interactive-story/planning/reports/v1.1/V1.1-WP-A1-A2-REPORT.md

# v1.1 WP-A1 and WP-A2 — Implementation and Verification Report

**Work packages:** WP-A1 (context-window safety reserve) and WP-A2 (protocol-echo
cleanup and genre-neutral state prompting), authorised together and implemented
in that order. They are reported separately throughout.

**Status:** COMPLETE, including the owner-requested corrective work (§R). Staged,
uncommitted, for the owner's signed commit (2026-09-14). **Final decisions: §R.6.**
WP-A1: PASS. WP-A2: PASS.

---

## A. Repository baseline

| | |
| --- | --- |
| Branch | `v1.1-development` |
| Starting commit | `ac465ed` — *Planning v4.1: record the v1.0.0 release, and plan v1.1*, signed by the owner (`%G?` = `G`) |
| Its parent | `432f041`, the signed v1.0.0 release commit; tag `v1.0.0`; `main` and `origin/main` |
| Working tree at start | clean; nothing staged, nothing unstaged, nothing untracked |
| Planning baseline | committed before any product change, so it is not in this diff |

**Baseline backend suite, before any change** (the untouched `ac465ed` tree,
`python -m pytest tests/ -q`, no `AIDND_TEST_*` set): **1,421 passed, 17 skipped,
0 failed**, 865 s. This matches the v1 closeout's count exactly.

---

## B. WP-A1 implementation

### B.1 What the code did before, answered from the code

| Question | Answer on `ac465ed` |
| --- | --- |
| 1. What defines the effective context window? | `contextwindow.effective_budget(configured, window)`, which is `min(context_token_budget, window.tokens)` when a window is enforceable (verified by `/api/ps` or `/api/show`, or declared through `context_window_override`), and the configured budget otherwise. |
| 2. Where is the fixed 64-token margin applied? | `context/builder.py`: `OUTPUT_SAFETY_MARGIN = 64`, added to `max_output_tokens` as `output_reserve`. That is subtracted with the protected sections before any knowledge or history is priced. |
| 3. How is `max_output_tokens` reserved? | Inside that same `output_reserve`. |
| 4. Which components are protected? | Every system section (narrator prompt, state rule, campaign canon, always-include Canon and the knowledge rule, AI instructions, persona, plot essentials), plus the summary, retrieved memories, narrative state, author's note, front memory, length hint, refusal note and state reminder. |
| 5. Where is history trimmed? | `build_context`: `history.window_covering`, then `history_floor` and `trim_block` (§15.3), then newest-first until `history_budget` is spent. Knowledge is chosen before history, out of its own share. |
| 6. What counts tokens before the request? | `cl100k_base` from the vendored table (`context/encoding.py`), through `builder.count_tokens`. |
| 7. Which response fields give the real prompt-token count? | `usage.prompt_tokens` in the OpenAI-compatible response. **Measured on Ollama 0.33, a stream sends no `usage` unless `stream_options.include_usage` is set.** Chat and completion modes both report it once asked, and non-streaming requests always do. |
| 8. Where is that metadata persisted? | `snapshot["usage"] = provider.last_usage` in `turns.py`, inside the turn's compressed `context_snapshot`. Because streams were never asked, **none of the 514 AI turns in the v1 evidence databases has a stored usage**. |
| 9. Can the status live in provenance without a migration? | Yes. `context_snapshot` is a compressed JSON column, and the per-action context route returns it whole. |
| 10. What happens if protected context alone is too large? | `ContextOverflow` is raised before the model call. The turn route yields it as a turn error, and the dry-run route returns 422. Nothing is written. |

### B.2 What the 64 tokens were, and what replaced them

M6's comment gave the margin two jobs:
- absorb "the separators between sections" that are added after the arithmetic;
- absorb "the difference between our tokenizer's count and the serving model's".

The first job is not drift. It is application text nobody priced: `SEPARATOR`
joins between sections, and `CHAT_CONTINUE_HINT`, which the provider appends to
every chat request. v1.1 prices it exactly as `tokens.transport`:

- one separator per system section and per story section slot
  (`STORY_SECTION_SLOTS = 11`), which over-counts by at most two;
- plus the hint.

The second job is what the reserve now does. The reply allocation is exactly
`max_output_tokens`. Nothing is double-counted: the 64 tokens are gone, and
each of their two jobs has one owner.

### B.3 The reserve

`contextwindow.safety_reserve(effective_budget) = max(256, ceil(effective_budget × 5 / 100))`.
The rounding is up, to a whole token, in integer arithmetic.

| Effective window | Reserve |
| --- | --- |
| 4,096 | 256, because 204.8 is below the floor |
| 5,120 | 256, exactly 5% |
| 8,192 | 410, from 409.6 |
| 16,384 | 820, from 819.2 |
| 32,768 | 1,639, from 1,638.4 |

It follows the *effective* budget. A 16,384 setting against a 4,096 server
reserves 256. It is not a setting, and it is not calibrated per model.

Protected context is `sections + transport + max_output_tokens + reserve`.
`ContextOverflow` now names each part, and keeps the M11 advice sentence when
the server's window is what binds.

### B.4 Accounting after the reply

`contextwindow.classify_usage(usage, estimate, budget, max_output_tokens, window_verified)`.
`estimate` is `tokens.estimate`: the assembled text plus what the provider adds
(the chat hint, or the completion separator). The checks run in this order:

| Status | Condition | What it means |
| --- | --- | --- |
| `unknown` | no positive integer `prompt_tokens` | Nothing can be said. Never reported as `fits`. |
| `truncation_suspected` | `server + reserve < estimate` | The server read fewer tokens than were sent, by more than the drift tolerance. This is the measured shape of an over-window prompt: 6,316 sent, 2,050 read. |
| `exceeded` | `server + max_output_tokens > budget` | The drift used up the whole reserve, so the reply may be cut short. |
| `fits` | otherwise | The server read the whole prompt. |

The record also carries `server_prompt_tokens`, `difference` (server minus
estimate), `observed_margin` (`budget - reply - server`), `safety_reserve`,
`window_verified` and a sentence of detail.

**Why `exceeded` is measured against the hard edge and not the reserve line.**
On prompts that fit, the server counted 13 tokens more than the application,
which is chat-template overhead. A full prompt built exactly to the reserve line
would then read as "exceeded" on every turn. The reserve is the tolerance, so
using part of it is `fits` with a smaller `observed_margin`. Using all of it is
`exceeded`.

**Surfacing.**
- The record is stored as `snapshot["accounting"]`, so it is available for every
  past turn.
- It is returned on the turn's `done` SSE event.
- `exceeded` and `truncation_suspected` are logged at WARNING.
- The context inspector shows the safety margin on every turn, and the
  accounting for a turn that was sent. The two bad states are a `role="alert"`
  notice that says the turn is kept.

**The turn is kept.** Accounting happens after the reply has streamed, and it
changes nothing about whether the turn commits.

### B.5 Files

| File | Change |
| --- | --- |
| `backend/app/contextwindow.py` | `SAFETY_RESERVE_FLOOR`, `SAFETY_RESERVE_PERCENT`, `safety_reserve`; the `FITS` / `EXCEEDED` / `TRUNCATION_SUSPECTED` statuses; `classify_usage` |
| `backend/app/context/builder.py` | `OUTPUT_SAFETY_MARGIN` removed; `transport`, the reserve, and an exact reply allocation; `ContextOverflow` names each part; the report gains `transport`, `safety_reserve` and `estimate` |
| `backend/app/providers/openai_compatible.py` | `STREAM_OPTIONS = {"include_usage": True}` on all four streaming bodies |
| `backend/app/routers/adventures/turns.py` | `snapshot["accounting"]`, a WARNING log, and `accounting` on the `done` event |
| `frontend/src/pages/Play/panels/ContextPanel.jsx`, `frontend/src/styles/context.css` | the safety-margin line and the accounting notice |
| `backend/tools/m11_long_run.py` | the timeline records the turn's accounting from the `done` event |
| `backend/tools/v11_window_accounting.py` | **new**: the real-model accounting harness (§D) |
| `planning/TECHNICAL-DESIGN.md` §15.2, `DEVELOPMENT.md`, `README.md` | as-implemented notes. The README's stale Screenshots paragraph and test count are corrected, as the v1.1 plan asked |

No schema change, no migration, and no bundle-format change.

---

## C. WP-A1 tests

`tests/test_v11_context_reserve.py`, new:

| Criterion | Tests |
| --- | --- |
| A1-1 reserve calculation | `test_the_reserve_is_the_larger_of_the_floor_and_five_percent_rounded_up` (1,024; 4,096; 5,120; 5,121; 8,192; 16,384; 32,768), and `…far_larger_than_the_v1_margin…` |
| A1-2 budget enforcement | `test_the_prompt_leaves_the_reply_and_the_reserve_free`, on the **assembled text plus the chat hint**, for verified 4,096, 8,192 and 16,384, a declared 6,000, and an unverified configured 12,000, each against a 120-turn story. Also `test_the_report_prices_the_text_the_provider_adds` and `test_the_reserve_follows_the_effective_window_not_the_setting` |
| A1-3 protected overflow | `test_protected_context_that_only_fits_without_the_reserve_fails_explicitly`: a canon grown until v1's 64-token margin would still have built the prompt and the 256-token reserve does not. Also `test_an_overflowing_turn_never_reaches_the_model`: the scripted provider is called **0** times and no AI action is written |
| A1-4 no silent canon dropping | the canon sentinel is asserted present in every A1-2 configuration while the history gives way. M11's `test_the_canon_at_the_front_survives_a_window_far_too_small` and its negative control still pass |
| A1-5 accounting | `test_a_prompt_the_server_read_in_full_fits`; `test_a_turn_records_what_the_server_read`, end to end, including the `done` event |
| A1-6 unknown | `test_no_usable_count_is_unknown_never_fits`: None, `{}`, no `prompt_tokens`, 0, a string and a negative value. Also `test_a_turn_with_no_reported_usage_is_unknown` |
| A1-7 discrepancy recorded and visible | `test_a_suspected_truncation_keeps_the_turn_and_says_so` (snapshot, `done` event, WARNING log, and the per-action context route); `test_a_server_that_read_far_less…`; `test_a_small_undercount_is_tokenizer_drift_not_truncation` (reserve minus 1 is `fits`, reserve plus 1 is suspected); `test_a_server_that_counts_more…_is_exceeded` |
| A1-8 turn preserved | `test_a_suspected_truncation_keeps_the_turn_and_says_so`, `test_an_exceeded_turn_is_also_kept` |
| request | `test_the_stream_asks_the_server_to_report_its_usage`, in chat and completion modes |
| each take's own accounting (added after the A2 long run; §N.2 item 7) | `test_each_attempt_keeps_its_own_accounting_when_the_live_flag_moves`, on `keep_own_slices` and `hand_over_the_prompt`. `test_a_retry_leaves_each_take_with_its_own_accounting`, end to end through `POST /retry`: the superseded take keeps its `fits` and no prompt; the live take keeps the prompt and its own `truncation_suspected` |

The file has 35 tests: 33 at the A1 checkpoint, plus the two added above.

Frontend, `panels.test.jsx`, four new tests: the safety margin is shown; nothing
is shown for a turn not yet sent; `truncation_suspected` is an alert naming both
counts; `unknown` makes no claim that the prompt fitted.

**One existing test changed.** It is a fixture calibration, not a weakened
assertion.

- **The failure.** `test_history_block_trim.py::test_the_story_prompt_keeps_its_prefix_across_a_new_turn`
  asserted that the *next* turn after its fixture holds the history floor. Its
  budget is 2,048 tokens, where the reserve is 256, or 12.5% of the window. The
  history budget fell from 1,186 to 969: the reserve's extra 192 over the old
  margin, plus 25 tokens of transport. The block is 2 on both trees. The traces:

  ```text
  turn     v1.0.0 floor     v1.1 floor
  <60           54               54
  <61           54               56    <- v1.1 steps here, v1.0.0 one turn later
  <62           56               56    prefix kept 0.906
  <63           56               58
  <64           58               58    prefix kept 0.906
  ```

- **The judgement.** Same cadence and same step size, offset by one turn. §15.3's
  property holds, and only the fixture's choice of turn moved.
- **The change.** The test now walks forward until a turn holds. It requires every
  move on the way to be exactly one block, and asserts the prefix on the held
  pair. A window that slides by one action every turn fails it exactly as
  before, and its negative-control companion is unchanged.

---

## D. WP-A1 real-model evidence

**Harness:** `tools/v11_window_accounting.py`, on the A1 tree, with no source edit
during the run.

**Inference:** the trusted-LAN CPU reference host. It runs Ollama 0.33.0 over
HTTPS, with a private CA in this machine's OS trust store and verification on.

**Campaign:** the v1 evidence run's own bundle (`m04-final/bundle.json`, 207
actions), imported so that every turn is assembled against a full window. Memory
bank and auto-summarise are off, because they would only add post-turn calls on
the same host.

**Settings:** configured budget 16,384, `max_output_tokens` 500.

**Evidence:** `$HOME/v11-evidence/a1-accounting/`.

### D.1 The 4,096-window reference configuration (`qwen2.5:3b-instruct`, no `num_ctx`)

| Turn | Window | Effective budget | App estimate | Server `prompt_tokens` | Difference | Reserve | Observed margin | Status |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| 1 | **not verified** (model not resident) | 16,384 (configured) | 13,875 | **2,050** | −11,825 | 820 | — | **`truncation_suspected`** |
| 2 | 4,096, verified (`loaded`) | 4,096 | 3,294 | 3,309 | +15 | 256 | **287** | `fits` |
| 3 | 4,096, verified | 4,096 | 3,253 | 3,268 | +15 | 256 | **328** | `fits` |
| 4 | 4,096, verified | 4,096 | 2,831 | 2,846 | +15 | 256 | **750** | `fits` |

"Observed margin" is `window − reply allocation − the server's count`. The v1
evidence's equivalent at the largest prompts was 23-42 tokens.

**Turn 1 is the most important row in this section.** The model was not
resident, so `/api/ps` could not report its window. M11's rule for that case
leaves the configured 16,384 standing and records the window as unverified. The
application sent 13,875 tokens. The server loaded the model at its 4,096 default,
kept 2,050 of them, and answered HTTP 200. That is the silent truncation M8 found
and M11 set out to prevent, still reachable on a cold model's first turn.
v1.0.0 would have stored this turn with no record of it. A1 recorded
`truncation_suspected`, logged a warning ("The server read 2,050 prompt tokens of
the 13,875 sent…") and kept the turn. §N records the cold-model gap itself as a
finding.

**Turns 2-4:** the window was verified and the budget capped to it. The server
counted exactly 15 tokens more than the application on every turn: chat-template
overhead the application cannot see. That used 15 of the 256-token reserve, and
each turn kept 287 tokens or more beside the reply.

*One harness note.* The bundle carried the evidence campaign's memory bank
setting, so turn 1's post-turn memory pass ran and failed as the in-process
client closed (`derived memory work failed`). It is a failure in the harness,
outside the turn and outside what is measured. The tool was then changed to
switch memory and auto-summarise off before importing. The 16,384 run below used
the changed tool.

### D.2 The 16,384-window configuration (`qwen2.5:3b-instruct-16k`, `num_ctx` 16,384 baked in)

| Turn | Window | Effective budget | App estimate | Server `prompt_tokens` | Difference | Reserve | Observed margin | Status | Seconds |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| 1 | 16,384, verified (`parameters`) | 16,384 | 13,875 | 13,890 | +15 | 820 | **1,994** | `fits` | 1,028 |

The first run was **stopped after turn 1 at the owner's request**, because the
shared inference host was needed by another project. One turn took 17 minutes on
the CPU host. A second run of three turns was started when the host was released
(§D.3).

The window was verified from the model's own `num_ctx`, so even a cold model had
a ceiling. The prompt held 60 of 120 history actions. The server again counted 15
tokens more than the application. That left 1,994 tokens beside the reply,
against 23-42 in the v1 evidence at the same window and the same model.

### D.3 16,384 window, second run

Started when the host was released, with the A1 code loaded at process start
and before any A2 edit.

| Turn | Window | Effective budget | App estimate | Server `prompt_tokens` | Difference | Reserve | Observed margin | Status | Seconds |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| 1 | 16,384, verified (`parameters`) | 16,384 | 13,875 | 13,890 | +15 | 820 | 1,994 | `fits` | 1,058 |

**The run was stopped deliberately after turn 1** (10:03 EDT), to free the shared
host for WP-A2's real-model runs. Each 16k turn took about 17.6 minutes on the CPU
host, and the two remaining turns would have delayed A2's 50-turn run by more than
half an hour.

**Read this row as a reproduction, not a second sample.** Both 16k runs imported
the same campaign, so turn 1 assembled the same prompt. The identical counts show
that the measurement is repeatable. They add no new prompt shape. The prompts that
grow and change across many turns are measured at 16,384 by the integrated v1.1
release run (plan §11). In this report, the prompts that change turn by turn are
the 4,096 rows in §D.1 and the A2 long run in §J.

### D.4 What the evidence shows

| Criterion | Result |
| --- | --- |
| A1's tolerance is materially larger than v1's margin | At 16,384: 1,994 tokens left beside the reply, against 23-42. At 4,096: 287 or more. The reserve is 820 and 256. |
| Real drift between the counters | +15 tokens on every turn measured, at both windows. That is 6% of the smaller reserve and 2% of the larger. |
| Disagreement is observable | Every sent turn carried a server count and a status. A real cold-model truncation was caught, recorded and logged, and the turn was kept. |

---

## E. WP-A1 interim decision

**A1 RESULT: PASS.**

Recorded at the checkpoint before any WP-A2 product code was written.

- **A1-1 to A1-9** pass on the A1 tree:
  - backend suite **1,454 passed, 17 skipped, 0 failed** (the 1,421 baseline plus
    33 new);
  - frontend **165 of 165**;
  - lint clean apart from the six warnings the v1 closeout already had.
- **A1-10** passes on real-model evidence. At 4,096 there are four turns,
  including a real `truncation_suspected`. At 16,384 there is one verified turn,
  with the second run pending (§D.3).
- **One existing test was re-calibrated**, not weakened (§C). The failure was the
  fixture's choice of turn. §15.3's property was unaffected, and the v1.0.0 and
  v1.1 traces show it.
- **A1-only checkpoint** saved outside the repository, so A1 can be reviewed on
  its own:
  - `a1-tracked.patch`, sha256 `3b5d679f…`;
  - `a1-untracked.tgz`, sha256 `78275d0f…`.

**Later corrective work on A1, found after this checkpoint.** The A2 long run
exposed a defect in A1: a retried or reselected take lost its accounting, or was
shown another take's. It was fixed with two tests (§N.2 item 7). The fix is one
line in `attempts.py`, plus the two tests. The A1-only checkpoint patch above
predates it. The final staged tree includes it. This interim PASS stands on
A1-1 to A1-10 as written, and §O records the decision after the fix.

**Carried to §N, not corrective work for A1:** the cold-model first turn. When
the window cannot be verified, M11 builds to the configured budget. A1 now makes
the resulting truncation visible, but does not prevent it. Preventing it means a
policy change: build conservatively, or refuse to send, when the window is
unknown. That is outside A1's authorised scope ("do not implement model-specific
dynamic calibration"; "preserve the accepted turn") and is the owner's decision.

---

## F. WP-A2 implementation

Begun only after §E was recorded. The A1-only checkpoint was saved first, so A1
can still be reviewed on its own.

| File | Change |
| --- | --- |
| `backend/app/narrative/events.py` | `vocabulary_for_prompt` shows each event as the JSON object to send, not as `name(field, …)`. `_PLACEHOLDER` holds the neutral placeholders. `SPECS` is unchanged, verified against `v1.0.0` by diff. |
| `backend/app/narrative/extract.py` | `EMIT_RULE`'s example now uses `character-1`, `item-1` and `location-1`. `LENGTH_HINT_OPENING` and `LENGTH_HINT_TAIL` are shared with the builder. R1-R4 and `RULE_*` added (§H). `_clean(…, after_block=)`. `explain_removed_line` added for the replay. |
| `backend/app/context/builder.py` | `length_hint` builds its opening and tail from the shared constants. The hint text is byte-identical to v1.0.0. |
| `backend/tools/m11_long_run.py` | The leak count also detects call lines and echoed hints. |
| `backend/tools/v11_replay_extractor.py` | **New**: the historical replay (§I). |
| `backend/tools/v11_compat_check.py` | **New**: the v1.0.0-database compatibility check (§K). |
| `backend/tests/test_v11_protocol_echo.py` | **New**: prompt, observed shapes, adversarial prose, rule attribution. |
| `planning/TECHNICAL-DESIGN.md` §15.4, `DECISIONS/013` | As-implemented notes. |

Unchanged: no event type, field, reference rule or validation. The fence protocol,
proposal recording, history replay and schema are also untouched.

**Two corrections made during A2, before its evidence was taken.**

1. **Misplaced docstring paragraphs.** The new paragraphs in `extract._clean` and
   `events.vocabulary_for_prompt` were first placed after each docstring's
   closing quotes, so the modules did not import. Collection failed at once and
   nothing ran; the paragraphs were moved into the docstrings.
2. **The first vocabulary form cost too much.** `"<key>"`-style placeholders with
   spaced separators took the vocabulary from 258 to 456 tokens and `EMIT_RULE`
   from 467 to 690. That pushed protected context in an existing budget test
   (2,048 tokens with an 800-token reply cap) to 2,055. It also left an
   imported-knowledge fixture with no room to retrieve anything. Both failures
   were real consequences of the prompt growth, not faulty tests. The full-suite
   run that found them was stopped as void, and the form was changed to compact
   JSON with ellipsis placeholders (§G). Both tests pass unchanged on the final
   form, and no test was edited to accommodate it.

---

## G. Prompt changes

### G.1 Semantic before and after

| | v1.0.0 | v1.1 |
| --- | --- | --- |
| How the vocabulary is shown | `set_possession(item, owner) — gives an item to an owner`, a call notation that is not the wire format | `{"type":"set_possession","item":"…","owner":"…"} — gives an item to an owner`, the object itself |
| Optional fields | `name(field, optional?)` | ` (optional: description, aliases)` after the summary |
| List-valued fields | not distinguished | shown as `["…"]` |
| Identifier guidance | "short lower-case slugs (mara, silver-key, old-abbey)" | "short lower-case slugs … the example's identifiers are placeholders" |
| Worked example | `silver-key` owned by `aldric`, who is at `old-abbey` | `item-1` owned by `character-1`, who is at `location-1` |
| Length hint | unchanged text | unchanged text, built from shared constants |
| Reminder, canon, state rendering | unchanged | unchanged |

### G.2 Cost

| | v1.0.0 | v1.1 | Change |
| --- | --- | --- | --- |
| `events.vocabulary_for_prompt()` | 258 tokens | 378 | +120 |
| `EMIT_RULE` (which includes the vocabulary) | 467 | 588 | **+121** |

`EMIT_RULE` sits in the static system block, so it is priced once into the cached
prefix and into protected context on every turn. At a 4,096 window, +121 tokens is
about 3% of the window, and it comes out of the history. The cheapest option
measured was a plain `name: fields` list at 274 tokens. It was rejected because it
is not the wire format, and because a copy of it in prose is not a proposal the
extractor can recognise and remove. A copied JSON line is.

### G.3 Guard against reintroduction

`test_v11_protocol_echo.py` covers the following:
- **Fixture identifiers.** No identifier from either acceptance fixture, and no
  genre noun, appears in `EMIT_RULE`, `EMIT_REMINDER`, the vocabulary, or any
  length hint.
- **The worked example.** It is a block the extractor accepts, with allowed
  event types.
- **Call notation.** No vocabulary line is a call.
- **Line shape.** Every line parses as the object, with exactly the required
  fields.
- **Hint wording.** The length hint carries the constants the extractor
  recognises.

---

## H. Cleanup rules (WP-A2)

### H.0 The evidence the rules were designed from

Before any extractor change, the whole v1 corpus was scanned. That covers every
AI turn in every evidence database under `$HOME/m11-evidence`, plus the exported
bundles. Stored text and stored raw replies were counted separately, and
duplicates were removed by content hash. The scan counted the candidate shapes,
and the near-misses a rule must not touch.

| Shape | Unique stored texts | Where |
| --- | --- | --- |
| A line opening with a vocabulary call | 4 | All four closeout identity turns (depths 10, 12, 14 and 20). |
| A vocabulary call anywhere | 4 | The same four lines. The corpus has no call in the middle of a sentence. |
| `[Hard limit` anywhere | 3 | See the three cases below. |
| A rendered `Scene: … (at …)` as the last line | 1 | Closeout browser-run3 action 3, **stored by the v1.0.0 product tree**. |
| `Scene:` lines anywhere | 62 | Mostly pasted state sections from runs taken before M11's `0c7316f` fix. The v1.0.0 extractor already handles those, and the replay (§I) starts from the raw reply. |

The three `[Hard limit` cases:
- **Identity depth 14:** the application's length hint, reworded at the front.
- **m04-rerun action 151:** the hint's own words, with the last sentence
  replaced by "This story ends here." An empty dangling ```` ```json ```` fence
  follows it.
- **browser-recheck2 action 5:** "[Hard limit: I have adhered to the prescribed
  limit of words. Here's the narrated turn and the state update. Send your next
  action.]" The model **invented** this; it is not application text.

### H.1 The rules

Each rule is anchored to something the application owns: the event vocabulary,
the length hint's wording, or the renderer's scene-line format. None of them
judges prose.

**R1 — event-call line** (`RULE_EVENT_CALL`)

| | |
| --- | --- |
| Source | `events.vocabulary_for_prompt` printed every event as `name(field, …)`, and the narrator copied the notation. |
| Matcher | A whole line that starts with a name in `events.SPECS` (case-insensitive) followed by `(`. Indentation and a leading `>` are allowed before the name, and spaces before the `(`. The whole line is removed, including anything after the call on that line, such as depth 20's "Adds the silver key…". Lines inside a fenced code block are never examined. |
| Rationale | `create_entity`, `set_possession` and the rest are this protocol's snake_case identifiers. A story line that *starts* with one of them followed by `(` is protocol. |
| False-positive defence | Not applied in the middle of a sentence (the engineer's whiteboard). Not applied to call-shaped lines whose name is not in the vocabulary (`> open_door(north)`). Not applied inside a story's own code block. Not applied to a vocabulary word with no `(` ("Create_entity is a terrible name"). |

**R2 — echoed length hint** (`RULE_LENGTH_HINT`)

| | |
| --- | --- |
| Source | `builder.length_hint`. Its opening `[Hard limit:` and its closing sentence are now named constants shared with the extractor (`LENGTH_HINT_OPENING`, `LENGTH_HINT_TAIL`). |
| Matcher | A bracket at the end of the reply, closed or cut off; the existing trailing loop already isolates it. Its contents must start with `Hard limit:` **and** carry the application's own wording: either the tail phrase "append the state block", or "turn must not exceed *N* words". The check goes in `_is_echoed_instruction`, beside the reminder and continue-hint checks M11 already has. |
| Rationale | Both phrases are the application's instruction text. The 3B narrator reworded the front ("your next turn") and kept the rest. |
| False-positive defence | Only a whole bracket at the end of the reply is removed. These all stay: "[Hard limit: 500 words]" read aloud mid-sentence; an in-world "[Hard limit of the reactor…]"; a final "[Hard limit: forty days, no extensions]". **The model's invented bracket in browser-recheck2 action 5 also stays**, because it carries neither phrase. That is a deliberate miss. |

**R3 — rendered scene line** (`RULE_SCENE_LINE`)

| | |
| --- | --- |
| Source | The first line of `render.for_prompt`: `Scene: <summary>`, plus ` (at <location>)` when the scene has a location. |
| Matcher | After the other trailing cuts, the reply's last line starts with `Scene: ` and meets one of two conditions. Either it ends in the renderer's `(at <location>)`, or protocol was also cut from the end of the same reply (a block, a hint, a call line or a dangling fence). |
| Rationale | The `(at …)` suffix is the renderer's syntax. Without it, a lone scene line directly above removed protocol belongs to the same pasted tail. |
| False-positive defence | Never removed mid-reply: "Scene: a kitchen, late." followed by story stays, and so does M11's existing "Scene: the docks at dawn." case. A screenplay-style last line, "Scene: take two, and nobody moves.", stays when nothing else was removed. **Accepted risk:** a story whose last line exactly imitates `Scene: … (at …)` loses that line. |

**R4 — empty dangling fence** (`RULE_EMPTY_FENCE`)

| | |
| --- | --- |
| Source | A reply that hit the output limit after opening ```` ```json ```` and before writing anything (m04-rerun action 151). |
| Matcher | A ```` ```json ```` or bare ```` ``` ```` opener as the reply's last line, with nothing after it. |
| Rationale | M11's `_is_opening_of_proposal` already cuts a dangling fence that stopped after `{`, on the principle that "a story's own code block is not that short, and one that is holds nothing to lose". An empty opener holds even less. |
| False-positive defence | Applies only when nothing at all follows the opener. A dangling fence with any content keeps M11's existing judgement. |

### H.2 What is deliberately not removed

- A fact restated inside a sentence (§P risk 4). Removing it would mean judging
  prose.
- Model-invented headings that are not the renderer's (§P risk 6).
- Model-invented brackets that carry no application phrasing (browser-recheck2
  action 5).
- Prose that follows a removed call line, even when it narrates the call ("You
  create a new person, Mike, who has", identity depth 12). It is narration,
  however poor.

---

## I. Historical replay

**Tool:** `tools/v11_replay_extractor.py`, on the final A2 extractor.

**Inputs:** every AI turn in the 17 evidence databases under `$HOME/m11-evidence`,
plus the closeout identity run's bundle. A turn is replayed from its stored
`raw_output` where one exists, so the comparison starts from what the narrator
actually sent. The identity bundle carries only stored text; for those turns the
v1.0.0 prose is the input itself.

**Comparison:** each input goes through the extractor **as tagged at `v1.0.0`**,
read with `git show`, and through the v1.1 extractor. Lines are compared with
trailing whitespace ignored.

**Evidence:** `$HOME/v11-evidence/a2-replay/replay.json` (sha256 `f04c54ff…`) and
`replay.md`, which holds the full v1.0.0 and v1.1 prose for every changed turn.

| | |
| --- | --- |
| Unique replies replayed | **518** (6 exact duplicates skipped) |
| Unchanged | **509** |
| Changed | **9** |
| Flagged (an unexplained removal, text added or rewritten, or more than 25% removed) | **0** |
| Removed lines by rule | R3 scene line 6, R1 event call 4, R2 length hint 2, R4 empty fence 1 |

The planning pass estimated about 453 turns; the actual count is 518. The
difference is the trial, browser and recheck databases, which the v1 figure of
443 did not count.

### I.1 Every changed turn

| # | Source | Removed | Rule | Share of prose removed | Review |
| --- | --- | --- | --- | --- | --- |
| 1 | browser-final action 3 (raw) | `Scene: Aldric and Mara by the fire in the Crooked Lantern (at The Crooked Lantern).` | R3 | 13.1% | The rendered scene line, directly above a ```` ```json ```` proposal in the raw reply. **Protocol.** |
| 2 | closeout browser-run3 action 3 (raw), **stored by the v1.0.0 product tree** | `Scene: Aldric and Mara by the fire in The Crooked Lantern. (at The Crooked Lantern)` | R3 | 20.7% | The same, in the renderer's exact form. **Protocol.** |
| 3 | m04-rerun action 151 (raw) | `Scene: Aldric and Mara in the Crooked Lantern, rain outside.`; `[Hard limit: this turn must not exceed 180 words, … This story ends here.]`; ```` ```json ```` | R3, R2, R4 | 11.9% | A pasted scene line, the application's length hint with its last sentence reworded, and a proposal opener the output limit cut off. **Protocol.** |
| 4 | m04-rerun action 153 (raw) | `Scene: Aldric and Mara in the Crooked Lantern, rain outside.` | R3 | 3.1% | The scene line directly above a ```` ```json ```` proposal. One trailing space was also trimmed from the story line before it; no word changed. **Protocol.** |
| 5 | m04-rerun action 157 (raw) | `Scene: Aldric and Mara in the Crooked Lantern, rain outside.` | R3 | 2.8% | The scene line directly above ```` ```json\n{ ````. **Protocol.** |
| 6 | identity depth 10 (stored) | `> Create_entity(new_person, "john", "character", "A determined team member …", ["jo…` | R1 | 6.4% | A call cut off mid-argument by the output limit. **Protocol.** |
| 7 | identity depth 12 (stored) | `> Create_entity(new_person, "mike", "character", "A new team member …", ["mike"])` | R1 | 4.8% | The call. The narration after it ("You create a new person, Mike, who has") is **kept**. **Protocol.** |
| 8 | identity depth 14 (stored) | `> Create_entity(mike, …)`; `Scene: Bill, Alice, Roger, John, and Mike at the table; John not yet arrived. (at The meeting room)`; `[Hard limit: your next turn must not exceed 180 words, … append the state block well inside the limit.]` | R1, R3, R2 | 23.4% | The whole pasted tail: the call, the rendered scene line, and the reworded length hint. **Protocol.** |
| 9 | identity depth 20 (stored) | `> set_possession(silver-key, "alice") Adds the silver key to Alice's possession.` | R1 | 4.1% | The call, with the fantasy example slug and a gloss on the same line. **Protocol.** |

**Genuine prose lost: none.** Each of the 13 removed lines is application
protocol or instruction text: a vocabulary call, the length hint, the renderer's
scene line, or an empty fence opener. On a line that also carried narration, only
depth 20's same-line gloss went with the call; that gloss describes the call, not
the story.

**A replay-tool defect, found and fixed before this result.** The first replay
flagged turn 4 as "text rewritten". The trailing space trimmed from the story line
was compared as a changed line. The tool now ignores trailing whitespace and says
why. The flag was the tool's, and no rule changed as a result.

---

## J. WP-A2 real-model evidence

**Inference:** the trusted-LAN CPU reference host. It runs Ollama 0.33.0 over
HTTPS with a private CA and verification on, and serves `qwen2.5:3b-instruct` at
a verified 4,096 window. Embeddings are `nomic-embed-text`. The storyteller was
on loopback.

**Tree:** the final A2 extractor and prompt. The full backend suite passed on
this tree before the long run was allowed to start. The launcher enforced that
gate.

### J.1 Multi-character identity diagnostic

The office meeting fixture (`TEST-CAMPAIGN-FIXTURE.md` Appendix A), 10 beats,
memory off. Evidence: `$HOME/v11-evidence/a2-identity`.

| | v1 closeout (§S.5 of the M11 report) | v1.1 |
| --- | --- | --- |
| Turns accepted | 10 of 10 | 10 of 10 |
| Identity signals | 0 | **0**; verdict "no objective identity defect detected" |
| Proposals naming an example identifier from the fixed prompt | 1 (`silver-key` given to Alice) | **0**. No `silver-key`, `aldric`, `mara` or `old-abbey`, and none of the new placeholders either |
| Proposal outcomes | 1 applied, 5 without a block, 3 unparseable, 1 refused | **10 accepted, 1 rejected** |
| Stored turns with a shape R1-R4 targets | 4 of 10 (depths 10, 12, 14, 20) | **0 of 10** |
| Stored turns with any echoed application instruction | 4 of 10 | **1 of 10**: depth 16, below |

**A leak A2 does not remove.** Depth 16 kept this tail at the end of the story:

```text
Scene: Bill, Alice and Roger at the table; John not yet arrived.

[Hard limit: this is now 180 words.]

[Reminder: end your reply with a `state` block listing the events your narration made true, with absolute values.]

[You don't need to continue; your turn must now be about John entering the room. Continue the story here, directly. Output only story text.]
```

The trailing cleanup works from the end upwards, and the last bracket is not
recognised: it is a reworded continue hint, and the recogniser matches that hint
only by its opening words. So the reminder above it is never at the end, the
reworded length hint carries none of the application's wording, and the scene
line is never last. **This is the conservative design behaving as documented. It
is still a real leak, on 1 of 10 turns.** The harness's leak counter did not see
it: it looks for proposals, pasted headings, calls and the hint's own wording,
not reminders. It was found by reading the stored narration. A narrow follow-up
is in §N.

### J.2 The 50-turn long run

`tools/m11_long_run.py --turns 50`: the fantasy Continuity Test with the full
schedule of history operations and the memory bank on. Evidence:
`$HOME/v11-evidence/a2-long-run`.

| | |
| --- | --- |
| Status | `complete`; no aborted reason, no failed reason |
| Accepted turns | **51**: 50 scheduled and the recall turn |
| Wall clock | 9,324 s. A turn took 47-243 s, median 165 |
| Genuine process restarts | 3, each compared `identical: true` |
| History operations performed | 2 Save Points, Undo/Redo, 2 retries, undo then divergence, take selection, a Save Point restore, and an induced failed call (HTTP 404; state unchanged) |
| Post-turn failures | **0**. 0 tracebacks and 0 `database is locked` in `server.log` |
| Memories and summaries written | 15 memories (9 in the bank at the end); 5 summaries |
| **Protocol leakage** | **0 of 54 stored AI turns**, by the extended harness count (headings, `"events"`, call lines, the echoed hint). A separate scan of every stored turn for reminders, `[Hard limit`, continue-hint wording, calls, a final `Scene:` and `"events"` also found 0 |
| **Parser failures** | 6 proposals `unparseable`, out of 56 recorded |
| **Refused proposals** | 0 |
| **State updates from narration** | 4 events accepted from story (50 proposals accepted, most with an empty events list); 9 more from the harness's manual corrections |
| **Legitimate prose removed** | **none.** All 64 raw replies from this run and the identity run were replayed through the v1.0.0 and v1.1 extractors. One changed: a trailing ```` ```json ```` opener with nothing after it (R4, 0.4% of that reply). 0 flagged |
| M04-style recall | `recovered_through_state_only`, which is WP-B's subject and unchanged from v1 |

**A1 accounting across the run.**

| | |
| --- | --- |
| Window | verified at 4,096 on 51 of 51 turns |
| Status | **`fits` on 51 of 51** |
| Server count minus the application's estimate | **+15 on every turn** |
| Largest server prompt | 3,321 tokens |
| Observed margin beside the reply | 275 minimum, 620 median, 2,297 maximum, against a 256 reserve |

**A defect the long run exposed, fixed in A1 (§N.2 item 7).** Three of the 54
stored AI turns had no accounting: the two retried takes and the take superseded
by a take selection. `attempts.ATTEMPT_KEYS` lists the snapshot slices that
belong to one attempt, and A1 had not added `accounting` to it. When the live
flag moved, the new live take was handed the old take's accounting with the
shared prompt, and its own was discarded. The long run's numbers above come from
the `done` events and are unaffected. It was the *stored* accounting of a
retried turn that could be wrong.

### J.3 Genre fixtures (A2-8)

| Fixture | How | Result |
| --- | --- | --- |
| Fantasy Continuity Test | the 50-turn long run, real model | 0 example identifiers proposed. The fixture's own `silver-key` is legitimately its entity |
| Multi-Character Identity Test (office) | the identity diagnostic, real model | 0 proposals naming any prompt example identifier (v1: 1) |
| Persephone science fiction | `test_m11_scifi.py`, 10 tests, scripted | passes; no genre noun in any fixed instruction (`test_v11_protocol_echo.py`) |

**Not run:** science fiction against a real narrator. No harness drives that
fixture with a real model, and adding one was out of A2's scope.

### J.4 What this does not replace

This is not the integrated v1.1 release run (plan §11). That run covers 100
turns, the 16,384 window, and the GPU host with the owner's logging.

---

## K. Compatibility

### K.1 A real v1.0.0 database opens unchanged

**Source database:** `m04-final/campaign.db`, the v1 evidence run's own campaign.
It was written by `96c1bf5`, whose product code is identical to v1.0.0, and holds
`user_version` 94. Its contents:
- 207 actions on 4 branches, with retained history;
- 2 Save Points and 32 state events;
- 33 memories and 12 summaries;
- 3 imported knowledge sources, one campaign narration-length choice, and
  settings.

**Method:** `tools/v11_compat_check.py`. The database was copied, and each copy
opened by one tree:
- `v100`: the `v1.0.0` tag, from a scratch worktree;
- `v11-readonly`: the v1.1 tree.

Each tree's app was verified by the path it was imported from. The same read-only
snapshot was taken through the API for both:
- the full export bundle (which carries no timestamp of its own);
- narrative state and state events;
- Save Points, knowledge, memories and derived status;
- the newest actions and settings;
- the schema and `user_version` before and after opening.

| Comparison | Result |
| --- | --- |
| Schema before opening, v1.0.0 against v1.1 | **identical** |
| Schema after opening | **identical**; `user_version` 94 → 94 on both, so no migration ran |
| API snapshot | **identical, field for field** |

### K.2 The same database, exercised on v1.1

`--exercise`, on a third copy, with the endpoint first pointed at a refused
loopback port so nothing left the machine:

| Operation | Result |
| --- | --- |
| Undo | 119 → 117 moments; Redo becomes available |
| Redo | back to 119; Redo no longer available |
| Restore Save Point *On the ridge* | 69 moments, with Redo available into the later story |
| Context dry run | HTTP 200. One imported passage retrieved. The campaign canon and narrative state sections are present. The summary that applies (moments 49-64) is included. Budget 16,384: 14,577 prompt + 28 transport + 500 reply + 820 reserve = 15,925. The window is recorded as unverified, because the server was unreachable by design. |
| Export, then import into the same install | 207 → 207 actions, the same head depth, Save Points 2 → 2, memories 33 → 33, narrative state identical |

**Not exercised here, and why.** Writing a new memory or summary needs a model
and an embedding model. The real-model long run in §J writes both on the v1.1
tree. Memory *retrieval* with embeddings is covered the same way. No
data-migration path was needed, and none was added.

---

## L. Security and offline

### L.1 What the diff adds, measured against `v1.0.0`

`git diff v1.0.0` over `backend/app` and `frontend/src`, searched for any new
network or remote-resource use. The search covered `httpx`, `requests`, `urllib`,
`socket`, `aiohttp`, literal URLs, `fetch(`, `XMLHttpRequest` and
`tiktoken.get_encoding`.

| Check | Result |
| --- | --- |
| New network client, destination or URL | **none** |
| New imports in product code | `math`, `json`, `logging`, and one internal constant (`providers.openai_compatible.CHAT_CONTINUE_HINT`) |
| Remote or cloud token counting | **none**. The count is the vendored `cl100k_base`, as before. The server's own count arrives in the response the turn already receives |
| Calibration service | **none**. Calibration was not built |
| The one request-level change | `stream_options: {"include_usage": true}` in the body of the request already sent to the already-approved endpoint. It adds no destination and no data about the user |
| Endpoint policy (`endpoints.py`, ADR 011) | unchanged; the file is not in the diff |
| Probe policy (`contextwindow._ask`) | unchanged; A1 added pure functions beside it |
| Storyteller bind | unchanged; `docker-compose.yml`, `Dockerfile` and the start scripts are not in the diff |

### L.2 Regression runs

- **The endpoint-policy and local-only tests pass in the backend suite (§M):**
  `test_m11_security.py` (H-series, including a public endpoint refused at
  request time), `test_egress.py`, `test_local_only_surface.py` (loopback
  publication), `test_m11_context_window.py` (the probe held to the policy).
- **Trusted-LAN inference still works.** Every real-model turn in §D and §J
  went to the trusted-LAN host over HTTPS, with a private CA and verification on.
- **The offline container passed 23 of 23.** It ran `tools/m11_offline.py` on the
  final tree, with `--network none`, a fresh volume, and an image built with
  `docker build --no-cache`. The checks are the same 23 as the v1 closeout:
  - no route and no DNS;
  - first page load, no remote origin, a CSP, and every asset local;
  - campaign creation, state extraction, knowledge import, prompt assembly and
    retrieval;
  - a turn with no model reachable is reported, with no narration accepted,
    the player's words kept, state unchanged and the earlier story intact;
  - export and import with no secret;
  - the media module inert;
  - campaigns survive a container restart.

  The evidence is `$HOME/v11-evidence/offline/offline-report.json`. The A1
  accounting path is exercised offline by the failed-turn check: a turn that
  never reaches a model writes no accounting, because it commits nothing.

---

## M. Full test results

Every backend command below is `.venv/bin/python -m pytest tests/ -q` from
`backend/`, with no `AIDND_TEST_*` set. The 17 skips are the tests that need a
real local model, the same 17 as the v1.0.0 closeout. **No new skip was
introduced.** The three real-model skips in the targeted runs are those same
tests.

| Run | Tree | Result |
| --- | --- | --- |
| Backend, baseline | untouched `ac465ed` | **1,421 passed, 17 skipped, 0 failed**, 866 s |
| Backend, A1 checkpoint | A1 only; the not-yet-implemented A2 test file excluded | **1,454 passed, 17 skipped, 0 failed**, 835 s |
| Backend, A2 first full run | A2 with the first vocabulary form | **stopped and discarded.** Two budget failures, §F |
| Backend, A1 + A2 | before the take-accounting fix | **1,505 passed, 17 skipped, 0 failed**, 786 s |
| **Backend, final** | **A1 + A2 + the take-accounting fix: the staged tree** | **1,507 passed, 17 skipped, 0 failed**, 792 s |
| New tests | `test_v11_context_reserve.py` (35) and `test_v11_protocol_echo.py` (51) | all pass |
| Frontend | A1 (A2 changes no frontend file) | **165 of 165**, 14 files |
| Lint | A1 | exit 0, six `only-export-components` warnings, the same six as the v1 closeout |
| Production build | final | clean. 16 files, `index-rWgm40jJ.js` 394.47 kB, `index-BXtb0iME.css` 48.09 kB |
| Offline container, `--network none`, `docker build --no-cache` | A1 + A2, before the take-accounting fix | **23 passed, 0 failed** (§L.2) |
| Offline container, repeated | **final**, after the take-accounting fix | **23 passed, 0 failed**, from a fresh `--no-cache` image (`$HOME/v11-evidence/offline-final`) |
| Identifier scan of every changed and new file | final | no real hostname, address, domain or personal name |

---

## N. Findings

### N.1 Blockers

*None found.*

### N.2 Corrective work, done within the packages

1. **A1: `stream_options` was required, not optional.** The provider's
   docstring said `stream_options` was "deprecated and does nothing", which is
   true of OpenRouter. Against Ollama 0.33 a stream sends no `usage` without it,
   and none of the 514 v1 evidence turns stored a count. Without the fix, A1's
   accounting would have read `unknown` on every real turn.
2. **A1: one test's fixture re-calibrated** (§C). The history-floor prefix test
   had assumed which turn holds the floor. Behaviour was unchanged.
3. **A2: the first vocabulary form was too expensive** (§F, §G). It grew
   protected context by 223 tokens and failed two existing budget tests. It was
   replaced by compact JSON (+121); the tests pass unchanged.
4. **A2: module syntax.** Two docstring paragraphs were misplaced. Collection
   failed immediately, and they were corrected before any evidence was taken.
5. **Harness: the replay tool compared trailing whitespace** (§I), which
   produced one false "rewritten" flag. Fixed.
6. **Harness: the accounting tool imported the bundle's memory setting** (§D.1).
   That caused failing post-turn calls on the shared host. Fixed before the 16k
   runs.
7. **A1: a retried or reselected take lost its accounting, or showed another
   take's.**
   - **Where it was found:** after the A2 long run. Three of 54 stored AI turns
     had no `accounting`, and they were exactly the two retries and the take
     selection.
   - **Cause:** `attempts.ATTEMPT_KEYS` lists the snapshot slices that belong to
     one attempt, and A1 had not added `accounting` to it. It was therefore
     treated as part of the shared prompt. `hand_over_the_prompt` gave the new
     live take the old take's accounting, and discarded its own.
   - **Fix:** `accounting` added to `ATTEMPT_KEYS`, with a unit test and an
     end-to-end retry test (§C).
   - **Exports:** none needed a change. A snapshot travels whole.
   - **Migrations:** none. v1.0.0 turns have no accounting to move, and
     `migrations._ATTEMPT_KEYS` is a frozen historical copy, left as it is.
   - **Evidence:** the long run's accounting figures in §J come from the `done`
     event of each turn and are unaffected. The full backend suite and the
     offline container were re-run after the fix (§M).

### N.3 Non-blocking residual risks

1. **Cold-model first turn: truncation is detected, not prevented** (§D.1).
   When `/api/ps` cannot see the model and `/api/show` finds no `num_ctx`, M11
   builds to the configured budget. On a server whose real window is smaller,
   the first turn is silently cut. It was observed for real: 13,875 sent, 2,050
   read. A1 now records it, logs it and shows it. Preventing it needs a policy
   decision, which is the owner's and outside A1's scope. The two options are to
   build conservatively when the window is unknown, or to warm the model and
   probe again before the first turn.
2. **The drift measured is one model's.** +15 tokens against `cl100k_base`, for
   `qwen2.5:3b-instruct` in both window sizes. A model whose tokenizer diverges
   by more than 5% will show up as `exceeded`, not as silent truncation. The
   reserve is a tolerance, not a guarantee.
3. **`exceeded` and `truncation_suspected` depend on the server reporting
   usage.** A server that ignores `include_usage` produces `unknown` on every
   turn. That is honest, but it detects nothing.
4. **R3's accepted false-positive risk.** A story whose last line exactly
   imitates the renderer's `Scene: … (at …)` loses that line (§H).
5. **Protocol still left in stored narration, deliberately:**
   - model-invented brackets that carry no application wording;
   - model-invented headings;
   - facts restated inside a sentence.

   **One real v1.1 turn shows the cost** (§J.1, identity depth 16). A reworded
   continue hint was the last line of the reply, so nothing above it became
   trailing. The application's reminder, a reworded length hint and a scene line
   all stayed.

   **Narrow follow-up, not done here.** Recognise `CHAT_CONTINUE_HINT` by its
   distinctive application phrase "Output only story text", not only by its
   opening words. The reminder above it would then come off by the existing
   rule. The reworded hint, with none of the application's wording, and the
   scene line would still stay.

   **Why it was not done.** It would have been an extractor change after the
   long-run evidence was taken, and it needs its own replay. This is the owner's
   decision.
6. **A2 costs 121 tokens of protected context** (§G.2). At 4,096 that is about
   3% of the window, and it comes out of history.
7. **A2's real-model run is on the CPU host at 4,096, not the v1 evidence
   configuration.** v1 used 16,384 on the GPU host. On the CPU host a full 16k
   prompt took 17 minutes a turn, and a GPU-host long run requires the owner's
   power, link and kernel logging to be started first
   (`gpu-host-logging-before-long-runs`). The integrated v1.1 release run
   (plan §11) is where 16,384 is re-established.

### N.4 Future ideas

- **A cold-model policy for the first turn**, as in N.3 item 1.
- **Summarising the accounting across a campaign**, for example "3 of 120 turns
  suspected". Today the inspector shows it one turn at a time.
- **Showing the accounting status as a chip under the narration**, not only in
  the context inspector. This is browser work, for WP-C.

---

## O. Final A1 decision

**A1 RESULT: PASS.**

The final decision is taken on the staged tree, including the take-accounting
fix found after the interim checkpoint (§N.2 item 7).

| Criterion | Result | Evidence |
| --- | --- | --- |
| A1-1 Reserve calculation | PASS | `max(256, ceil(5%))`: 256 at 4,096, 410 at 8,192, 820 at 16,384; 7 windows tested (§B.3, §C) |
| A1-2 Budget enforcement | PASS | assembled text, provider hint, reply and reserve are within the effective window in 5 configurations (§C) |
| A1-3 Protected overflow | PASS | fails before the model call; the provider is called 0 times and nothing is written (§C) |
| A1-4 No silent canon dropping | PASS | the canon sentinel is present in every configuration while history gives way (§C) |
| A1-5 Post-response accounting | PASS | real: 51 of 51 long-run turns, 4 turns at 4,096 and 2 at 16,384 carry a server count and a status (§D, §J) |
| A1-6 Unknown accounting | PASS | no usable count gives `unknown`, never `fits` (§C) |
| A1-7 Unexpected discrepancy visible | PASS | a **real** `truncation_suspected` on a cold model: 13,875 sent, 2,050 read. It was stored, logged, sent on the `done` event and shown in the inspector (§D.1) |
| A1-8 Accepted turn preserved | PASS | the turn is kept for `truncation_suspected` and for `exceeded`; after a retry, each take keeps its own accounting (§C) |
| A1-9 Existing behaviour | PASS | 1,507 passed, 0 failed. One fixture re-calibrated, not weakened (§C) |
| A1-10 Real-model verification | PASS | at 4,096, 275-2,297 tokens left beside the reply across 55 turns; at 16,384, 1,994. Drift is +15 on every turn, against v1's 23-42 tokens of headroom (§D, §J) |

**Carried as residual risk, not failure:** the cold-model first turn is detected,
not prevented. Preventing it is a policy decision for the owner (§N.3 item 1).

## P. Final A2 decision

**A2 RESULT: PASS, with one recorded residual.**

| Criterion | Result | Evidence |
| --- | --- | --- |
| A2-1 Genre neutrality | PASS | no fantasy or science-fiction identifier and no genre noun appears in any fixed instruction; a test guards against reintroduction (§G.3) |
| A2-2 Protocol clarity | PASS | the vocabulary is the wire-format object, not call notation. +121 tokens, the smallest wire-format form measured (§G) |
| A2-3 Observed leaks | PASS | all four v1 shapes are removed (§H). What is deliberately left is documented, including one real v1.1 occurrence (§J.1, §N.3 item 5) |
| A2-4 Historical corpus safety | PASS | 518 real replies replayed, 9 changed, 0 flagged, **no story prose removed**. A further 64 replies from the v1.1 runs gave 1 changed, 0 flagged (§I, §J.2) |
| A2-5 Adversarial prose | PASS | the owner's four sentences and nine more survive untouched (§C of the A2 tests, `test_v11_protocol_echo.py`) |
| A2-6 State extraction | PASS | a valid block still parses and applies when protocol litter surrounds it. `SPECS`, `render.py` and `validate.py` are identical to v1.0.0 (§F, §K) |
| A2-7 Invalid proposals | PASS | the validator is byte-identical and the existing refusal tests pass; the long run recorded 0 refusals and 6 unparseable proposals (§J.2) |
| A2-8 Genre fixtures | PASS | fantasy by real model (51 turns); office identity by real model (10 turns, 0 example identifiers against v1's 1); science fiction scripted only, which is stated (§J.3) |
| A2-9 Real-model sample | PASS | 51 accepted turns: 0 of 54 stored turns carry protocol, 6 parser failures, 0 refused, 4 story state events, no prose removed, and A1 accounting `fits` 51 of 51 (§J.2) |

**The residual.** In the identity run, 1 of 10 stored turns kept a trailing tail
of echoed instructions: a reworded continue hint, the reminder, a reworded length
hint and a scene line. The conservative design cannot see past the reworded last
line. §N.3 item 5 records a narrow follow-up, which is the owner's decision.

## Q. Recommendation

- **A1 is ready for acceptance.** It meets every criterion on real evidence,
  including a real silent truncation it caught.
- **A2 is ready for acceptance, with the residual in §P noted.** The owner may
  want the narrow continue-hint follow-up (§N.3 item 5) first. It would be a small
  extractor change with its own replay. It does not block acceptance of what A2
  set out to do.
- **Owner decisions this report raises:**
  1. Accept or correct A1.
  2. Accept A2, or ask for the continue-hint follow-up first.
  3. Whether the cold-model first turn (§N.3 item 1) needs a prevention policy,
     and where that policy belongs: an A1 follow-up, or a later package.
- **WP-B may begin once A1 and A2 are accepted.** Nothing in either package blocks
  B's diagnosis. A1's accounting and A2's cleaner prose are both in place for B's
  long runs. **WP-B has not been started.**

**Git state:** everything is staged and uncommitted for the owner's signed commit.
Nothing was committed, pushed or tagged. A suggested commit message was prepared
outside the repository.

---

## R. Corrective-work addendum (owner review, 2026-09-14)

The owner accepted A1 and A2 in principle, and asked for two corrective items to
be closed before the commit. §O-§Q above record the decisions as they stood
before this addendum. **§R.6 supersedes them.**

### R.1 WP-A1: preventing the cold-model truncation

**The case, as A1 caught it (§D.1, turn 1):**
- `/api/ps` knew nothing, because the model was not resident.
- `/api/show` found no `num_ctx`, so the window was unverified.
- The prompt was built to the configured 16,384.
- Ollama loaded the model at its 4,096 default, read **2,050 of 13,875** tokens,
  and answered HTTP 200.

**Mechanism, measured before it was built.** This was measured on Ollama 0.33
on the trusted-LAN host, with the model first unloaded (`keep_alive: 0`) and
`/api/ps` empty.

| Step | Observed |
| --- | --- |
| `POST /api/generate {"model": "qwen2.5:3b-instruct"}`, with no prompt | HTTP 200 in 3.7 s, `"response": ""`, `"done_reason": "load"`. **Nothing was generated.** |
| `/api/ps` afterwards | the model is listed with `context_length` 4,096 |
| An OpenAI-compatible streamed request afterwards | no reload: `/api/ps` still reads 4,096, and `prompt_tokens` was the estimate plus 13 |

**What was built.**
- `contextwindow.Window` gains `reachable`: the server answered a discovery
  request, whatever it said.
- `contextwindow.warm(endpoint, model, timeout)` sends one `POST {native base}/api/generate`
  with the body `{"model": model}`. There is no prompt, no `options` and no
  `keep_alive`. It goes through `endpoints.rejection_reason` and
  `tlstrust.ssl_context()`, and it never raises.
- `contextwindow.ensure_window(endpoint, model, declared, warm_timeout)` does
  the following:
  1. It probes. A verified window is returned untouched.
  2. If the window is unverified, the server was reachable, and a model is
     configured, it warms once.
  3. If the load succeeds, it probes again with `use_cache=False`.
  4. It returns the window and a `preflight` record (`attempted`, `loaded`,
     `verified_before`, `verified_after`, `detail`).
- `turns._generate_turn` calls `ensure_window` in place of `probe`, with the
  settings' model timeout as the bound. It stores
  `snapshot["window"]["preflight"]`. The context dry run still only probes:
  loading a model from a read-only panel would be a side effect.

**What is unchanged.**
- A window still unverified leaves the configured budget standing.
- There is no guessed window, no hard-coded 4,096, and no retry loop.
- The accounting still classifies the reply.

**The constraints the owner set, each checked:**
- no calibration and no user setting;
- no endpoint-policy change;
- only the configured endpoint is contacted;
- no dummy narration is generated or accepted;
- no accepted turn is discarded.

**Tests:** `tests/test_v11_cold_window.py`, 15 tests.

| Required | Test |
| --- | --- |
| cold model, then preflight, then a verified smaller window, then the real turn built to it | `test_a_cold_model_is_loaded_once_and_its_window_verified` (request order `/api/ps`, `/api/show`, `/api/generate`, `/api/ps`; the load body exactly `{"model": …}`). `test_a_cold_turn_is_built_to_the_window_the_loaded_model_reports`, end to end: budget 4,096, verified, the canon sentinel present, the assembled text plus transport, reply and 256-token reserve within 4,096 |
| negative control | `test_without_the_load_the_same_cold_turn_would_have_been_built_too_large`: probing alone gives an unverified window, budget 16,384, and a prompt more than twice 4,096 |
| already loaded: no warm | `test_an_already_loaded_model_is_not_warmed` |
| load succeeds, verification still unavailable | `test_a_model_that_loads_but_still_cannot_be_read_stays_unverified`: one load, unverified, the configured budget kept |
| load fails | `test_a_failed_load_is_recorded_and_leaves_the_window_unverified` (HTTP 404 and 500; bounded, with no second probe). `test_a_failed_load_then_a_failed_model_call_leaves_the_story_safe`: the error is reported, with no AI action, state event or proposal. `test_a_failed_load_does_not_stop_a_turn_the_model_can_still_answer`: accounting `unknown` |
| the load writes nothing | `test_the_load_itself_writes_nothing`: actions, state events, proposals, memories and summaries are counted before and after, and are identical |
| no new destination | `test_the_load_request_obeys_the_endpoint_policy` (public addresses refused with no transport installed). `test_the_load_request_goes_only_to_the_configured_host`. `test_an_unreachable_server_is_not_asked_to_load_anything` |
| also | `test_a_declared_window_does_not_stop_the_server_being_asked`; `test_the_context_dry_run_never_loads_a_model` |

**Real cold-model test:** §R.3.

### R.2 WP-A2: the continue-hint instruction tail

**The exact output.** Identity depth 16 (action 17 in the run's database). The
stored text equals the v1.1 extractor's output of the raw reply, and the raw
reply has no state block. It ends:

```text
Scene: Bill, Alice and Roger at the table; John not yet arrived.

[Hard limit: this is now 180 words.]

[Reminder: end your reply with a `state` block listing the events your narration made true, with absolute values.]

[You don't need to continue; your turn must now be about John entering the room. Continue the story here, directly. Output only story text.]
```

**Why the application-owned material above the last bracket was not removed.**
`_clean` cuts the end of a reply one bracket at a time, and only ever examines
the **last** bracket. That last bracket is the provider's `CHAT_CONTINUE_HINT`,
reworded at the front. `_is_echoed_instruction` recognised that hint only by its
opening words ("continue the story directly"), so it returned false, and the
loop stopped. The reminder above it would have been removed by the existing
`Reminder:` rule, but it was never at the end. The reworded length hint carries
none of the application's wording, and the scene line was never last.

**The rule, R5 (`RULE_INSTRUCTION_TAIL`).** Two narrow changes:

1. **Recognise the continue hint by its own sentence.** A trailing bracket
   containing "Output only story text" (`CONTINUE_HINT_PHRASE`) is an echoed
   instruction. A test pins the phrase to `CHAT_CONTINUE_HINT`, so the two
   cannot drift.
2. **Remove a hint-opened bracket only directly above an echo.** A trailing
   bracket opening with `Hard limit:` is removed only when an echoed instruction
   bracket has already been cut from the end of the same reply.

The rest follows from existing rules. The reminder is removed by the `Reminder:`
rule once it is last. The scene line is removed by R3 once it is last and
protocol has been cut.

**False-positive defence.** Each of these is a test that must pass unchanged:

| Case | Why it stays |
| --- | --- |
| A final `[Hard limit: forty days, no extensions]` | no echo was cut below it |
| The same bracket above a state block | a block is not an echoed instruction, so a block below does not license it |
| `[The sign on the door reads: Closed]` directly above an echoed continue hint | it does not open the way the hint opens; only the echo goes |
| "output only story text" inside a sentence mid-story | only a trailing bracket is examined |
| A final `[To be continued]` | no application phrase |

The owner's four original adversarial sentences and all earlier preservation
cases also still pass.

**Accepted risk.** A story-world bracket that opens exactly `[Hard limit:` *and*
sits directly above a parroted instruction would be removed with it.

**Positive regression:** `test_the_depth_sixteen_instruction_tail_leaves_entirely`.
The two story paragraphs are shortened; the four trailing lines are verbatim. It
leaves exactly the story.

### R.3 Evidence

| Check | Result |
| --- | --- |
| New and related unit tests (the A1 cold-window, A1 reserve, A2 echo, extractor, window, take and caching tests) | **308 passed, 3 skipped** (the real-model skips) |
| **Replay: the full v1 corpus** | **518 replayed, 509 unchanged, 9 changed, 0 flagged.** The changes are exactly the nine in §I, with the same rules: R5 changes no v1 turn |
| **Replay: the v1.1 runs' raw replies** (the 51-turn run's database and the identity run's database) | **64 replayed, 61 unchanged, 3 changed, 0 flagged:** |
| | long run, action 77: R4, a trailing ```` ```json ```` (0.4%), as in §J.2 |
| | **identity depth 16:** R3 scene line, plus R5 × 3 (the reworded length hint, the reminder, the reworded continue hint). 18.0% of the reply, all of it the tail above |
| | identity depth 18: R4, a trailing ```` ```json ```` (0.8%) |
| **Genuine story prose removed** | **0** |
| **Unreviewed replay flags** | **0** |
| **Real cold-model A1 test** (`v11_window_accounting --unload-first`, same host, model and 207-action bundle as §D.1) | **Prevented.** Model unloaded (`/api/ps` empty). Turn 1: preflight attempted, model loaded, window verified 4,096 (`loaded`), budget 4,096, estimate 3,082, server read **3,097** (+15), margin 499, **`fits`**. Turn 2: no preflight needed (already verified), estimate 3,086, server 3,101, margin 495, `fits`. Before the correction the same turn sent 13,875 against an unverified window and the server read 2,050 |
| **Identity diagnostic, re-run** (office fixture, 10 beats, the same CPU/HTTPS host at 4,096; `$HOME/v11-evidence/a2c-identity`) | **identity signals: 0** (verdict: no objective identity defect). **Prompt example identifiers in proposals: 0** (no `silver-key`, `aldric`, `mara`, `old-abbey`, nor the placeholders). **Stored protocol/instruction shapes: 0/10** (calls, hint and reminder brackets, continue-hint wording, a final scene line, state headings, `"events"`, fences). Proposals: 9 accepted, 1 partially accepted, 1 unparseable. **Read with the replay:** this run's 10 raw replies replay *unchanged* through v1.0.0 and v1.1, so this narrator produced no echo this time. 0/10 here is the required closeout result, not a live exercise of R5. R5's proof is the verbatim depth-16 regression fixture and the replay of the original depth-16 turn above |
| **Backend full suite** | **1,534 passed, 17 skipped, 0 failed**, 1,007 s (the 1,507 before this pass, plus 15 cold-window and 12 corrective A2 tests; the same 17 real-model skips) |
| Frontend suite | **165 of 165** (no frontend file changed in this pass) |
| Lint | **exit 0**; the same pre-existing `only-export-components` warnings |
| Production build | **clean**, 16 files; `index-rWgm40jJ.js` 394.47 kB and `index-BXtb0iME.css` 48.09 kB, the same hashes as before, so the SPA is byte-identical |
| **Offline container** (`tools/m11_offline.py`, `docker build --no-cache`, `--network none`, a fresh volume) | **23 passed, 0 failed** on the corrective tree (`$HOME/v11-evidence/offline-corrective`). The cold-model load is inert here: the failed-turn check has no reachable server, so no load is attempted (`reachable` false), and the turn is reported and commits nothing, as before |
| **Browser and context-inspector regression** (`tools/m11_browser.py`, Firefox 155.0.1 headless, the built SPA served by FastAPI, the real narrator over trusted-LAN HTTPS; `$HOME/v11-evidence/browser-corrective`) | **38 passed, 0 failed, 0 skipped.** This includes F05 (the context inspector shows the assembled prompt), two real turns through the UI, Undo and Redo, hostile narration, G01 import, the dialog and accessibility checks, and CSP. The two browser-played turns' stored snapshots carry the new provenance: the window was verified at 4,096 (`loaded`), the preflight was not attempted because the model was already resident, and accounting was `fits` (server 876 against estimate 861, margin 2,820; server 1,024 against estimate 1,009, margin 2,672). The inspector's accounting and safety-margin display is covered by the component suite (§C), not by this harness |
| **v1.0.0 database compatibility** (a fresh `v1.0.0` worktree against this tree, same database as §K) | **schema before: identical; schema after: identical; API snapshot: identical; `user_version` 94 → 94.** Exercise: Undo 119 → 117, Redo 117 → 119, restore *On the ridge* → 69 with Redo available, dry run 200 with knowledge retrieved, export and import 207 → 207 actions with the same head and identical state |

### R.4 Findings from the corrective pass

**Blockers:** none.

**Corrective work within the pass:**

1. **Harness slip: two background watchers never ran their jobs.** The watchers
   were meant to start the offline container after the suite, and the browser
   regression after the identity run. Each waited with `pgrep -f` on a command
   name that appears in its own command line, so each matched itself and never
   proceeded. Nothing ran and nothing was corrupted. Both watchers were stopped,
   and both runs were started directly (§R.3). This is the same class of slip
   as the earlier `pkill` self-match (§N.2). It sits in session scripting, not
   in the repository.

**Non-blocking residual risks:**

1. **R5 accepted false-positive risk.** A story-world bracket that opens exactly
   `[Hard limit:` and sits directly above a parroted instruction would be
   removed with it (§R.2).
2. **Cold-model load: what it cannot fix.**
   - It does nothing for a server that is unreachable, or that does not speak
     Ollama's native API. Both keep the unverified path, now recorded in
     `window.preflight`.
   - It does not change the window. A model loaded at a smaller default is still
     that window; the turn is built to it, not to the setting.
   - It costs one load request on a cold turn: 3.7 s measured on the CPU host
     for a 3B model, bounded by the model timeout.
3. **The identity closeout's 0/10 does not exercise R5 live** (§R.3). The shape
   is proven by the verbatim fixture and the replay, not by this run.

**Future ideas:**

- Warming the model when the reader opens a campaign, so the first turn does not
  pay for the load. This was deliberately not done, because the dry-run panel
  must have no side effects.

### R.5 Closeout against the owner's required results

| Required | Result |
| --- | --- |
| A1: one bounded load of a cold model, no story content, then the window probed again | built and tested (§R.1); real server: HTTP 200 in 3.7 s, `"response": ""`, `"done_reason": "load"` |
| A1: turn built to the verified window when the load makes it known | **real cold test: verified 4,096, 3,082 sent, 3,097 read, `fits`.** Before the correction: unverified, 13,875 sent, 2,050 read |
| A1: window still unknown → no guess, no hard-coded 4,096, the unverified path kept, accounting kept | tested (§R.1) |
| A1: no calibration, no user setting, no endpoint-policy change, only the configured endpoint, no dummy narration, no discarded turn | met (§R.1). The policy and same-host tests pass. The load writes nothing, tested by row counts |
| A2: minimised positive regression, and why the tail survived | `test_the_depth_sixteen_instruction_tail_leaves_entirely`; root cause in §R.2 |
| A2: narrowest rule; adversarial controls; all extractor tests | R5; 12 new tests; the extractor, A2 and state tests pass |
| A2: replay of all available real turns | **518 replayed, 509 unchanged, 9 changed, 0 flagged.** Classifications exactly as §I.1. Plus the 64 v1.1 replies: 3 changed, 0 flagged |
| **genuine story prose removed** | **0** |
| **unreviewed replay flags** | **0** |
| **identity signals** | **0** |
| **prompt example identifiers in proposals** | **0** |
| **stored protocol/instruction shapes** | **0/10** |
| Backend full suite | **1,534 passed, 17 skipped, 0 failed** |
| Frontend suite / lint / production build | **165/165**; exit 0; clean and byte-identical |
| Offline container | **23 passed, 0 failed** |
| Browser and context-inspector regression | **38 passed, 0 failed, 0 skipped** |
| v1.0.0 database compatibility | **identical** schema before and after, identical API snapshot, `user_version` 94 → 94. Exercise passed |

### R.6 Final decisions

```text
WP-A1: PASS
WP-A2: PASS
```

**WP-A1: PASS.**
- **What is met:** every criterion in §O, plus the owner's corrective
  requirement.
- **The case now prevented:** the real cold-model truncation that A1 had only
  detected. The window becomes discoverable once the model loads, and the turn
  is built to it.
- **What still depends on detection:** a server that cannot be asked, or that
  will not load the model on request. That falls back to the unverified path,
  which is unchanged, recorded, and caught by the accounting.

**WP-A2: PASS.**
- **What is met:** every criterion in §P, plus the owner's corrective
  requirement.
- **The residual §P recorded is closed.** The depth-16 instruction tail is
  removed by a narrow rule anchored to application-owned text.
- **Safety evidence:** 0 genuine prose removed and 0 unreviewed flags across
  582 real replies (518 v1 and 64 v1.1).
- **Identity closeout:** 0 signals, 0 example identifiers, and 0/10 stored
  shapes.

**Next step.** WP-B.1 may begin **after the owner signs the A1/A2 commit.** WP-B
has not been started.

**Git state.** Everything is staged and uncommitted: product code, tests, tools,
planning documents and this report. Nothing was committed, pushed or tagged.