Fit every model request to its context window

Every turn re-sent the whole transcript with nothing checking it against
the model's window. On a local model that fails silently: Ollama drops
the start of an over-long prompt, which is where the system prompt and
the plan are. Measured on the Jetson's llama3.2, cut at 4096 tokens with
no error.

- The model catalog reads max_input_tokens and max_output_tokens from
  LiteLLM's model_info, and startup refuses a role on a model with no
  declared window
- BudgetedClient wraps both routes. It fits the canonical events before
  rendering: older tool results cut to head and tail, then the oldest
  turns dropped with a note, keeping calls with their results; a request
  that still cannot fit fails with ContextOverflow and is never sent.
  The output ceiling is the smaller of config and the model's limit
- Tokens are estimated from characters, pessimistically, and the
  estimate is corrected from reported prompt sizes, only ever upward
- The executor takes its scope from the log: the latest plan, which is
  the approved milestone plan, goes in its system prompt, and it sees
  only events after it
- Tool output keeps its head and, mostly, its tail, so a test runner's
  failure summary survives truncation
- tuning.context.keep_recent_turns and safety_margin are new knobs
- scripts/probe_context.py checks a declared window against what the
  server does; it confirmed llama3.2 cuts at the declared 4096
- The tuning guide covers the budget, declaring a local model's limits,
  and the probe

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

nisse-dev/src/nisse_dev/llm.py

@@ -149,12 +149,15 @@ class LiteLLMClient:
         tools: list[dict[str, Any]] | None,
         model: str,
         system: str | None = None,
+        *,
+        max_tokens: int | None = None,
     ) -> list[CanonicalEvent]:
         body = self._renderer.render(events, tools, model, system=system)
         # A ceiling on this route too: without one a runaway turn is bounded
         # only by the provider's default, and the same truncation check has
-        # nothing to check against.
-        body["max_tokens"] = self._max_tokens
+        # nothing to check against. A caller that knows the model's limits
+        # (the context budget) passes a tighter one.
+        body["max_tokens"] = max_tokens or self._max_tokens
         response = _post_with_rate_limit_retry(
             self._http, "/chat/completions", body, self._sleep
         )
@@ -175,8 +178,8 @@ class LiteLLMClient:
             raise LLMError(f"malformed completion response: {exc}") from exc
         if choice.get("finish_reason") == "length":
             raise TruncatedResponse(
-                f"{requested_model} hit its output limit mid-answer; "
-                "raise llm.max_output_tokens"
+                f"{requested_model} hit its output limit mid-answer; raise "
+                "llm.max_output_tokens, or the model's max_output_tokens in LiteLLM"
             )
         produced_by = data.get("model") or requested_model
         usage = data.get("usage") or {}
@@ -258,9 +261,15 @@ class AnthropicPassthroughClient:
         tools: list[dict[str, Any]] | None,
         model: str,
         system: str | None = None,
+        *,
+        max_tokens: int | None = None,
     ) -> list[CanonicalEvent]:
         body = self._renderer.render(
-            events, tools, model, system=system, max_tokens=self._max_tokens
+            events,
+            tools,
+            model,
+            system=system,
+            max_tokens=max_tokens or self._max_tokens,
         )
         response = _post_with_rate_limit_retry(
             self._http, "/v1/messages", body, self._sleep
@@ -277,8 +286,8 @@ class AnthropicPassthroughClient:
     ) -> list[CanonicalEvent]:
         if data.get("stop_reason") == "max_tokens":
             raise TruncatedResponse(
-                f"{requested_model} hit the output limit of {self._max_tokens} "
-                f"tokens mid-answer; raise llm.max_output_tokens"
+                f"{requested_model} hit its output limit mid-answer; raise "
+                "llm.max_output_tokens, or the model's max_output_tokens in LiteLLM"
             )
         content = data.get("content")
         if not isinstance(content, list):