M4: close out Save Points, with browser verification

Closes M4. The review's three findings are fixed, the durability rule the
specification always implied is now enforced, and M3's and M4's browser
behaviour has been verified in a real browser for the first time.

B-1 -- the Save Point list was an N+1 that loaded whole Action rows,
narration included, to answer "does a row exist here". It is now one bulk
two-column coordinate query plus one lineage: 53 SELECTs for 25 Save Points
became 5, and the count no longer grows with the list. The clause is an OR
of exact (branch, depth) pairs rather than two IN lists, because the cross
product would report a Save Point resolved on the strength of another one's
depth existing on this one's branch. A test builds exactly that trap.

B-2 -- reclassified during closeout from "missing warning" to a behaviour
defect, and fixed as one. STORY-BRANCH-SEMANTICS §19 says a named checkpoint
remains until explicitly deleted, and §28 already required future cleanup to
retain checkpoint-referenced paths; a cascade that silently removed Save
Points with a branch violated both, and a warning would only have documented
the violation. A branch a Save Point names can no longer be deleted. The
request is refused with the offending Save Points named, the user deletes
them explicitly -- which deletes no story -- and the branch then goes. The
scope is the subtree, because deleting a branch takes its descendants. Both
delete controls disable and explain. Recorded as a new §19.1; models.py,
TECHNICAL-DESIGN §8.8 and DATA-MODEL §8 had all recorded the cascade as the
rule and now record the refusal.

An earlier pass in this same closeout had kept the cascade and added a
warning. That was the wrong fix and its tests were replaced rather than left
standing, since they pinned the defect.

B-3 -- the D11/L03 automation never left one process, so it could not
distinguish durable state from a live Python object. It now spawns real
server processes, kills the first, and reads the campaign back with the
second.

C-5 -- creating a Save Point takes the campaign's turn lock. "Save where I
am" has to name one committed position, and the head is what a turn in
flight is about to move. Rename and Delete deliberately do not take it.

The architecture is untouched: a Save Point is still name + note +
(branch, depth), and restore is still coordinate -> head.move_to_node ->
head.move_to -> attempts.restore_state. No second restore path, no state
copied into a checkpoint, no fork on restore.

Browser verification -- the first in this project, and it covers both
milestones. Firefox 154.0.1 through geckodriver over the W3C WebDriver
protocol, driving the rendered DOM: 47/47 checks, twice, on independent
databases, no console errors. M3's Undo/Redo enable states, transcript
movement, Retry and the take pager, divergence retiring Redo; M4's whole
Save Point lifecycle, both confirmations, and the new branch-delete refusal
including its recovery. No dependency was added: the WebDriver client is
stdlib HTTP.

No application defect was found by the browser. Four failures occurred, all
in the harness -- a wrong SPA route, a wait comparing transcript length when
the empty-story placeholder is longer than the first turn, a fixture
deleting the branch it was reading, and a reload assertion that sampled
once instead of waiting. The last was checked against the app before being
called a harness bug.

Tests: 698 backend pass (was 680), 60 M4, 94 M3 history, 66 export/
migrations, 93 security/local-only. Frontend lint and build clean, Docker
build clean, loopback binding unchanged. No assertion weakened, no skip
added.

Planning: STORY-BRANCH-SEMANTICS §19.1 is the only behavioural change and it
strengthens §19. V1-ACCEPTANCE-TESTS records D11-D14, I04, L03 and the
E-series, keeping automated, live-runtime and browser evidence distinct, and
weakens no pass condition. DATA-MODEL records the coordinate with the retry
measurement that settles it. BROWSER-UX-SPEC rules for Moment over Turn.
BUILD-MILESTONES marks M4 COMPLETE, closes M3's browser condition, and lists
what M5 inherits. VERSION adds v2.6.

No new ADR: ADR 005 already decides that history is preserved rather than
overwritten, and §19.1 is that decision applied to checkpoint-referenced
history.

M4 is closed. M5 may now be briefed; it has not been started.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PWU4gTfLYY6Qq9U7aa9Qw2

planning/README.md

@@ -3,10 +3,10 @@
 **This file is the index. Start here.**
 
 **Current state:** Phase 0 complete; AI-DnD forked as the production base;
-milestones **M1, M2 and M3 implemented and accepted** (M3: 2026-09-03).
-**M4 — named Save Points — is implemented (2026-09-03) and awaiting review.**
-Its implementation report has not been written, and writing it is the current
-action. Do not begin M5.
+milestones **M1, M2, M3 and M4 implemented and accepted** (M3 and M4:
+2026-09-03).
+**Next:** **M5 — Genre-Neutral Authoritative Narrative State.** Its brief has not
+been written yet, and writing it is the current action.
 
 **Package version:** see `VERSION.md`, which records what each revision changed
 and why.
@@ -234,9 +234,9 @@ Milestone M3                        COMPLETE (2026-09-03)
   active-head export                and ADR 012
         |
         v
-Milestone M4                        IMPLEMENTED 2026-09-03 —
-  named Save Points                 awaiting review; no report yet
-        |
+Milestone M4                        COMPLETE (2026-09-03)
+  named Save Points                 reports/M4-IMPLEMENTATION-REPORT.md
+        |                           browser verification: PASS (M3 + M4)
         v
 M5-M11, one at a time               see BUILD-MILESTONES.md
 ```
@@ -245,16 +245,17 @@ M5-M11, one at a time               see BUILD-MILESTONES.md
 
 **One milestone at a time. Do not begin a milestone before its brief exists.**
 
-**M4 is implemented and unreviewed.** Its implementation report is the current
-action; M5 does not begin before that report is written and accepted.
+**No M5 brief has been prepared.** Writing one is the current action, informed by
+the M4 report's §U readiness assessment and by the note `BUILD-MILESTONES.md`
+attaches to M5 — in particular that M4 added 55 tests using the inherited
+world-state values as deterministic instrumentation, which M5 must **move rather
+than delete**.
 
-Two conditions remain open. The **browser smoke test has still not been
-performed** — now for M3 and for M4 — because no session so far has had a usable
-browser. See `archive/milestone-reports/M3-IMPLEMENTATION-REPORT.md` §M and §W.4,
-`reports/M4-IMPLEMENTATION-REPORT.md` §M, and the M4 status block in
-`BUILD-MILESTONES.md`. And **no M4 review exists**: the status block was
-written by the implementation and records what it built, which is not the same as
-a reviewer having read it.
+**No conditions remain open on M1-M4.** The browser smoke condition that M3 and
+M4 both carried was satisfied at M4 closeout: a real Firefox exercised the
+rendered DOM for both milestones' controls, 44/44 checks passing. The M3 report's
+§M.2 and the M4 report's §M record the condition as it stood; the M4 report's §W
+records it closed.
 
 ## What each milestone closeout corrected