Brief P2: log and replay assistant messages exactly, drop the thinking-block risk

Approved 2026-09-17. Evidence is in docs/decisions.md.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs/design.md

@@ -84,7 +84,10 @@ ordinary outbound networking can reach the whole tailnet and the internet as the
    measured with the server's tokenizer, enforced by a test.
 2. **Append-only.** The request for turn N+1 is a strict extension of the request for turn N.
    Nothing volatile (time, heartbeat notes, memory refreshes) goes anywhere but the newest message.
-   Enforced by a property test on the serialized message array.
+   Enforced by a property test on the serialized message array. The session log stores each
+   assistant message exactly as the server returned it (`content`, `reasoning_content`,
+   `tool_calls`) and replays it unchanged. Ornith's template keeps every thinking block, so
+   dropping or editing one changes the prefix.
 3. **No in-place pruning.** Tool results are size-capped when first appended, never trimmed later.
 4. **Compaction is an epoch change.** It happens only when the session is idle, writes a summary,
    and starts a new epoch whose prefix is the baseline plus the summary. The old log is kept.
@@ -109,9 +112,7 @@ ordinary outbound networking can reach the whole tailnet and the internet as the
 
 Open question settled by measurement in M0: use the server's chat-completions endpoint with
 server-side tool parsing, or render the template in-process for byte-exact prefix control. Default
-to chat-completions. Switch only if the M0 cache measurements fail. Known risk: Qwen-style
-templates drop earlier thinking blocks from history, which changes the rendered prefix at the last
-assistant turn.
+to chat-completions. Switch only if the M0 cache measurements fail.
 
 ## Authority contract