Guard protocol generation against context truncation

docs/diarization.md

@@ -35,4 +35,28 @@ torchcodec file decoder.
 Anonymous `SPEAKER_XX` labels are aligned to Whisper segments by maximum
 temporal overlap with Community-1 exclusive diarization. The original Whisper
 transcript is preserved; the derived transcript under `diarization/` is used as
-the unchanged direct-protocol generator's input.
+the direct-protocol generator's source input.
+
+The full diarized JSON and timestamped text remain immutable audit artifacts,
+but their per-segment formatting is too verbose for a full-meeting LLM prompt:
+timestamps and repeated speaker labels can more than double input size. For
+protocol generation, Meeting Lab deterministically groups only adjacent
+segments assigned to the same anonymous speaker and omits timestamps. A later
+return by the same speaker starts a new block, and unassigned segments remain
+under `SPEAKER_UNASSIGNED`. `protocol/transcript_input.txt` preserves the exact
+derived representation sent to prompt construction.
+
+Before contacting Ollama, Meeting Lab conservatively estimates prompt tokens
+from UTF-8 byte count without adding a model tokenizer dependency. The default safe
+budget is 16,200 estimated tokens, below the observed 16,386-token effective
+boundary even when a larger `num_ctx` was requested. The estimate is calibrated
+against the currently validated German BPD input and is configurable through
+`MvpMeetingConfig.protocol_safe_input_token_budget` or
+`--protocol-safe-input-token-budget`.
+
+If compact diarized input exceeds the budget, the generator deterministically
+uses the complete plain segment transcript and records the fallback. If that
+also exceeds the budget, generation fails before model lookup or generation;
+it never truncates, chunks, summarizes, retries, or makes multiple protocol
+calls implicitly. Full diarization artifacts are never overwritten by this
+selection.