M4: close out Save Points, with browser verification

Closes M4. The review's three findings are fixed, the durability rule the
specification always implied is now enforced, and M3's and M4's browser
behaviour has been verified in a real browser for the first time.

B-1 -- the Save Point list was an N+1 that loaded whole Action rows,
narration included, to answer "does a row exist here". It is now one bulk
two-column coordinate query plus one lineage: 53 SELECTs for 25 Save Points
became 5, and the count no longer grows with the list. The clause is an OR
of exact (branch, depth) pairs rather than two IN lists, because the cross
product would report a Save Point resolved on the strength of another one's
depth existing on this one's branch. A test builds exactly that trap.

B-2 -- reclassified during closeout from "missing warning" to a behaviour
defect, and fixed as one. STORY-BRANCH-SEMANTICS §19 says a named checkpoint
remains until explicitly deleted, and §28 already required future cleanup to
retain checkpoint-referenced paths; a cascade that silently removed Save
Points with a branch violated both, and a warning would only have documented
the violation. A branch a Save Point names can no longer be deleted. The
request is refused with the offending Save Points named, the user deletes
them explicitly -- which deletes no story -- and the branch then goes. The
scope is the subtree, because deleting a branch takes its descendants. Both
delete controls disable and explain. Recorded as a new §19.1; models.py,
TECHNICAL-DESIGN §8.8 and DATA-MODEL §8 had all recorded the cascade as the
rule and now record the refusal.

An earlier pass in this same closeout had kept the cascade and added a
warning. That was the wrong fix and its tests were replaced rather than left
standing, since they pinned the defect.

B-3 -- the D11/L03 automation never left one process, so it could not
distinguish durable state from a live Python object. It now spawns real
server processes, kills the first, and reads the campaign back with the
second.

C-5 -- creating a Save Point takes the campaign's turn lock. "Save where I
am" has to name one committed position, and the head is what a turn in
flight is about to move. Rename and Delete deliberately do not take it.

The architecture is untouched: a Save Point is still name + note +
(branch, depth), and restore is still coordinate -> head.move_to_node ->
head.move_to -> attempts.restore_state. No second restore path, no state
copied into a checkpoint, no fork on restore.

Browser verification -- the first in this project, and it covers both
milestones. Firefox 154.0.1 through geckodriver over the W3C WebDriver
protocol, driving the rendered DOM: 47/47 checks, twice, on independent
databases, no console errors. M3's Undo/Redo enable states, transcript
movement, Retry and the take pager, divergence retiring Redo; M4's whole
Save Point lifecycle, both confirmations, and the new branch-delete refusal
including its recovery. No dependency was added: the WebDriver client is
stdlib HTTP.

No application defect was found by the browser. Four failures occurred, all
in the harness -- a wrong SPA route, a wait comparing transcript length when
the empty-story placeholder is longer than the first turn, a fixture
deleting the branch it was reading, and a reload assertion that sampled
once instead of waiting. The last was checked against the app before being
called a harness bug.

Tests: 698 backend pass (was 680), 60 M4, 94 M3 history, 66 export/
migrations, 93 security/local-only. Frontend lint and build clean, Docker
build clean, loopback binding unchanged. No assertion weakened, no skip
added.

Planning: STORY-BRANCH-SEMANTICS §19.1 is the only behavioural change and it
strengthens §19. V1-ACCEPTANCE-TESTS records D11-D14, I04, L03 and the
E-series, keeping automated, live-runtime and browser evidence distinct, and
weakens no pass condition. DATA-MODEL records the coordinate with the retry
measurement that settles it. BROWSER-UX-SPEC rules for Moment over Turn.
BUILD-MILESTONES marks M4 COMPLETE, closes M3's browser condition, and lists
what M5 inherits. VERSION adds v2.6.

No new ADR: ADR 005 already decides that history is preserved rather than
overwritten, and §19.1 is that decision applied to checkpoint-referenced
history.

M4 is closed. M5 may now be briefed; it has not been started.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PWU4gTfLYY6Qq9U7aa9Qw2

planning/DATA-MODEL.md

@@ -230,6 +230,30 @@ It carries **no** copy of the transcript, the state, the prompt, a memory, a
 summary, or a branch's contents. Everything a restore produces comes from the
 retained history the coordinate points into.
 
+The retry case is what settles the coordinate-versus-turn-id question, and M4
+closeout measured it rather than arguing it. A Save Point named a turn whose
+live row was id 17; retrying that turn made id 17 dead and id 18 live at the
+same coordinate; the Save Point resolved to id 18 and restored correctly. A row
+id would have pinned a take the story no longer tells. **A Save Point names a
+story position, not a particular take of it.**
+
+Three further properties of the implemented model, recorded so they are decided
+rather than incidental:
+
+- **Names are not unique**, and nothing requires them to be. No product
+  requirement asks for uniqueness, and two names for one moment is a reasonable
+  thing for a player to want.
+- **Several Save Points may name the same position.** Same reason.
+- **Ordinary list presentation is newest-created first.** Story order is not
+  something the list can honestly claim: depths on lines that have parted
+  company are not comparable, so ordering by depth would draw a sequence that no
+  reading of the story passes through. When each was made is a fact about all of
+  them.
+
+None of this is genre-specific. A coordinate is a position in a story; what the
+state at that position *contains* is M5's question, and changing it does not
+change what a Save Point is.
+
 Two consequences worth recording here:
 
 - **Restore reuses the campaign's one head-movement mechanism.** It resolves the
@@ -238,11 +262,13 @@ Two consequences worth recording here:
   the path being read, which is what makes a Save Point on a departed line
   restorable at all — and what keeps a Save Point in a shared prefix from
   dragging the reader off the line they chose. See `TECHNICAL-DESIGN.md` §8.8.
-- **A checkpoint is durable against everything but its own deletion and its
-  branch's.** No pass removes one for going stale, sitting behind the head, or
-  naming a line the story left (`STORY-BRANCH-SEMANTICS.md` §19). Deleting a
-  branch removes its checkpoints by cascade, as it removes its memories, because
-  the story they named is gone.
+- **A checkpoint is durable against everything but its own explicit deletion.**
+  No pass removes one for going stale, sitting behind the head, or naming a line
+  the story left (`STORY-BRANCH-SEMANTICS.md` §19). Deleting a *branch* does not
+  remove one either: the deletion is refused while a checkpoint names any
+  position in the subtree, and the user deletes the checkpoint first
+  (§19.1). Deleting the whole campaign removes them, which is what deleting a
+  campaign means.
 
 ## 9. Narrative Entity