Planning v3.9: record M11's long-run evidence, and correct what v3.7 claimed

The planning package still described M01 as outstanding. It now records the
evidence run on 96c1bf5 and the two product defects found on the way. It also
corrects three statements that were never true.

- V1-ACCEPTANCE-TESTS.md: result blocks for M01-M04. M04 is recorded as
  recovered through authoritative state, with the owner's acceptance of that on
  2026-09-13 and the positional precondition explained.
  Correction: v3.7 said this file carried M11 results against every REQUIRED
  test. None were written, and the per-test matrix is the M11 report's §F. The
  §P3 M11 disposition said the report records the identity diagnostic's
  findings. It does not, and the disposition now says so.
- BUILD-MILESTONES.md: the M11 status block records the long-run evidence,
  the write-lock and protocol-leak defects, and what is left for the reviewer.
- DATA-MODEL.md §28B: M11 added two columns, not one.
  settings.context_window_override (migration 94, ef25b0a) was never
  recorded.
- TECHNICAL-DESIGN.md: "Background failure observability" gains the rule
  that nothing in a turn writes before the model call, and new §15.4 records
  that stored narration carries story only, with the extractor's rules.
- CONTEXT-AND-MEMORY.md §51 and ADR 013: as-implemented notes for the same
  two fixes.
- README.md and VERSION.md: status, milestone map, stop rule, and the v3.9
  entry.
- M11 report §Q: the "not revised" note is replaced by what v3.9 revised.

No requirement changes. No code changes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0136VBTMUKWYeU6G9HgbDbND

planning/DATA-MODEL.md

@@ -886,15 +886,14 @@ never becomes canon (`MEDIA-EXTENSION-CONTRACT.md` §35, §37).
 
 ## 28B. What M11 Added (as implemented)
 
-One column, and one field on a response. Both exist because something that was
+Two columns, and one field on a response. Each exists because something that was
 happening silently had to become visible.
 
 ```text
 adventures.narration_length   "" | "brief" | "medium" | "long"
 ```
 
-The campaign's own narration-length choice, and the *only* schema change M11
-makes. Until M11 the choice became one English sentence inside
+The campaign's own narration-length choice (migration 93). Until M11 the choice became one English sentence inside
 `ai_instructions` and moved no number: the numeric hint the model actually reads
 was derived from the global reply cap and said the same thing for all three
 settings. Stored as its own field because the prompt builder has to derive a
@@ -904,6 +903,17 @@ it is a campaign that never chose, which is exactly what every campaign created
 before M11 did, so the migration needs no backfill and no existing prompt
 changes under it.
 
+```text
+settings.context_window_override   INTEGER | NULL   (migration 94, post-M11)
+```
+
+The window an operator says the inference server enforces, for a server the
+window probe cannot ask, meaning anything that does not speak Ollama's native
+API. It is nullable and null by default, because a default number would be the
+application guessing at a window, which is the one thing `contextwindow` refuses
+to do. It never overrides a window the server reported. It was added in `ef25b0a`
+and not recorded here until 2026-09-14; `TECHNICAL-DESIGN.md` §15.2 has the rule.
+
 **No new table.** The context-window ceiling M11 enforces is *not* stored: it is
 asked of the server, cached in the process, and recorded in the turn's context
 snapshot as provenance. A stored ceiling would be a second copy of a fact the