Update planning package after Phase 0B

planning/V1-ACCEPTANCE-TESTS.md

@@ -1,6 +1,6 @@
 # Adventure Storyteller — V1 Acceptance Tests
 
-**Status:** Draft v0.1  
+**Status:** v1.0 planning/release contract — updated after Phase 0B  
 **Purpose:** Define black-box acceptance tests for finalist evaluation during Phase 0B and for the eventual v1 release.
 
 ## 1. Test Philosophy
@@ -229,18 +229,18 @@ Application requires:
 
 ---
 
-## A02 — Loopback Default
+## A02 — Storyteller Loopback Default
 
 **Priority:** REQUIRED FOR V1
 
 ### Steps
-Inspect application and model listener addresses.
+Inspect the storyteller web/API listener address.
 
 ### Pass
-Default services bind to loopback or another explicitly approved local-only address.
+The storyteller UI/API binds to loopback by default.
 
 ### Fail
-Application exposes privileged storyteller APIs on `0.0.0.0` by default without explicit configuration.
+Application exposes privileged storyteller APIs on `0.0.0.0` or the LAN by default without explicit storyteller-LAN configuration.
 
 ---
 
@@ -290,6 +290,34 @@ Transcript and authoritative current state are restored.
 
 ---
 
+## A06 — Trusted-LAN Ollama Inference
+
+**Priority:** REQUIRED FOR V1
+
+### Preconditions
+- storyteller and browser run on machine A,
+- Ollama runs on a separate user-controlled machine B on the trusted LAN,
+- required models are already installed,
+- outbound Internet access is blocked.
+
+### Steps
+1. Keep the storyteller UI/API bound to loopback on machine A.
+2. Configure the storyteller's Ollama endpoint to machine B.
+3. Verify model discovery/connection diagnostics.
+4. Generate at least three story turns.
+5. Trigger state extraction and embeddings/memory retrieval if enabled.
+6. Restart the storyteller and resume the campaign.
+7. Observe network destinations.
+
+### Pass
+- story operation succeeds through the explicitly configured LAN Ollama host,
+- no cloud API key or Internet access is required,
+- inference/model traffic goes only to the approved LAN host,
+- storyteller UI/API remains loopback-bound,
+- prompts, state, retrieved knowledge, and embedding inputs do not go to any unapproved destination.
+
+---
+
 # B. Basic Story Interaction
 
 ## B01 — Natural Language Action
@@ -431,6 +459,26 @@ Narrator follows campaign canon rather than imported lower-authority text.
 
 ---
 
+## C06 — Structured State Matches Accepted Narrative Consequence
+
+**Priority:** REQUIRED FOR V1
+
+### Purpose
+Catch semantically valid-looking state proposals that do not represent the accepted narration.
+
+### Steps
+1. Use a fixture action with an unambiguous state consequence, such as moving an item, changing location, or applying a known condition.
+2. Run the turn under a realistic application context, not an isolated extraction prompt.
+3. Inspect accepted state events and resulting state.
+
+### Pass
+- accepted state reflects the narration's intended consequence,
+- event semantics are explicit and unambiguous,
+- malformed or contradictory proposals are rejected/repaired rather than silently accepted,
+- the implementation does not rely on one ambiguous numeric value being interpreted as either an absolute value or a relative delta.
+
+---
+
 # D. Undo, Redo, Retry, and Checkpoints
 
 ## D01 — Undo One Turn
@@ -1082,6 +1130,27 @@ Privileged local APIs do not allow arbitrary wildcard cross-origin writes.
 
 ---
 
+## H11 — No First-Use Runtime Asset Download
+
+**Priority:** REQUIRED FOR V1
+
+### Preconditions
+- application installed,
+- Ollama models installed,
+- fresh application data/cache where practical,
+- outbound Internet blocked.
+
+### Steps
+1. Start the application.
+2. Open the browser UI.
+3. Generate the first story turn.
+4. Monitor DNS/network attempts.
+
+### Pass
+The application does not attempt to fetch tokenizer encodings, fonts, scripts, stylesheets, or other runtime assets from the Internet.
+
+---
+
 # I. Export, Backup, and Restore
 
 ## I01 — Export Campaign
@@ -1146,6 +1215,25 @@ No external API credentials are embedded in campaign export.
 
 ---
 
+## I07 — Export/Import Preserves an Undone Active Head
+
+**Priority:** REQUIRED FOR V1
+
+### Steps
+1. Create a story with at least five accepted turns.
+2. Undo at least two turns without deleting the retained future.
+3. Export the campaign while the active head is behind the retained tip.
+4. Import into a fresh data directory.
+5. Open the campaign.
+
+### Pass
+- the campaign opens at the exact exported active head,
+- later retained turns are still present as retained/disposable history,
+- import does not silently Redo to the newest retained turn,
+- Redo/recovery behavior remains coherent after import.
+
+---
+
 # J. Genre Independence
 
 ## J01 — Science-Fiction Campaign
@@ -1493,8 +1581,10 @@ The release candidate should not be called v1.0 until:
 - any approved exceptions are documented in an ADR,
 - security offline test passes,
 - 100-turn long-run test passes,
-- export/import recovery passes,
+- export/import recovery passes, including an undone active-head round trip,
 - Undo/Redo/Retry/checkpoint behavior passes,
+- explicit narrative-state event/coherence tests pass at realistic context length,
+- no first-use runtime tokenizer/font/asset download occurs,
 - branch/memory lineage isolation passes,
 - fantasy and science-fiction fixtures both pass.