v1.1: harden context window and narrator protocol boundary

WP-A1 and WP-A2, implemented in sequence, plus the corrective work the owner
asked for at review. Reported in
planning/reports/v1.1/V1.1-WP-A1-A2-REPORT.md (corrective addendum §R).
Planning package v4.2.

WP-A1: context-window safety reserve
- The prompt leaves max(256, ceil(5% of the effective window)) tokens free
  beside the reply. That is 256 at 4,096 and 820 at 16,384. The value is fixed,
  not a setting, and not calibrated per model.
- M6's 64-token margin is gone. Separators and the chat hint are priced
  exactly; tokenizer drift is the reserve's job.
- Protected context that cannot fit raises ContextOverflow before the model
  is called.
- Streams set stream_options.include_usage. Measured on Ollama 0.33, a stream
  sent no usage without it.
- Each sent turn records fits, exceeded, truncation_suspected or unknown.
  The status is returned on the done event, logged when bad, and shown in the
  context inspector. The turn is always kept.
- Accounting is per-attempt data (attempts.ATTEMPT_KEYS).
- Corrective: a cold model is loaded before its turn is built. When the
  window is unverified but the server answered, contextwindow.ensure_window
  makes one bounded POST /api/generate naming only the model. It sends no
  prompt, generates nothing and writes nothing. It then probes again, and the
  turn is built to that answer. If the load fails, or the window is still
  unknown, the turn falls back to the old behaviour.
- Real host, 4,096 window:
  - v1 cold turn: sent 13,875, the server read 2,050.
  - Same turn after the correction: the window was verified, 3,082 sent,
    3,097 read, fits, 499 tokens left beside the reply.
  - Verified turns elsewhere left 275-2,297 tokens against v1's 23-42.

WP-A2: protocol echo and genre-neutral state prompting
- The vocabulary is shown as the JSON object the model sends, not as
  name(field, ...). This costs 121 tokens.
- The example uses character-1, item-1 and location-1.
- The extractor removes shapes anchored to application-owned text:
  - a vocabulary call line;
  - an echoed length hint;
  - the renderer's scene line left last;
  - an empty fence opener.
- Corrective R5: the echoed continue hint is recognised by its own sentence
  ("Output only story text"). A Hard-limit-opened bracket is removed only
  directly above an echo already cut from the same reply.
- Replay of all 518 real v1 replies: 9 changed, 0 flagged, and no story prose
  removed. That is unchanged by R5.
- Replay of 64 v1.1 replies: 3 changed, 0 flagged. The depth-16 instruction
  tail is removed.
- Identity diagnostic after the correction:
  - 0 identity signals;
  - 0 prompt example identifiers proposed;
  - 0/10 stored turns with protocol or instruction shapes.
- 50-turn run: 51 accepted, 0 of 54 stored turns carry protocol.
- SPECS, render.py and validate.py are identical to v1.0.0.

Compatibility: a real v1.0.0 database reads identically on v1.0.0 and v1.1,
field for field, with schema and user_version 94 unchanged. Undo, redo, Save
Point restore, export and import all work on it. There is no schema,
migration or bundle-format change.

Verification: the backend suite passes 1,534 with 17 skipped and 0 failed.
The frontend passes 165/165, and lint and the build are clean. The offline
container and the browser regression were re-run on this tree (see §R.3).

One test was re-calibrated, not weakened: test_history_block_trim's prefix
test had assumed which turn holds the floor at a 2,048 budget.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VvegagkhuCZoFPdv4M1egY

backend/tools/v11_window_accounting.py

@@ -0,0 +1,211 @@
+"""v1.1 WP-A1: real turns, and what the server said it read.
+
+    AIDND_TEST_ENDPOINT=https://<host>:<port>/v1 AIDND_TEST_MODEL=<model> \\
+      .venv/bin/python -m tools.v11_window_accounting \\
+        --bundle "$HOME/m11-evidence/m04-final/bundle.json" --turns 4 \\
+        --out "$HOME/v11-evidence/a1-accounting/<label>"
+
+Run from `backend/`. The evidence that matters is at the edge of the window, and
+a new campaign takes dozens of turns to reach it. So this imports a long
+campaign, by default the v1 evidence run's 207-action bundle, and every turn is
+assembled against a full window from the first. A real narrator is then asked
+for `--turns` turns, and each one is written out with:
+
+    configured budget, verified window, and where the window came from
+    the application's estimate of what it sent (its count, plus the text the
+    provider adds)
+    the server's own prompt-token count, from the usage it reported
+    the reply allocation and the safety reserve
+    the observed margin: window - reply allocation - the server's count
+    the accounting status: fits, exceeded, truncation_suspected or unknown
+
+The first turn on a cold model cannot verify the window: `/api/ps` knows nothing
+until the model is loaded. That is M11's behaviour, and the row says so rather
+than hiding the turn.
+
+The database lives in `--out`, not in `/tmp`, so the stored snapshots behind
+every row can be read again. The endpoint is read from the environment and is
+never written into a committed file.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import sys
+import time
+from pathlib import Path
+
+ENDPOINT = os.environ.get("AIDND_TEST_ENDPOINT", "")
+MODEL = os.environ.get("AIDND_TEST_MODEL", "")
+
+TURNS = [
+    "I look around carefully and take stock of where I am.",
+    "I ask the nearest person what has happened since I was last here.",
+    "I check what I am carrying.",
+    "I move on towards the place I meant to reach.",
+    "I wait and listen.",
+    "I say, \"Tell me the part you left out.\"",
+]
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__.split("\n")[0])
+    parser.add_argument("--bundle", default="",
+                        help="a campaign bundle to import, so turns start at a full window")
+    parser.add_argument("--turns", type=int, default=4)
+    parser.add_argument("--budget", type=int, default=16384)
+    parser.add_argument("--max-output", type=int, default=500)
+    parser.add_argument("--timeout", type=int, default=900)
+    parser.add_argument("--out", required=True)
+    parser.add_argument("--unload-first", action="store_true",
+                        help="ask the configured server to unload the model before turn 1, "
+                             "so the first turn starts cold (the A1 corrective test)")
+    args = parser.parse_args()
+
+    if not (ENDPOINT and MODEL):
+        print("set AIDND_TEST_ENDPOINT and AIDND_TEST_MODEL")
+        return 2
+
+    out = Path(args.out)
+    out.mkdir(parents=True, exist_ok=True)
+    db_path = out / "accounting.db"
+    if db_path.exists():
+        print(f"{db_path} exists; choose a new --out")
+        return 2
+    os.environ["AIDND_DB_PATH"] = str(db_path)
+    os.environ.pop("AIDND_DATABASE_URL", None)
+    os.environ.pop("DATABASE_URL", None)
+
+    from fastapi import Depends
+    from fastapi.testclient import TestClient
+    from sqlalchemy.orm import undefer
+
+    from app import auth, limits, models
+    from app.database import Base, SessionLocal, engine, get_db
+    from app.main import app
+
+    limits.check_row_cap = lambda *a, **k: None
+    Base.metadata.create_all(bind=engine)
+    with SessionLocal() as db:
+        user = models.User(is_guest=False, email="accounting@example.com")
+        db.add(user)
+        db.flush()
+        db.add(models.Settings(
+            user_id=user.id, model=MODEL, endpoint_url=ENDPOINT, embedding_model="",
+            context_token_budget=args.budget, max_output_tokens=args.max_output,
+            model_timeout_seconds=args.timeout,
+        ))
+        db.commit()
+        user_id = user.id
+    app.dependency_overrides[auth.get_current_user] = (
+        lambda db=Depends(get_db): db.get(models.User, user_id)
+    )
+    client = TestClient(app)
+
+    if args.bundle:
+        bundle = json.loads(Path(args.bundle).read_text())
+        # The evidence campaign had its memory bank and auto-summarise on. Here
+        # they would only add post-turn model calls between the measured turns,
+        # on the same host, and fail noisily as the in-process client closes.
+        # This tool measures the turn's own prompt, which neither changes.
+        bundle["memoryBankEnabled"] = False
+        bundle["autoSummarize"] = False
+        imported = client.post("/api/adventures/import", json=bundle)
+        imported.raise_for_status()
+        adv = imported.json()["id"]
+    else:
+        created = client.post("/api/adventures", json={
+            "title": "Window accounting", "opening": "A quiet road at dusk."})
+        created.raise_for_status()
+        adv = created.json()["id"]
+
+    if args.unload_first:
+        # The configured endpoint only, under the same policy and TLS trust as a turn.
+        import asyncio
+        import httpx
+        from app import contextwindow, endpoints, tlstrust
+        reason = endpoints.rejection_reason(ENDPOINT)
+        if reason:
+            print(f"endpoint refused: {reason}")
+            return 2
+        base = contextwindow.native_base(ENDPOINT)
+        with httpx.Client(verify=tlstrust.ssl_context(), timeout=120) as http:
+            unloaded = http.post(f"{base}/api/generate", json={"model": MODEL, "keep_alive": 0})
+            resident = [m.get("name") for m in http.get(f"{base}/api/ps").json().get("models", [])]
+        contextwindow.cache_clear()
+        print(f"unload: HTTP {unloaded.status_code} {unloaded.text[:120]} | resident now: {resident}")
+
+    rows: list[dict] = []
+    timeline = (out / "turns.jsonl").open("a")
+    print(f"model {MODEL}, budget {args.budget}, reply {args.max_output}")
+    print(f"{'#':>2} {'status':22} {'window':>13} {'estimate':>8} {'server':>7} "
+          f"{'reserve':>7} {'margin':>7} {'sec':>5}")
+    for index in range(args.turns):
+        text = TURNS[index % len(TURNS)]
+        started = time.monotonic()
+        response = client.post(f"/api/adventures/{adv}/actions",
+                               json={"type": "do", "text": text})
+        seconds = round(time.monotonic() - started, 1)
+        error = None
+        if response.status_code != 200 or '"type": "error"' in response.text:
+            error = response.text[-400:]
+        with SessionLocal() as db:
+            action = (
+                db.query(models.Action)
+                .filter(models.Action.adventure_id == adv, models.Action.type == "ai")
+                .options(undefer(models.Action.context_snapshot))
+                .order_by(models.Action.id.desc()).first()
+            )
+            snapshot = (action.context_snapshot or {}) if action else {}
+        tokens = snapshot.get("tokens") or {}
+        window = snapshot.get("window") or {}
+        accounting = snapshot.get("accounting") or {}
+        row = {
+            "turn": index + 1,
+            "action_id": action.id if action else None,
+            "seconds": seconds,
+            "error": error,
+            "configured_budget": tokens.get("configured_budget"),
+            "effective_budget": tokens.get("budget"),
+            "window_verified": window.get("verified"),
+            "window_tokens": window.get("tokens"),
+            "window_source": window.get("source"),
+            "preflight_attempted": (window.get("preflight") or {}).get("attempted"),
+            "preflight_loaded": (window.get("preflight") or {}).get("loaded"),
+            "preflight_verified_before": (window.get("preflight") or {}).get("verified_before"),
+            "preflight_verified_after": (window.get("preflight") or {}).get("verified_after"),
+            "preflight_detail": (window.get("preflight") or {}).get("detail"),
+            "app_prompt_tokens": tokens.get("total"),
+            "transport_tokens": tokens.get("transport"),
+            "app_estimate": tokens.get("estimate"),
+            "output_reserve": tokens.get("output_reserve"),
+            "safety_reserve": tokens.get("safety_reserve"),
+            "server_prompt_tokens": accounting.get("server_prompt_tokens"),
+            "difference": accounting.get("difference"),
+            "observed_margin": accounting.get("observed_margin"),
+            "status": accounting.get("status"),
+            "history_included": (snapshot.get("history") or {}).get("included"),
+            "history_total": (snapshot.get("history") or {}).get("total"),
+        }
+        rows.append(row)
+        timeline.write(json.dumps(row) + "\n")
+        timeline.flush()
+        print(f"{row['turn']:>2} {str(row['status'] if not error else 'ERROR'):22} "
+              f"{str(row['window_tokens'])+('v' if row['window_verified'] else '?'):>13} "
+              f"{str(row['app_estimate']):>8} {str(row['server_prompt_tokens']):>7} "
+              f"{str(row['safety_reserve']):>7} {str(row['observed_margin']):>7} {seconds:>5}")
+        if error:
+            print(f"   error: {error[:200]}")
+    timeline.close()
+    (out / "summary.json").write_text(json.dumps({
+        "model": MODEL, "budget": args.budget, "max_output_tokens": args.max_output,
+        "bundle": args.bundle, "rows": rows,
+    }, indent=2))
+    app.dependency_overrides.clear()
+    return 0 if all(r["error"] is None for r in rows) else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())