Fit every model request to its context window

Every turn re-sent the whole transcript with nothing checking it against
the model's window. On a local model that fails silently: Ollama drops
the start of an over-long prompt, which is where the system prompt and
the plan are. Measured on the Jetson's llama3.2, cut at 4096 tokens with
no error.

- The model catalog reads max_input_tokens and max_output_tokens from
  LiteLLM's model_info, and startup refuses a role on a model with no
  declared window
- BudgetedClient wraps both routes. It fits the canonical events before
  rendering: older tool results cut to head and tail, then the oldest
  turns dropped with a note, keeping calls with their results; a request
  that still cannot fit fails with ContextOverflow and is never sent.
  The output ceiling is the smaller of config and the model's limit
- Tokens are estimated from characters, pessimistically, and the
  estimate is corrected from reported prompt sizes, only ever upward
- The executor takes its scope from the log: the latest plan, which is
  the approved milestone plan, goes in its system prompt, and it sees
  only events after it
- Tool output keeps its head and, mostly, its tail, so a test runner's
  failure summary survives truncation
- tuning.context.keep_recent_turns and safety_margin are new knobs
- scripts/probe_context.py checks a declared window against what the
  server does; it confirmed llama3.2 cuts at the declared 4096
- The tuning guide covers the budget, declaring a local model's limits,
  and the probe

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

nisse-dev/src/nisse_dev/catalog.py

@@ -35,12 +35,25 @@ class UnknownModel(LLMError):
     stale alias, or a key without access. Always a misconfiguration."""
 
 
+class UnknownLimits(LLMError):
+    """A model in use has no declared context window. LiteLLM knows the
+    limits of commercial models; for a local one they are whatever its server
+    allocates, and have to be declared in LiteLLM's ``model_info``. Guessing
+    is not safe: a server that silently truncates a prompt (Ollama does)
+    drops its start, which is where the system prompt and the plan are."""
+
+
 @dataclass(frozen=True)
 class ModelFacts:
     alias: str  # what we ask for, e.g. "remote-architecture"
     backing: str  # what LiteLLM calls, e.g. "anthropic/claude-opus-5"
     provider: str  # "anthropic", "openai", "ollama", ...
     supports_tools: bool | None  # None when LiteLLM does not say
+    # The whole context window, prompt plus response, as LiteLLM declares it
+    # (model_info.max_input_tokens); None when it does not say.
+    max_input_tokens: int | None = None
+    # The most one response may use (model_info.max_output_tokens).
+    max_output_tokens: int | None = None
 
     @property
     def native_anthropic(self) -> bool:
@@ -72,6 +85,8 @@ class ModelCatalog:
                 backing=backing,
                 provider=str(provider),
                 supports_tools=info.get("supports_function_calling"),
+                max_input_tokens=_positive_int(info.get("max_input_tokens")),
+                max_output_tokens=_positive_int(info.get("max_output_tokens")),
             )
         return cls(facts)
 
@@ -136,6 +151,24 @@ class ModelCatalog:
                 f"available: {', '.join(self.aliases()) or '(none)'}"
             )
 
+    def require_limits(self, roles: Mapping[str, str]) -> None:
+        """Refuse a role mapping that uses a model with no declared context
+        window, naming every such model at once."""
+        missing = {
+            role: alias
+            for role, alias in roles.items()
+            if self.facts(alias).max_input_tokens is None
+        }
+        if missing:
+            named = ", ".join(
+                f"{role}={alias!r}" for role, alias in sorted(missing.items())
+            )
+            raise UnknownLimits(
+                f"no context window is declared for: {named}. Set "
+                "model_info.max_input_tokens (and max_output_tokens) for these "
+                "in LiteLLM; docs/Tuning-Guide.md says how to find the values"
+            )
+
     def pinned(self, roles: Mapping[str, str]) -> dict[str, dict[str, Any]]:
         """The resolved mapping to record at task start (A11, A16).
 
@@ -154,6 +187,12 @@ class ModelCatalog:
         }
 
 
+def _positive_int(value: Any) -> int | None:
+    if isinstance(value, bool) or not isinstance(value, int | float):
+        return None
+    return int(value) if value > 0 else None
+
+
 def select_client(
     model: str,
     normalized: LLMClient,