Stop re-reading the whole prompt every turn, and let a lost run carry on

M01, the hundred-turn campaign, is the one REQUIRED test still
outstanding. Everything here is about it finishing, and being worth
believing when it does. No requirement changed, no acceptance test was
retired or relaxed, and M11 §P.1's "no performance requirement" still
stands: what changed is the cost of a turn, not what a turn contains.

An inference server caches a prompt by its prefix. The history window
gave up its oldest action every turn, which changed the prompt near the
front and threw that cache away, so nearly the whole prompt was
reprocessed every turn however little had actually changed. The window
now snaps the oldest depth to a block and holds it, stepping every few
turns. Measured on real builder output at an 8,192-token budget: 124.0s
per turn against 362.4s. The cost is history depth, bounded by
TRIM_FRACTION at a quarter of the window, which is the dial between
recent history and speed.

A run that dies no longer starts again from turn one. m11_long_run
checkpoints resume.json after the prologue, after every scheduled step
and after every turn, and --resume reattaches to the same campaign. A
finished run deletes it, so the file's presence means an unfinished run
and starting fresh over one is refused. The model timeout is an option
rather than a hard-coded 600s, a turn that overruns is a failed turn
instead of an unhandled exception that ends the run with no summary,
and a run that has stopped producing turns writes its evidence and
stops.

Two checks could not fail. M04's planted clue went into an add_fact
"detail" key that the event does not define, so it was dropped and
fact_still_in_state could never be true; it is now in "value" and
proved at turn one, which stops a run measuring nothing for hours.
m11_browser degraded silently without a narrator into two failures that
read exactly like a product regression, and now requires one, with
--no-narrator as an explicit opt-out that marks the run partial.

Window discovery speaks Ollama's native API, so against vLLM or
llama.cpp's own server the window goes unverified and the budget
uncapped -- M11's own failure mode reached by another route.
context_window_override lets the operator state what they launched the
server with, and is used only where discovery left a hole: a verified
window always wins, so a declaration can lower an unknown ceiling into
existence and never raise a known one. "verified" still means the
server answered, so window_verified in a turn's provenance keeps the
meaning M11's report counts on.

planning/README.md said the M11 tree was staged rather than committed,
in two places; it was committed and signed. Planning package v3.8.

Backend 1,376 passed, 17 skipped, 0 failed; frontend 161; lint and
build clean. Every M11 harness re-run on this tree: browser 38/0/0,
offline 23/0, identity clean, contrast unchanged, recovery 14/0 on a
small bundle. M01 itself has not been run.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E9LiyxBxnMTXV2wRjdyDGB

planning/VERSION.md

@@ -1,8 +1,49 @@
 # Planning Package Version
 
-- **Package:** Adventure Storyteller Planning Package v3.7
-- **Revision date:** 2026-09-07
-- **Status:** Phase 0 complete; architecture selected; **Milestones M1-M8 implemented and accepted**; **M9 and M10 implemented, M10 committed and signed**; **M11 implemented and verified, awaiting independent review/acceptance** (2026-09-07). M11 is the last planned milestone before v1 acceptance.
+- **Package:** Adventure Storyteller Planning Package v3.8
+- **Revision date:** 2026-09-10
+- **Status:** Phase 0 complete; architecture selected; **Milestones M1-M8 implemented and accepted**; **M9 and M10 implemented, M10 committed and signed**; **M11 implemented and verified, awaiting independent review/acceptance** (2026-09-07). M11 is the last planned milestone before v1 acceptance. M01, the 100-turn campaign, is the one REQUIRED test still outstanding.
+
+## v3.8 — Two gaps closed under M11's own rules, and the cost of a long turn (2026-09-10)
+
+No milestone, no requirement change, and no acceptance claim. Three pieces of
+work done while M01 was still outstanding: one hole in §15.2's guarantee, one
+stale statement of fact, and the reason a long campaign cost the same per turn
+however little had changed.
+
+| Document | Change | Kind |
+| --- | --- | --- |
+| `TECHNICAL-DESIGN.md` | **§15.2 gains "the server that cannot be asked"** — discovery speaks Ollama's native API, nothing restricts the endpoint to Ollama, and on any other server the window goes unverified and the budget uncapped. `Settings.context_window_override` lets an operator state it; a verified window always wins, so a declaration can lower an unknown ceiling into existence and never raise a known one. | as-implemented record |
+| `TECHNICAL-DESIGN.md` | **New §15.3** — the history window moves in blocks. What happens *at* §15.2's ceiling: a window that gave up its oldest action every turn changed the prompt near the front and cost a full re-read every turn. Records the two safety properties and that M11 §P.1's "no performance requirement" still stands. | as-implemented record |
+| `planning/README.md` | **Corrected**: said M11's tree was "staged rather than committed" in two places. It was committed and signed on `m11-release-validation` (`fedb714`); `main` is still M10. | correction |
+| `README.md`, `DEVELOPMENT.md` | The window override and how to set it; why a long campaign is not slow in proportion to its length, with the measurements. | developer docs |
+
+**The window a server will not tell you.** §15.2 makes the application ask the
+inference server what it will accept and cap itself to the answer. It asks over
+Ollama's *native* API — and nothing restricts `endpoint_url` to Ollama. Against
+vLLM, llama.cpp's own server, or anything else serving an OpenAI-compatible
+`/v1`, `/api/ps` and `/api/show` are simply absent, discovery fails as designed,
+and the budget stands uncapped at whatever is configured. §15.2's rule names
+Ollama because Ollama is what M8 measured; the failure it forbids is not
+Ollama's. The override closes that without weakening what `verified` claims:
+`verified` still means the server answered, so `window_verified` in a turn's
+provenance counts what M11's report says it counts, and a declared window is
+identifiable as a declaration everywhere it appears.
+
+**What a long turn was paying for.** An inference server caches a prompt by its
+prefix. The history window gave up its oldest action every turn, which changed
+the prompt near the front and discarded that cache, so nearly the whole prompt
+was reprocessed every turn regardless of how little had changed. The window now
+snaps to a block and holds, stepping every few turns. Measured against the
+reference deployment on real builder output, at an 8,192-token budget: **124.0s
+per turn against 362.4s** with the floor disabled. The cost is history depth —
+up to a block fewer actions right after a step — bounded by `TRIM_FRACTION` at a
+quarter of the window, which is the dial between recent history and speed.
+
+**Requirement changes: zero.** Nothing was retired, relaxed or reclassified.
+§15.3 records explicitly that M11 §P.1 declines to set a performance requirement
+and that this does not invent one: what changed is the cost of a turn, not what
+a turn must contain.
 
 ## v3.7 — M11 implemented: v1 security, long-run and release validation (2026-09-07)