Planning: add the M4 implementation review report and rotate M3's

Reporting pass only. No application code, no test, and no product
requirement changes.

Result: PASS WITH CORRECTIVE WORK REQUIRED.

M4's Definition of Done is met and demonstrated at the API level, including
across a real two-process restart. The load-bearing constraint holds under
inspection rather than assertion: the only head-field assignment M4 added
anywhere in the backend is one line in head.py, and an exhaustive grep of the
diff finds no second mechanism that forks, prunes memories, reconstructs
state, filters the transcript or recomputes Redo.

Three corrective items, all M4's own, none in the head model:

- GET /checkpoints is an N+1 fetching whole Action rows including prose --
  measured at 53 SELECTs for 25 Save Points against 4 for the branch panel,
  in a codebase that keeps test_egress.py for this exact class of mistake;
- deleting a branch silently deletes Save Points naming it, and the branch
  panel's confirmation does not say so. M4 added the consequence to an
  existing destructive action without updating its warning;
- the shipped D11/L03 tests restart a client, not a process, so the suite is
  weaker than the acceptance items it is named for. Both pass here only
  because the report re-ran them across a real process boundary by hand.

The browser smoke test is NOT PERFORMED, for M4 and still for M3. Firefox is
a snap that hangs past 90s on a trivial headless screenshot; there is no
Xvfb, no display, no driver library. Two consecutive milestones now carry an
unperformed browser requirement, which the report raises as a standing
acceptance risk rather than a defect in either milestone's code.

Evidence recorded: 680 backend tests pass (42 M4, 130 M3 invariants, 93
security/local-only), frontend lint and build clean, Docker build clean,
migration 80 verified against a representative pre-M4 database with both
cascades and zero possible orphans, and I04 verified through a real round
trip with branch ids remapped 1->3 and 2->4.

M4 is NOT accepted by this report, and M5 is NOT authorized. That decision
belongs to whoever reviews this.

Rotation: planning/reports/M3-IMPLEMENTATION-REPORT.md moves to
planning/archive/milestone-reports/ as a pure rename, contents unedited
(git reports 100% similarity, 0 insertions, 0 deletions). Six path
references in five active documents are updated because the path changed
and for no other reason -- no status claim, no wording change.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PWU4gTfLYY6Qq9U7aa9Qw2

planning/README.md

@@ -96,7 +96,7 @@ Two standing qualifications:
 10. `BROWSER-UX-SPEC.md`
 11. `V1-ACCEPTANCE-TESTS.md`
 12. `DECISIONS/` — all of them; they are short.
-13. `reports/M3-IMPLEMENTATION-REPORT.md`, for what the last milestone actually
+13. `reports/M4-IMPLEMENTATION-REPORT.md`, for what the last milestone actually
     left behind. Nothing in `planning/archive/` unless sent there.
 
 ## Architectural decisions
@@ -127,15 +127,12 @@ work until Phase 0 closes — which Phase 0 satisfied on 2026-09-01. It is in
 `reports/` holds the report for the milestone most recently completed, because
 that is the one the next milestone's planning has to consult:
 
-- `reports/M3-IMPLEMENTATION-REPORT.md` — M3's review **and** its primary
-  evidence record; no separate M3 baseline report was produced. M4 needs its
-  §W (closeout) and §M/§W.4 (the open browser smoke test).
+- `reports/M4-IMPLEMENTATION-REPORT.md` — M4's review and its evidence record.
 
-Completed earlier milestones are in `archive/milestone-reports/`. When M4's
-report lands, M3's moves there too: a milestone report is useful during the
-immediate next milestone and historical afterwards. **M3's report has not moved
-yet**, because M4's does not exist — the rotation belongs to M4's closeout, not
-to its implementation.
+Completed earlier milestones are in `archive/milestone-reports/`, which M3's
+report joined when M4's landed: a milestone report is useful during the
+immediate next milestone and historical afterwards. M3's is now at
+`archive/milestone-reports/M3-IMPLEMENTATION-REPORT.md`, unedited.
 
 ## The decision this package rests on
 
@@ -233,7 +230,7 @@ Milestone M2                        COMPLETE (2026-09-02)
         |
         v
 Milestone M3                        COMPLETE (2026-09-03)
-  non-destructive undo/redo,        reports/M3-IMPLEMENTATION-REPORT.md
+  non-destructive undo/redo,        archive/milestone-reports/M3-*.md
   active-head export                and ADR 012
         |
         v
@@ -253,8 +250,9 @@ action; M5 does not begin before that report is written and accepted.
 
 Two conditions remain open. The **browser smoke test has still not been
 performed** — now for M3 and for M4 — because no session so far has had a usable
-browser. See `reports/M3-IMPLEMENTATION-REPORT.md` §M and §W.4, and the M4 status
-block in `BUILD-MILESTONES.md`. And **no M4 review exists**: the status block was
+browser. See `archive/milestone-reports/M3-IMPLEMENTATION-REPORT.md` §M and §W.4,
+`reports/M4-IMPLEMENTATION-REPORT.md` §M, and the M4 status block in
+`BUILD-MILESTONES.md`. And **no M4 review exists**: the status block was
 written by the implementation and records what it built, which is not the same as
 a reviewer having read it.