImage);
+              await deleteAvatarFromR2(currentImage);
             } finally {
               setIsDeleting(false);
             }
@@ -101,7 +177,7 @@ export function ChangeAvatar({ className }: ChangeAvatarProps) {
           type="button"
           variant="ghost"
           className="p-0 h-auto w-auto rounded-full"
-          disabled={isPending}
+          disabled={isPending || !canUpload}
           onClick={() => fileInputRef.current?.click()}
         >
           <UserAvatar className="size-12" isPending={isPending} />
@@ -118,7 +194,7 @@ export function ChangeAvatar({ className }: ChangeAvatarProps) {
           </DropdownMenuTrigger>
 
           <DropdownMenuContent className="min-w-fit">
-            <DropdownMenuItem onClick={() => fileInputRef.current?.click()}>
+            <DropdownMenuItem disabled={!canUpload} onClick={() => fileInputRef.current?.click()}>
               <Upload className="text-muted-foreground" />
 
               {localization.settings.uploadAvatar}
diff --git a/components/settings/memory-view.tsx b/components/settings/memory-view.tsx
index f3075a9..2ecfdfd 100644
--- a/components/settings/memory-view.tsx
+++ b/components/settings/memory-view.tsx
@@ -49,7 +49,7 @@ function buildRows(store: MemoryDoc, auth: AuthInfo): Row[] {
   const storeKeys = new Set(Object.keys(store));
   const storeKeyList = [...storeKeys].sort();
   // ponytail: account rows first in AUTH_OVERLAY_KEYS order (stable:
-  // name, email, image, socials), then store rows alphabetically.
+  // name, email, avatar, socials), then store rows alphabetically.
   const accountOrder = new Map<AuthOverlayKey, number>(AUTH_OVERLAY_KEYS.map((k, i) => [k, i]));
   const rows: Row[] = Object.entries(merged).map(([key, value]) => ({
     key,
diff --git a/docs/APIS.md b/docs/APIS.md
index ce91537..01ba710 100644
--- a/docs/APIS.md
+++ b/docs/APIS.md
@@ -94,6 +94,28 @@ Best-effort cleanup of a composer chip. Removes the row + the R2 object. Idempot
 | Response      | `204 No Content`                                                       |
 | Failure codes | 401 `UNAUTHORIZED`. 404 `NOT_FOUND`. 503 `ATTACHMENTS_NOT_CONFIGURED`. |
 
+### `POST /api/avatar/presign`
+
+Presign a 5-minute PUT for a user avatar (issue #28). Same R2 backing as attachments (`withAuth`, 503 when `R2_*` unset), but **no DB row** — avatars aren't chat attachments. Key is `u/<userId>/avatar/<id>-<safe-name>`. The browser PUTs the file, then calls Better Auth `updateUser({ image: publicUrl })` — we store only the URL, never base64 (a base64 data URL in `user.image` flowed through the memory auth-overlay into every `<memory>` block uncapped; that was the 372K-token blow-up). Client gate: the Settings avatar upload is disabled unless `window.__CONFIG__.ATTACHMENTS_ENABLED === "true"`.
+
+`contentType` must start with `image/` **and is not `image/svg+xml`** — unlike attachments (which uses `R2_ALLOWED_CONTENT_TYPES`), this route hardcodes the image check, and SVG is rejected because it can carry inline script and renders `inline` from a public bucket (XSS in the bucket origin).
+
+|               |                                                                                                                                                                                     |
+| ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Request body  | `{ name: string (1..256), contentType: string (1..127), sizeBytes: number (>0) }`. `contentType` must start with `image/` and not be `image/svg+xml`; `sizeBytes` ≤ `R2_MAX_BYTES`. |
+| 201 response  | `{ key, uploadUrl, publicUrl, uploadHeaders: { "Content-Type": contentType, "Content-Disposition": "inline" } }`. Presigned URL expires in 300s.                                    |
+| Failure codes | 400 `BAD_REQUEST`. 400 `CONTENT_TYPE_NOT_ALLOWED` (non-image or svg). 400 `FILE_TOO_LARGE` (`{ maxBytes, sizeBytes }`). 401 `UNAUTHORIZED`. 503 `AVATAR_UPLOADS_NOT_CONFIGURED`.    |
+
+### `DELETE /api/avatar`
+
+Delete the R2 object behind a previous avatar URL — avatars have no DB row, so nothing else sweeps the old object when the user deletes or replaces one. Called by the Settings UI on delete and after a successful replace. Owner-scoped: the key must live under `u/<user.id>/avatar/`.
+
+|               |                                                                                                                                                                  |
+| ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Request body  | `{ url: string }` — the avatar's public URL.                                                                                                                     |
+| Response      | `204 No Content`. Idempotent (R2 404 swallowed). An external / non-R2 URL is a no-op 204.                                                                        |
+| Failure codes | 400 `BAD_REQUEST` (invalid JSON / missing url). 401 `UNAUTHORIZED`. 403 `FORBIDDEN` (key outside the caller's avatar path). 503 `AVATAR_UPLOADS_NOT_CONFIGURED`. |
+
 ## Observability
 
 Per-thread captured LLM / Tool / Chain / Node / Human spans — written at every End hook by the callback handler attached to the compiled graph in `backend/agent.ts` via `compile({ checkpointer }).withConfig({ callbacks: [capturingHandler] })`. Attaching at the compile layer (not per-model) ensures ToolNode spans are captured too. Design doc: [`docs/OBSERVABILITY.md`](./OBSERVABILITY.md) (storage, retention, FORBIDDEN regex, trade-offs).
@@ -210,12 +232,12 @@ Backed by the LangGraph `PostgresStore` (per-user, cross-thread long-term memory
 
 Returns the user's profile doc plus read-only better-auth fields that the agent already sees via the recall middleware, plus a flat list of thread summaries enriched with the corresponding chat title. The store + auth fields are kept separate on purpose so the UI can classify each merged field as "summarized by AI" (store) vs "from account" (auth overlay) using store-keys membership — the same classification the model's `<memory>` block applies.
 
-|              |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
-| ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Request body | (none)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
-| Output       | `{ store: Record<string, unknown>, auth: { name, email, image, socials: Array<{ provider: string }> }, threads: Array<{ key, value: SummaryEntry, threadTitle: string \| null }> }`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
-| Status codes | 200 / 401 / 500 (store throws). 401 is returned by the shared `withAuth` wrapper, not the handler body.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| Field notes  | `auth.socials[].provider` is the better-auth `providerId` for each linked OAuth account (`github`, `google`, ...). `accountId` / tokens are deliberately NOT exposed (FR-020). The "credential" provider is filtered out so email+password accounts don't show as a misleading "linked account". `threads[]` is `createdAt`-asc (oldest-first); the Memory tab groups by threadId client-side using insertion order — do not sort on the client (FR-passthrough). `threadTitle` is the row from the `threads` table set by `renameThreadAgent`; `null` when the rename path hasn't run, in which case the UI falls back to the raw `threadId`. Storage detail: `lib/memory/queries.ts`; Zod shape: `lib/memory/validators.ts` `MemoryResponseSchema`. |
+|              |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Request body | (none)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| Output       | `{ store: Record<string, unknown>, auth: { name, email, avatar, socials: Array<{ provider: string; email?: string }> }, threads: Array<{ key, value: SummaryEntry, threadTitle: string \| null }> }`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| Status codes | 200 / 401 / 500 (store throws). 401 is returned by the shared `withAuth` wrapper, not the handler body.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| Field notes  | `auth.avatar` is the user's profile image — an `https://...` URL once Settings → Account uploads to R2, `null` otherwise. Legacy `data:` base64 rows in `user.image` are filtered out on read so the model never sees them in the memory block (issue #28 — the 372K-token blow-up was a base64 avatar flowing through the auth overlay uncapped). `auth.socials[].provider` is the better-auth `providerId` for each linked OAuth account (`github`, `google`, ...). `auth.socials[].email` is the per-provider verified email when available: Google via OIDC `idToken` `email` claim (only when `email_verified === true`), GitHub via `GET /user/emails` with the stored `accessToken` (primary+verified preferred). Unverified / undecodable / fetch-failed → `email` is absent from that entry. `accountId` / tokens are deliberately NOT exposed (FR-020). The "credential" provider is filtered out so email+password accounts don't show as a misleading "linked account". `threads[]` is `createdAt`-asc (oldest-first); the Memory tab groups by threadId client-side using insertion order — do not sort on the client (FR-passthrough). `threadTitle` is the row from the `threads` table set by `renameThreadAgent`; `null` when the rename path hasn't run, in which case the UI falls back to the raw `threadId`. Storage detail: `lib/memory/queries.ts`; Zod shape: `lib/memory/validators.ts` `MemoryResponseSchema`. |
 
 ### `DELETE /api/memory/profile/[key]`
 
diff --git a/docs/MEMORY.md b/docs/MEMORY.md
index 9a7bec0..ed9868d 100644
--- a/docs/MEMORY.md
+++ b/docs/MEMORY.md
@@ -64,7 +64,7 @@ does the heavy lifting. It:
 2. Hits `getCachedMemory(userId)` (`backend/memory/recall.ts`) —
    LRU-cached, max 1000 entries, 60s TTL, keyed by `userId`.
 3. Loads the user's profile doc (`[userId, "memory"] main`) and the
-   auth record (name / email / image / socials from drizzle `user` +
+   auth record (name / email / avatar / socials from drizzle `user` +
    `account` tables), merges them via `mergeMemory`, and renders the
    SystemMessage through the `MEMORY_AUGMENTED_PROMPT_TEMPLATE`
    mustache template.
@@ -95,7 +95,7 @@ The merged view from `mergeMemory(doc, auth)` (`lib/memory/merge.ts`):
   in the merged view (regardless of whether the auth overlay has a value
   for them).
 - Auth overlay fills the gaps. For each `AUTH_OVERLAY_KEYS` entry
-  (`name`, `email`, `image`, `socials`), if the user-saved doc doesn't
+  (`name`, `email`, `avatar`, `socials`), if the user-saved doc doesn't
   have that key AND the auth value isn't `null`/`undefined`/`[]`, the
   auth value fills the slot.
 - `socials` is the list of OAuth providers linked to the user
@@ -382,14 +382,14 @@ visual classes:
 - **"Summarized by AI"** (Bot icon) — keys present in the store doc
   (`save_memory` wrote them, or they predate the auth overlay).
 - **"From account"** (User icon) — keys only present in the auth
-  overlay (name / email / image / socials). Read-only — clicking
+  overlay (name / email / avatar / socials). Read-only — clicking
   shows a tooltip explaining the user should edit these in account
   settings.
 
 Rows sort by:
 
 1. Auth-overlay rows first, in the order they appear in
-   `AUTH_OVERLAY_KEYS` (`name`, `email`, `image`, `socials`).
+   `AUTH_OVERLAY_KEYS` (`name`, `email`, `avatar`, `socials`).
 2. Store rows alphabetically by key.
 
 `Delete` opens a confirmation dialog (`Delete this memory?`). On
diff --git a/lib/memory/constants.ts b/lib/memory/constants.ts
index bdc23fc..7f27d66 100644
--- a/lib/memory/constants.ts
+++ b/lib/memory/constants.ts
@@ -52,5 +52,5 @@ export const MEMORY_PROFILE_MAX_BYTES = positiveInt(
 // Better Auth) when the user-saved doc doesn't have them. Listed
 // once so mergeMemory iterates them — the UI's "(from account)"
 // hint and the LLM's system-prompt overlay use the same set.
-export const AUTH_OVERLAY_KEYS = ["name", "email", "image", "socials"] as const;
+export const AUTH_OVERLAY_KEYS = ["name", "email", "avatar", "socials"] as const;
 export type AuthOverlayKey = (typeof AUTH_OVERLAY_KEYS)[number];
diff --git a/lib/memory/queries.ts b/lib/memory/queries.ts
index bf5610d..f0f1e6d 100644
--- a/lib/memory/queries.ts
+++ b/lib/memory/queries.ts
@@ -148,18 +148,73 @@ export async function writeSummary(
   return full;
 }
 
-// ponytail: explicit `.select({ provider: account.providerId })` keeps
-// `accountId` / tokens out of the recall payload (FR-020). Filter out
-// better-auth's `"credential"` provider — that's the email+password
-// account, not a social login; showing it in the Memory view as a
-// "linked account" is misleading.
+// ponytail: we read `idToken` / `accessToken` only to derive a per-provider
+// email — the raw tokens never leave this function (FR-020 keeps accountId /
+// tokens out of the recall payload). Google's email comes from the OIDC
+// idToken; GitHub's from one API call spending the stored access token.
+// Filter out better-auth's `"credential"` provider — that's the
+// email+password account, not a social login.
 export type AuthInfo = {
   name: string | null;
   email: string | null;
-  image: string | null;
-  socials: Array<{ provider: string }>;
+  avatar: string | null;
+  socials: Array<{ provider: string; email?: string }>;
 };
 
+// ponytail: single source of truth for the "auth lookup failed" fallback —
+// `.catch(() => EMPTY_AUTH_INFO)` at every call site. Keeps the socials
+// element shape (`email?`) in one place so it can't drift.
+export const EMPTY_AUTH_INFO: AuthInfo = { name: null, email: null, avatar: null, socials: [] };
+
+// ponytail: read the `email` claim out of an OIDC idToken. Google is OIDC
+// so its idToken is a JWT (header.payload.signature) with an email claim.
+// We only READ our own stored token, so no signature verify: base64url-
+// decode the middle segment. Only surface a VERIFIED email (Google always
+// stamps email_verified) so the Memory view can't show an unverified
+// address. Malformed / missing / unverified → undefined, never throws.
+function emailFromIdToken(idToken: string | null): string | undefined {
+  const payload = idToken?.split(".")[1];
+  if (!payload) return undefined;
+  try {
+    const claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    if (typeof claims?.email !== "string") return undefined;
+    const verified = claims.email_verified;
+    return verified === true || verified === "true" ? claims.email : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+// ponytail: GitHub is OAuth2, not OIDC — no idToken to decode. Its email
+// lives behind the API, so we spend the user's own stored access token
+// (default scope already includes `user:email`) on one GET. Best-effort:
+// any failure (revoked token, rate limit, network) → undefined, the row
+// just stays email-less. This is the only network hop in getAuthInfo, so
+// it rides the recall LRU (getCachedMemory) on the prompt path.
+async function fetchGithubEmail(accessToken: string | null): Promise<string | undefined> {
+  if (!accessToken) return undefined;
+  try {
+    const res = await fetch("https://api.github.com/user/emails", {
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        Accept: "application/vnd.github+json",
+        "User-Agent": "langgraph-app",
+      },
+    });
+    if (!res.ok) return undefined;
+    const emails = (await res.json()) as Array<{
+      email: string;
+      primary: boolean;
+      verified: boolean;
+    }>;
+    const pick =
+      emails.find((e) => e.primary && e.verified) ?? emails.find((e) => e.verified) ?? emails[0];
+    return typeof pick?.email === "string" ? pick.email : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 export async function getAuthInfo(userId: string): Promise<AuthInfo> {
   const [u] = await db
     .select({ name: user.name, email: user.email, image: user.image })
@@ -167,15 +222,30 @@ export async function getAuthInfo(userId: string): Promise<AuthInfo> {
     .where(eq(user.id, userId))
     .limit(1);
   const accounts = await db
-    .select({ provider: account.providerId })
+    .select({
+      provider: account.providerId,
+      idToken: account.idToken,
+      accessToken: account.accessToken,
+    })
     .from(account)
     .where(eq(account.userId, userId));
   return {
     name: u?.name ?? null,
     email: u?.email ?? null,
-    image: u?.image ?? null,
-    socials: accounts
-      .filter((r) => r.provider !== "credential")
-      .map((r) => ({ provider: r.provider })),
+    // ponytail: never overlay a legacy base64 `data:` avatar — those are
+    // exactly the blobs that blew the <memory> block (issue #28). Existing
+    // rows go harmless immediately (treated as no avatar) without waiting
+    // for a re-upload or a one-off DB cleanup.
+    avatar: u?.image && !u.image.startsWith("data:") ? u.image : null,
+    socials: await Promise.all(
+      accounts
+        .filter((r) => r.provider !== "credential")
+        .map(async (r) => {
+          const email =
+            emailFromIdToken(r.idToken) ??
+            (r.provider === "github" ? await fetchGithubEmail(r.accessToken) : undefined);
+          return email ? { provider: r.provider, email } : { provider: r.provider };
+        }),
+    ),
   };
 }
diff --git a/lib/memory/validators.ts b/lib/memory/validators.ts
index 50742ad..1d84a2a 100644
--- a/lib/memory/validators.ts
+++ b/lib/memory/validators.ts
@@ -100,7 +100,7 @@ export const SummaryEntrySchema = z
 
 export const MemoryResponseSchema = z.object({
   // ponytail: `memory` is the user-saved doc overlaid with live auth
-  // (name/email/image/socials from drizzle user+account tables). Model
+  // (name/email/avatar/socials from drizzle user+account tables). Model
   // and UI both see the same merged shape — one function (`loadMemory`)
   // is the single source of truth.
   memory: z.record(z.string(), z.unknown()),
diff --git a/tests/api/avatar/presign.test.ts b/tests/api/avatar/presign.test.ts
new file mode 100644
index 0000000..26a5578
--- /dev/null
+++ b/tests/api/avatar/presign.test.ts
@@ -0,0 +1,169 @@
+import "@/tests/helpers/session";
+import { afterAll, beforeEach, describe, expect, it, vi } from "vitest";
+
+const mockState = vi.hoisted(() => ({
+  presignPut: vi.fn(async () => "https://r2.example/presigned"),
+  buildPublicUrl: vi.fn((key: string) => `https://file.example/${key}`),
+  deleteObject: vi.fn(async () => undefined),
+  getR2PublicBaseUrl: vi.fn(() => "https://file.example"),
+}));
+
+vi.mock("@/lib/r2/client", async () => {
+  class R2NotConfiguredError extends Error {
+    readonly missing: readonly string[];
+    constructor(missing: readonly string[]) {
+      super(`R2 not configured — missing env vars: ${missing.join(", ")}`);
+      this.name = "R2NotConfiguredError";
+      this.missing = missing;
+    }
+  }
+  return {
+    R2NotConfiguredError,
+    presignPut: mockState.presignPut,
+    buildPublicUrl: mockState.buildPublicUrl,
+    deleteObject: mockState.deleteObject,
+    getR2PublicBaseUrl: mockState.getR2PublicBaseUrl,
+  };
+});
+
+import { setCurrentUser } from "@/tests/helpers/session";
+import { TEST_USER } from "@/tests/helpers/auth";
+import { R2NotConfiguredError } from "@/lib/r2/client";
+import { POST } from "@/app/api/avatar/presign/route";
+import { DELETE } from "@/app/api/avatar/route";
+
+const ctx = { params: Promise.resolve(undefined as never) };
+
+function jsonRequest(body: unknown): Request {
+  return new Request("http://localhost", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  });
+}
+
+function body(overrides: Partial<{ name: string; contentType: string; sizeBytes: number }> = {}) {
+  return { name: "me.png", contentType: "image/png", sizeBytes: 1024, ...overrides };
+}
+
+beforeEach(() => {
+  mockState.presignPut.mockReset();
+  mockState.buildPublicUrl.mockReset();
+  mockState.deleteObject.mockReset();
+  mockState.getR2PublicBaseUrl.mockReset();
+  mockState.presignPut.mockResolvedValue("https://r2.example/presigned");
+  mockState.buildPublicUrl.mockImplementation((key: string) => `https://file.example/${key}`);
+  mockState.deleteObject.mockResolvedValue(undefined);
+  mockState.getR2PublicBaseUrl.mockReturnValue("https://file.example");
+  process.env.R2_MAX_BYTES = "10485760";
+  setCurrentUser({ id: TEST_USER.id, email: TEST_USER.email });
+});
+
+afterAll(() => setCurrentUser(null));
+
+describe("POST /api/avatar/presign", () => {
+  it("returns 401 when unauthenticated", async () => {
+    setCurrentUser(null);
+    expect((await POST(jsonRequest(body()), ctx)).status).toBe(401);
+  });
+
+  it("returns 400 on invalid JSON", async () => {
+    const req = new Request("http://localhost", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: "{not json",
+    });
+    expect((await POST(req, ctx)).status).toBe(400);
+  });
+
+  it("returns 400 on schema violation", async () => {
+    const res = await POST(jsonRequest({ name: "", contentType: "image/png", sizeBytes: 0 }), ctx);
+    expect(res.status).toBe(400);
+  });
+
+  it("returns 400 for a non-image content type", async () => {
+    const res = await POST(jsonRequest(body({ contentType: "application/pdf" })), ctx);
+    expect(res.status).toBe(400);
+    expect((await res.json()).code).toBe("CONTENT_TYPE_NOT_ALLOWED");
+  });
+
+  it("rejects image/svg+xml (XSS-in-bucket)", async () => {
+    const res = await POST(jsonRequest(body({ contentType: "image/svg+xml" })), ctx);
+    expect(res.status).toBe(400);
+    expect((await res.json()).code).toBe("CONTENT_TYPE_NOT_ALLOWED");
+  });
+
+  it("returns 400 when the file is over the cap", async () => {
+    const res = await POST(jsonRequest(body({ sizeBytes: 20_000_000 })), ctx);
+    expect(res.status).toBe(400);
+    expect((await res.json()).code).toBe("FILE_TOO_LARGE");
+  });
+
+  it("returns 201 with a presigned PUT + public URL under the user avatar path", async () => {
+    const res = await POST(jsonRequest(body()), ctx);
+    expect(res.status).toBe(201);
+    const json = await res.json();
+    expect(json.uploadUrl).toBe("https://r2.example/presigned");
+    expect(json.key).toMatch(new RegExp(`^u/${TEST_USER.id}/avatar/[0-9a-z]{12}-me\\.png$`));
+    expect(json.publicUrl).toBe(`https://file.example/${json.key}`);
+    expect(json.uploadHeaders).toEqual({
+      "Content-Type": "image/png",
+      "Content-Disposition": "inline",
+    });
+  });
+
+  it("returns 503 when R2 is not configured", async () => {
+    mockState.presignPut.mockRejectedValueOnce(new R2NotConfiguredError(["R2_BUCKET"]));
+    const res = await POST(jsonRequest(body()), ctx);
+    expect(res.status).toBe(503);
+    expect((await res.json()).code).toBe("AVATAR_UPLOADS_NOT_CONFIGURED");
+  });
+});
+
+describe("DELETE /api/avatar", () => {
+  const del = (b: unknown) =>
+    DELETE(
+      new Request("http://localhost", {
+        method: "DELETE",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(b),
+      }),
+      ctx,
+    );
+
+  it("returns 401 when unauthenticated", async () => {
+    setCurrentUser(null);
+    expect((await del({ url: "https://file.example/x" })).status).toBe(401);
+  });
+
+  it("returns 400 when url is missing", async () => {
+    expect((await del({})).status).toBe(400);
+  });
+
+  it("deletes an owned avatar object and returns 204", async () => {
+    const key = `u/${TEST_USER.id}/avatar/abc123def456-me.png`;
+    const res = await del({ url: `https://file.example/${key}` });
+    expect(res.status).toBe(204);
+    expect(mockState.deleteObject).toHaveBeenCalledWith(key);
+  });
+
+  it("no-ops (204) for an external / non-R2 URL without deleting", async () => {
+    const res = await del({ url: "https://avatars.githubusercontent.com/u/1?v=4" });
+    expect(res.status).toBe(204);
+    expect(mockState.deleteObject).not.toHaveBeenCalled();
+  });
+
+  it("returns 403 for a key outside the caller's avatar path", async () => {
+    const res = await del({ url: "https://file.example/u/someone-else/avatar/x-me.png" });
+    expect(res.status).toBe(403);
+    expect(mockState.deleteObject).not.toHaveBeenCalled();
+  });
+
+  it("returns 503 when R2 is not configured", async () => {
+    mockState.getR2PublicBaseUrl.mockImplementationOnce(() => {
+      throw new R2NotConfiguredError(["R2_PUBLIC_BASE_URL"]);
+    });
+    const res = await del({ url: "https://file.example/x" });
+    expect(res.status).toBe(503);
+  });
+});
diff --git a/tests/api/memory/profile.get.test.ts b/tests/api/memory/profile.get.test.ts
index fa3b56f..0fba701 100644
--- a/tests/api/memory/profile.get.test.ts
+++ b/tests/api/memory/profile.get.test.ts
@@ -17,6 +17,7 @@ vi.mock("@/lib/memory/queries", () => ({
   getMemoryDoc: mockGetMemoryDoc,
   getAuthInfo: mockGetAuthInfo,
   getRecentThreadSummaries: mockGetRecentThreadSummaries,
+  EMPTY_AUTH_INFO: { name: null, email: null, avatar: null, socials: [] },
 }));
 
 describe("GET /api/memory/profile", () => {
diff --git a/tests/backend/memory/recall.test.ts b/tests/backend/memory/recall.test.ts
index 8be330e..2e0287f 100644
--- a/tests/backend/memory/recall.test.ts
+++ b/tests/backend/memory/recall.test.ts
@@ -9,6 +9,7 @@ const { mockGetMemoryDoc, mockGetAuthInfo } = vi.hoisted(() => ({
 vi.mock("@/lib/memory/queries", () => ({
   getMemoryDoc: mockGetMemoryDoc,
   getAuthInfo: mockGetAuthInfo,
+  EMPTY_AUTH_INFO: { name: null, email: null, avatar: null, socials: [] },
 }));
 
 import {
diff --git a/tests/backend/tool/memory/save-memory-tool.test.ts b/tests/backend/tool/memory/save-memory-tool.test.ts
index 5fe4c6b..2b56498 100644
--- a/tests/backend/tool/memory/save-memory-tool.test.ts
+++ b/tests/backend/tool/memory/save-memory-tool.test.ts
@@ -10,6 +10,7 @@ vi.mock("@/lib/memory/queries", () => ({
   getMemoryDoc: mockGetMemoryDoc,
   putMemoryDoc: mockPutMemoryDoc,
   getAuthInfo: mockGetAuthInfo,
+  EMPTY_AUTH_INFO: { name: null, email: null, avatar: null, socials: [] },
 }));
 
 import { saveMemoryTool } from "@/backend/tool/memory/save-memory-tool";
@@ -49,6 +50,48 @@ describe("saveMemoryTool — patch matrix (FR-001..003)", () => {
     expect(result.patches).toEqual([{ op: "add", path: "role", value: "frontend" }]);
   });
 
+  it("rejects a data-URL / base64 blob value (issue #28) without writing", async () => {
+    mockGetMemoryDoc.mockResolvedValueOnce({});
+    const dataUrl = `data:image/png;base64,${"A".repeat(600)}`;
+    await expect(
+      saveMemoryTool.invoke(
+        { patches: [{ op: "add", path: "/avatar", value: dataUrl }] },
+        cfg("u1"),
+      ),
+    ).rejects.toThrow(/base64/i);
+    expect(mockPutMemoryDoc).not.toHaveBeenCalled();
+  });
+
+  it("rejects a base64 blob nested inside an object value", async () => {
+    mockGetMemoryDoc.mockResolvedValueOnce({});
+    await expect(
+      saveMemoryTool.invoke(
+        { patches: [{ op: "add", path: "/pic", value: { raw: "B".repeat(700) } }] },
+        cfg("u1"),
+      ),
+    ).rejects.toThrow(/base64/i);
+    expect(mockPutMemoryDoc).not.toHaveBeenCalled();
+  });
+
+  it("rejects a url-safe (base64url) blob with -_ chars", async () => {
+    mockGetMemoryDoc.mockResolvedValueOnce({});
+    const blob = `${"a-b_".repeat(150)}`; // 600 chars of [a-z-_]
+    await expect(
+      saveMemoryTool.invoke({ patches: [{ op: "add", path: "/pic", value: blob }] }, cfg("u1")),
+    ).rejects.toThrow(/base64/i);
+    expect(mockPutMemoryDoc).not.toHaveBeenCalled();
+  });
+
+  it("does not flag short normal values (wallet address / hash)", async () => {
+    mockGetMemoryDoc.mockResolvedValueOnce({});
+    mockPutMemoryDoc.mockResolvedValueOnce(undefined);
+    await saveMemoryTool.invoke(
+      { patches: [{ op: "add", path: "/wallet", value: "0xAbC123def456" }] },
+      cfg("u1"),
+    );
+    expect(mockPutMemoryDoc).toHaveBeenCalledWith("u1", { wallet: "0xAbC123def456" });
+  });
+
   it("merges multiple adds with existing keys (non-destructive)", async () => {
     mockGetMemoryDoc.mockResolvedValueOnce({ language: "zh" });
     mockPutMemoryDoc.mockResolvedValueOnce(undefined);
@@ -106,7 +149,9 @@ describe("saveMemoryTool — patch matrix (FR-001..003)", () => {
 
   it("rejects a patch set that would exceed profile size (FR-003)", async () => {
     mockGetMemoryDoc.mockResolvedValueOnce({});
-    const padding = "x".repeat(9000);
+    // ponytail: spaced text so it trips the SIZE guard, not the base64
+    // guard (a long unbroken A-Za-z0-9 run would look like a blob).
+    const padding = "long note ".repeat(900);
     await expect(
       saveMemoryTool.invoke({ patches: [{ op: "add", path: "/note", value: padding }] }, cfg("u1")),
     ).rejects.toThrow(/exceeds|MemorySize|profile size/i);
diff --git a/tests/lib/memory/queries.test.ts b/tests/lib/memory/queries.test.ts
index 1c619fb..b0b8160 100644
--- a/tests/lib/memory/queries.test.ts
+++ b/tests/lib/memory/queries.test.ts
@@ -150,14 +150,14 @@ describe("lib/memory/queries", () => {
   });
 
   describe("getAuthInfo", () => {
-    it("returns name/email/image from user + providers from account", async () => {
+    it("returns name/email/avatar from user + providers from account", async () => {
       mockSelectLimit.mockResolvedValueOnce([{ name: "Lin", email: "lin@x.com", image: null }]);
       mockSelectAll.mockResolvedValueOnce([{ provider: "github" }, { provider: "google" }]);
       const info = await getAuthInfo(USER);
       expect(info).toEqual({
         name: "Lin",
         email: "lin@x.com",
-        image: null,
+        avatar: null,
         socials: [{ provider: "github" }, { provider: "google" }],
       });
     });
@@ -166,7 +166,21 @@ describe("lib/memory/queries", () => {
       mockSelectLimit.mockResolvedValueOnce([]);
       mockSelectAll.mockResolvedValueOnce([]);
       const info = await getAuthInfo(USER);
-      expect(info).toEqual({ name: null, email: null, image: null, socials: [] });
+      expect(info).toEqual({ name: null, email: null, avatar: null, socials: [] });
+    });
+
+    it("surfaces an http avatar but drops a legacy base64 data-URL (issue #28)", async () => {
+      mockSelectLimit.mockResolvedValueOnce([
+        { name: "Lin", email: "lin@x.com", image: "https://cdn.example/a.png" },
+      ]);
+      mockSelectAll.mockResolvedValueOnce([]);
+      expect((await getAuthInfo(USER)).avatar).toBe("https://cdn.example/a.png");
+
+      mockSelectLimit.mockResolvedValueOnce([
+        { name: "Lin", email: "lin@x.com", image: "data:image/png;base64,AAAA" },
+      ]);
+      mockSelectAll.mockResolvedValueOnce([]);
+      expect((await getAuthInfo(USER)).avatar).toBeNull();
     });
 
     it("filters out the credential provider (email+password account)", async () => {
@@ -175,6 +189,75 @@ describe("lib/memory/queries", () => {
       const info = await getAuthInfo(USER);
       expect(info.socials).toEqual([{ provider: "github" }]);
     });
+
+    it("decodes the email claim from an OIDC idToken (issue #10)", async () => {
+      const payload = Buffer.from(
+        JSON.stringify({ email: "lin@gmail.com", email_verified: true }),
+      ).toString("base64url");
+      const idToken = `h.${payload}.sig`;
+      mockSelectLimit.mockResolvedValueOnce([{ name: "Lin", email: "lin@x.com", image: null }]);
+      mockSelectAll.mockResolvedValueOnce([
+        { provider: "google", idToken },
+        { provider: "github", idToken: null },
+      ]);
+      const info = await getAuthInfo(USER);
+      expect(info.socials).toEqual([
+        { provider: "google", email: "lin@gmail.com" },
+        { provider: "github" },
+      ]);
+    });
+
+    it("drops an unverified idToken email", async () => {
+      const payload = Buffer.from(
+        JSON.stringify({ email: "spoof@x.com", email_verified: false }),
+      ).toString("base64url");
+      mockSelectLimit.mockResolvedValueOnce([{ name: "Lin", email: "lin@x.com", image: null }]);
+      mockSelectAll.mockResolvedValueOnce([{ provider: "google", idToken: `h.${payload}.sig` }]);
+      const info = await getAuthInfo(USER);
+      expect(info.socials).toEqual([{ provider: "google" }]);
+    });
+
+    it("ignores a malformed idToken instead of throwing", async () => {
+      mockSelectLimit.mockResolvedValueOnce([{ name: "Lin", email: "lin@x.com", image: null }]);
+      mockSelectAll.mockResolvedValueOnce([{ provider: "google", idToken: "not-a-jwt" }]);
+      const info = await getAuthInfo(USER);
+      expect(info.socials).toEqual([{ provider: "google" }]);
+    });
+
+    it("fetches the GitHub email via the stored access token (issue #10)", async () => {
+      const fetchMock = vi.fn().mockResolvedValue({
+        ok: true,
+        json: async () => [
+          { email: "old@x.com", primary: false, verified: true },
+          { email: "lin@users.noreply.github.com", primary: true, verified: true },
+        ],
+      });
+      vi.stubGlobal("fetch", fetchMock);
+      mockSelectLimit.mockResolvedValueOnce([{ name: "Lin", email: "lin@x.com", image: null }]);
+      mockSelectAll.mockResolvedValueOnce([
+        { provider: "github", idToken: null, accessToken: "gho_x" },
+      ]);
+      const info = await getAuthInfo(USER);
+      expect(info.socials).toEqual([{ provider: "github", email: "lin@users.noreply.github.com" }]);
+      expect(fetchMock).toHaveBeenCalledWith(
+        "https://api.github.com/user/emails",
+        expect.objectContaining({
+          headers: expect.objectContaining({ Authorization: "Bearer gho_x" }),
+        }),
+      );
+      vi.unstubAllGlobals();
+    });
+
+    it("leaves github email-less when the API call fails", async () => {
+      vi.stubGlobal("fetch", vi.fn().mockResolvedValue({ ok: false }));
+      mockSelectLimit.mockResolvedValueOnce([{ name: "Lin", email: "lin@x.com", image: null }]);
+      mockSelectAll.mockResolvedValueOnce([
+        { provider: "github", idToken: null, accessToken: "gho_x" },
+      ]);
+      const info = await getAuthInfo(USER);
+      expect(info.socials).toEqual([{ provider: "github" }]);
+      vi.unstubAllGlobals();
+    });
   });
 
   describe("writeSummary", () => {