# Adventure Storyteller v1.1 — Integrated Release Validation

**Status:** COMPLETE — **V1.1 RELEASE VALIDATION: PASS**. The decision, and what
it deliberately does not cover, is in §W.

This report answers one question: **does this exact candidate preserve the
complete v1 contract and satisfy every accepted v1.1 package on one integrated
release tree?** It is release validation, not a work package. Nothing here adds
a feature, and no release tag is created by it.

---

## A. Repository / provenance

| | |
| --- | --- |
| **Candidate SHA** | **`87a40326a29533c8d52c9f9f41022e7b499b1de7`** |
| Branch | `v1.1-development`, up to date with `origin/v1.1-development` |
| Working tree at freeze | **clean** — nothing modified, nothing staged |
| Commit | *v1.1: harden recovery and control boundaries* (WP-D + WP-E) |
| **Owner signature** | **Good signature**, RSA key `02C9BF7D8A4A77DF7A8905617D8AE19DB5C68569`, made 2026-09-16 05:37:13 EDT |
| Tag at HEAD | **none** — no `v1.1.0` tag exists |
| v1.0.0 baseline | `432f04100b9a67198bcdc46c6ff8ee0f181e1667`, **an ancestor** |
| Package ancestry | `d63804f` (WP-A1/A2), `beb17ad` (WP-B.1), `0c1ba83` (WP-B.2), `59b5ebc` (WP-C) — **all ancestors** |
| Diff v1.0.0..HEAD | 61 files, +14,833 / −366 |
| LICENSE / PROVENANCE | **unchanged since v1.0.0** (empty diff) |

### A.1 Frozen candidate identity

| | |
| --- | --- |
| Dependency locks | `backend/requirements.txt` `sha256:ed28bc0f8970cf4e…`, `frontend/package-lock.json` `sha256:355cb370837ade01…`, `frontend/package.json` `sha256:2016580ddfa176a9…`, `backend/requirements-dev.txt` `sha256:06d7695816b201e9…` |
| Schema | `LATEST_VERSION` **94**, 93 migrations (`PRAGMA user_version`) |
| Bundle format | **`ai-dnd-adventure-v3`** |
| Import ceiling | 20 MB (`MAX_IMPORT_BODY_BYTES`), unchanged |
| Frontend build | `dist` built 2026-09-16T05:39:55, 16 files, `sha256(dist) = ea2753ad24f61959fe084f4674911acc` |
| Docker image | `storyteller:release-87a4032`, `sha256:fe10e8a2511395958882e489bfdf53fa00d981597cc81aa5587235f7b7836398`, 312 MB |
| Firefox / geckodriver | 155.0.1 / 0.37.1 (2026-09-04) |
| Docker | 29.8.0, build 88096ef |
| CPU HTTPS reference host | Ollama **0.33.0**, serving `qwen2.5:3b-instruct`, `qwen2.5:3b-instruct-16k`, `nomic-embed-text:latest`; certificate verifies through the machine's CA store with no bypass |
| GPU inference host | Ollama **0.34.0**; `qwen2.5:3b-instruct-16k` digest `21ff8cc52f375f19`, `nomic-embed-text:latest` digest `0a109f422b47e3a3`; no model resident at start |
| Evidence root | `$HOME/v11-evidence/release-87a4032/` — never `/tmp`, and no real hostname appears in any committed file |

---

## B. Package acceptance inventory

| Package | Status | Source |
| --- | --- | --- |
| **WP-A1** context-window safety reserve | **ACCEPTED** | `V1.1-WP-A1-A2-REPORT.md`, signed `d63804f` |
| **WP-A2** protocol-echo cleanup, genre-neutral prompting | **ACCEPTED** | same report and commit |
| **WP-B** independent memory | **ACCEPTED WITH DOCUMENTED REAL-MODEL LIMITATION** | `V1.1-WP-B1-REPORT.md`, `V1.1-WP-B2-REPORT.md` §S, signed `beb17ad` / `0c1ba83` |
| **WP-C** browser release coverage | **ACCEPTED** | `V1.1-WP-C-REPORT.md`, signed `59b5ebc` |
| **WP-D** recovery honesty | **ACCEPTED** | `V1.1-WP-D-REPORT.md`, signed `87a4032` |
| **WP-E** control-boundary contrast | **ACCEPTED** | `V1.1-WP-E-REPORT.md`, signed `87a4032` |

### B.1 WP-B's qualification, carried whole

The WP-B disposition is **not** shortened to "WP-B passed" anywhere in this
report. Its own §S records:

```text
B2.1 RANKING: PASS
B2.2 EVICTION: PASS
B2.3 EXCERPT CREATION: PASS
B2.4 SUMMARIZER-PROMPT EXPERIMENT: FAIL — REVERTED

DETERMINISTIC WP-B: PASS
REAL-MODEL WP-B: FAIL

WP-B OVERALL:
ACCEPTED WITH DOCUMENTED REAL-MODEL LIMITATION
```

In the release contract's own words (§11 items 12), that is:

```text
DETERMINISTIC WP-B: PASS
REFERENCE-MODEL INDEPENDENT MEMORY: FAIL
OWNER ACCEPTED THE LIMITATION FOR v1.1
```

The failing stage is **memory creation** — the summariser's content selection —
not ranking, eviction or injection, each of which passes deterministically.

### B.2 WP-E screenshot approval — a correction of record

The committed WP-E report read `OWNER SCREENSHOT APPROVAL: PENDING`, because it
was written before the owner reviewed the images. The owner's release-validation
brief (2026-09-16) states the before/after screenshots are approved and
instructs this validation to record it. The WP-E report is updated to
`APPROVED` as part of this closeout (§V), sourced to that brief and dated. No
visual code changed during release validation, so the approval stands (§Q).

---

## C. v1 acceptance matrix

Every test marked **REQUIRED FOR V1** — there are **82** — against evidence taken
on **this candidate**. Evidence types follow M11's: `browser` (the 101-check run,
§G), `campaign` (the 102-turn integrated run, §H), `container` (the offline run
on the candidate image, §F), `process` (spawned server processes — recovery §M,
upgrade §N), `suite` (the 1,723-test backend suite, §D). No historical result
from different product code is used where the contract asks for candidate
evidence.

**Result: 81 PASS, H09 NOT APPLICABLE, 0 waived, 0 weakened, 0 reclassified.**

### A — Local-first operation

| ID | Result | Evidence on this candidate |
| --- | --- | --- |
| A01 Start application offline | **PASS** | container: first page load, fresh volume, no route and no DNS |
| A02 Storyteller loopback default | **PASS** | suite; every harness reached it on `127.0.0.1`; `docker-compose.yml` publishes `127.0.0.1:8000:8000` |
| A03 No cloud API key | **PASS** | suite; container: no secret in an export |
| A04 Campaign survives restart | **PASS** | campaign: **3 process restarts, 4 process starts**, state compared across each; container: campaigns survive a container restart |
| A05 Failed model call does not corrupt story | **PASS** | campaign: a real `failed_call` at turn 69 against an unserved model, play resumed; container: same with no model reachable |
| A06 Trusted-LAN Ollama inference | **PASS** | browser: the whole 101-check run over **trusted-LAN HTTPS with a private CA**, verification on, no bypass, storyteller loopback-bound |

### B — Core play

| ID | Result | Evidence |
| --- | --- | --- |
| B01 Natural language action | **PASS** | browser (real turns through the UI) + campaign (102 accepted) |
| B02 Dialogue input | **PASS** | campaign: dialogue beats in the turn list |
| B03 Continue | **PASS** | suite; browser: the Continue control present and enabled |

### C — Story authority and state

| ID | Result | Evidence |
| --- | --- | --- |
| C01 Campaign canon is preserved | **PASS** | campaign: canon present in the prompt on **102 of 102** turns |
| C02 Possession state | **PASS** | campaign (the silver key) + suite |
| C03 Character knowledge is not invented | **PASS** | suite |
| C04 Manual state correction | **PASS** | campaign: **2 state corrections**; browser: C3's accepted and refused corrections; suite |
| C05 Canon beats reference | **PASS** | suite |
| C06 Structured state matches accepted narrative consequence | **PASS** | campaign: real extraction across 102 turns, every event validated or refused; suite |

### D — Non-destructive history

| ID | Result | Evidence |
| --- | --- | --- |
| D01 Undo one turn | **PASS** | browser + campaign (`undo`) |
| D02 Minimum five undos | **PASS** | suite; campaign (`undo_redo`) |
| D04 Redo | **PASS** | browser + campaign |
| D05 Redo invalidated by new continuation | **PASS** | campaign: `diverged`, after which Redo is gone |
| D06 Retry narrator response | **PASS** | campaign: **2 retries** |
| D07 Select prior retry take | **PASS** | campaign: `take_selected` |
| D08 Retry does not delete prior take | **PASS** | campaign + suite |
| D09 Edit earlier user input | **PASS** | suite |
| D10 Edit narrator output | **PASS** | suite; browser (hostile-Markdown plants through the narrator-edit path) |
| D11 Named checkpoint | **PASS** | campaign: **2 Save Points**; browser; suite |
| D12 Restore checkpoint | **PASS** | campaign: `save_point_restored`; browser |
| D13 Restore does not delete later history | **PASS** | campaign: retained actions after the restore; recovery §M |
| D14 Delete checkpoint | **PASS** | suite; browser: the delete confirmation dialog |

### E — Branch and derived-data isolation

| ID | Result | Evidence |
| --- | --- | --- |
| E01 Abandoned future cannot affect active state | **PASS** | suite `test_m11_leakage.py`, with a positive control |
| E02 Abandoned memory cannot leak | **PASS** | as above |
| E03 Abandoned summary cannot leak | **PASS** | as above |
| E04 Scene state is lineage-safe | **PASS** | as above |

### F — Long-term memory and context

| ID | Result | Evidence |
| --- | --- | --- |
| F01 Recent turns remain coherent | **PASS** | campaign: history populated every turn, newest always included |
| F02 Old important event retrieval | **PASS** | campaign §K: the planting turn outside the window and the fact recovered — **through authoritative state**, not independent memory (§K states which) |
| F03 Prompt remains bounded | **PASS** | campaign: 1,602–14,982 tokens against a 16,384 budget across 102 turns |
| F04 Output token reserve | **PASS** | campaign: `output_reserve` 500 present and subtracted on every turn |
| F05 Prompt inspector | **PASS** | browser: the context panel shows the assembled prompt |
| F06 Retrieval provenance | **PASS** | campaign: knowledge and memory provenance per turn; suite |
| F07 Heuristic memory is not canon | **PASS** | suite |
| F08 Memory failure is non-fatal | **PASS** | suite; container: derived work fails with no model and turns still commit; campaign: **0 post-turn failures**, no database-lock errors |

### G — Imported knowledge

| ID | Result | Evidence |
| --- | --- | --- |
| G01 Import local text | **PASS** | browser: through the real file input; container: offline |
| G02 Import local Markdown | **PASS** | campaign: **3 sources imported**; browser |
| G03 Classification | **PASS** | campaign: all three classes; recovery §M confirms them after a move |
| G04 Disable knowledge source | **PASS** | suite |
| G05 Canon retrieval | **PASS** | campaign: canon passages in stored prompts; suite |
| G06 Reference retrieval | **PASS** | suite |
| G07 Inspiration is low authority | **PASS** | suite |
| G08 No automatic URL fetch | **PASS** | suite `test_egress.py`; container: no network at all, import still works |
| G09 Remote Markdown image does not auto-load | **PASS** | browser: no remote image src in the rendered story |
| G10 Prompt injection in source is treated as data | **PASS** | suite; browser: injection text rendered as text |

### H — Security

| ID | Result | Evidence |
| --- | --- | --- |
| H01 No unexpected outbound connections | **PASS** | container (no network at all) + suite `test_egress.py` |
| H02 No telemetry | **PASS** | suite |
| H03 No cloud provider required | **PASS** | container: a full campaign offline |
| H04 Model output cannot execute shell | **PASS** | browser + suite |
| H05 Invalid state event rejected | **PASS** | suite; campaign: refusals recorded |
| H06 Stored XSS protection | **PASS** | browser: `onerror` and `<script>` in accepted narration, neither executed |
| H07 JavaScript URL protection | **PASS** | browser: no `javascript:` href in the DOM |
| H08 Path traversal import rejected | **PASS** | suite |
| **H09 ZIP Slip protection** | **NOT APPLICABLE** | the product extracts no archives, and a test enforces it — the same condition v1 recorded |
| H10 Restrictive CORS and local API behaviour | **PASS** | browser: an unknown API path is a 404 with a non-HTML body; suite |
| H11 No first-use runtime asset download | **PASS** | container: every asset local with no network; suite: the tokenizer table is vendored |
| H12 Inference endpoint enforcement | **PASS** | suite; smoke §R: a public endpoint refused by the running image; the container's refusal of an unresolvable name is the same policy (§R) |

### I — Export, import and recovery

| ID | Result | Evidence |
| --- | --- | --- |
| I01 Export campaign | **PASS** | campaign: the 102-turn campaign exported (3,071,683 bytes) |
| I02 Import exported campaign | **PASS** | process §M: imported into a database and directory that never existed |
| I03 Branch/disposable history export | **PASS** | §M: **88 actions retained beyond the active line** after the move |
| I04 Checkpoint export | **PASS** | §M: both Save Points restore after the move |
| I05 Knowledge provenance export | **PASS** | §M: all three classes with their content |
| I06 Database/export contains no API secrets | **PASS** | §M: the bundle carries no secret; suite; container |
| I07 Export/import preserves an undone active head | **PASS** | §N: the v1.0.0 campaign's undone head and `can_redo` survive upgrade and both bundle directions; suite `test_m9_portability.py`. *(The long-run bundle ended head-at-tip, so §M exercises the other case — stated in §M rather than implied)* |

### J — Genre neutrality

| ID | Result | Evidence |
| --- | --- | --- |
| J01 Science-fiction campaign | **PASS** | suite `test_m11_scifi.py` |
| J02 Generic entity support | **PASS** | as above |
| J03 Genre profiles are configuration | **PASS** | as above |

### K — Future media architecture

| ID | Result | Evidence |
| --- | --- | --- |
| K01 Scene snapshot exists | **PASS** | suite; container: a scene packet builds offline |
| K02 Visual character profile | **PASS** | suite |
| K03 Visual location profile | **PASS** | suite |

### L — Data integrity

| ID | Result | Evidence |
| --- | --- | --- |
| L01 Atomic turn commit | **PASS** | container + campaign: a real induced failure, no narration accepted, no half-written state |
| L02 State reconstruction | **PASS** | suite; campaign: state compared across 3 restarts |
| L03 Checkpoint reconstruction after restart | **PASS** | campaign + §M |

### M — Long-run

| ID | Result | Evidence |
| --- | --- | --- |
| **M01** 100-turn campaign | **PASS** | **102 accepted turns**, every scheduled operation exercised, **0 post-turn failures** (§H) |
| **M02** Restart during long campaign | **PASS** | **3 genuine process restarts** (4 process starts); everything crossed as bytes on disk |
| **M03** Long-run context stability | **PASS** | the prompt held **13,492–14,982** tokens over the last 70 turns against a 16,384 budget; window verified **102/102**; canon present **102/102** |
| **M04** Long-run memory recall | **PASS**, qualified | the planted clue was outside the history window (planted depth 1, floor 72) and reached the prompt: `m04_verdict: **recovered_through_state_only**`. Recovery was **through authoritative state**, not independent memory — §K states this distinction and does not relabel it |

### SHOULD and FUTURE

Not counted as REQUIRED. **SHOULD:** B04, D03, K04, L04 — all still pass on the
candidate (suite; browser for B04's direction toggle). **FUTURE:** K05, K06 —
deliberately not run; both need a media provider this release does not build.

## D. Backend / frontend suites

| Suite | Result |
| --- | --- |
| **Backend** (`pytest -q`, no `AIDND_TEST_*` set) | **1,723 passed, 17 skipped, 0 failed, 0 xfailed** (1,210.6 s) |
| **Frontend** (`npm test`) | **175 passed**, 15 files, 0 failed |
| **Lint** (`npm run lint`, oxlint) | **exit 0 — 0 errors**, 15 warnings |
| **Production build** (`npm run build`) | succeeded |

**Every skip explained — one category, and it is the expected one.** All 17 are
environment-gated real-model tests, skipped because `AIDND_TEST_*` is
deliberately unset for the deterministic suite:

| File | Skipped | Gate |
| --- | --- | --- |
| `test_knowledge_real_model.py` | 7 | `AIDND_TEST_ENDPOINT` (and `AIDND_TEST_EMBED_MODEL`) |
| `test_context_realistic.py` | 3 | `AIDND_TEST_ENDPOINT` + `AIDND_TEST_MODEL` |
| `test_narrative_realistic.py` | 3 | same |
| `test_m11_real_window.py` | 3 | same; one needs `AIDND_TEST_WIDE_MODEL` |
| `test_provider_wiring.py` | 1 | same |

**0 xfailed.** No deficiency WP-B fixed remains parked as an expected failure —
B.1's two strict xfails became ordinary passes in B.2 and stayed that way.

**Lint warnings are the documented, unchanged set:** the pre-existing
`only-export-components` and unused-import warnings recorded at WP-C, WP-D and
WP-E. None is in a file this candidate changed relative to those packages.

## E. Production build and Docker image

| | |
| --- | --- |
| Command | the repository's documented production build (`DEVELOPMENT.md`), with `--no-cache` |
| Image | `sha256:fe10e8a2511395958882e489bfdf53fa00d981597cc81aa5587235f7b7836398` (312 MB) |
| Dependencies | **installed, not reused** — `npm ci` and `pip install --no-cache-dir` both executed in the log |
| `CACHED` steps | **2**, and both are `WORKDIR` metadata (`/build`, `/app`) — no dependency or source layer was cached |
| **Image SPA vs local build** | **file-for-file identical**: 16 files each, `diff -r` clean, combined `sha256 = ea2753ad24f61959fe084f4674911acc` on both sides |

The image is built from the candidate tree for this validation. No earlier
work-package image was reused.

## F. Offline / no-network

`tools/m11_offline.py` against **the candidate image**, `--network none`, fresh
volume. Evidence: `…/release-87a4032/offline/offline-report.json`.

**23 checks, 23 passed, 0 failed.** Including: no route to the public Internet;
no external DNS; first page load; no remote origin named; CSP served; every
referenced asset local; campaign creation; state extraction; local file import;
prompt assembly; knowledge search; a turn with no model reachable reported as a
failure with no narration accepted, the player's words kept and state unchanged;
export; import with state; no secret in the export; the media module inert with
no provider; campaigns surviving a container restart.

**No first-use download occurred**, which is what the container's absent network
makes unfalsifiable rather than merely unobserved.

## G. Browser release validation

`tools/m11_browser.py` on the candidate, production build served by FastAPI,
Firefox 155.0.1 / geckodriver 0.37.1, narrator over **trusted-LAN HTTPS with the
private CA** (`endpoint_class: trusted-LAN HTTPS`), storyteller on loopback.
`kind: release regression` — not partial, not `--only`. 693 s.

| Suite | Passed | Failed | Skipped |
| --- | --- | --- | --- |
| **M11** (the v1 release regression) | **38** | **0** | **0** |
| **WP-C** (browser release coverage) | **53** | **0** | **0** |
| **WP-E** (control boundaries) | **10** | **0** | **0** |
| **Total** | **101** | **0** | **0** |

**A1 accounting:** 8 narrator turns, **`fits` on every one**; `turns_not_clean`
**0**; `protocol_shapes_in_narration` **0**. The verified window on this host was
4,096 (`source: loaded`); the 16,384 evidence is the long run's (§I).

WP-C's proofs are all present in the 53: Retry and alternate takes, Save Point
create/restore/Redo, state correction including a refusal shown as a refusal,
narration length reaching the prompt, failed generation and recovery, and **real
export downloads** from both the library and campaign settings, each file landing
on disk and importing into a fresh application. WP-E's ten are the rendered
boundary measurements of §Q.

## H. Integrated 100+ turn long run

One new campaign on the candidate's product code, GPU inference host, with the
owner's power/link/kernel logging running before the first turn.
Evidence: `…/release-87a4032/long-run/`.

| | |
| --- | --- |
| Narrator | **`qwen2.5:3b-instruct-16k`**, digest `21ff8cc52f375f19` |
| Embeddings | **`nomic-embed-text`**, digest `0a109f422b47e3a3` |
| Window | **16,384**, `window_verified` on **102 of 102** turns |
| Memory / summaries | **on** — 19 memories in the bank, **12 summaries** written |
| **Accepted turns** | **102** (target 100) |
| Restarts | **3** genuine process restarts, 4 process starts |
| Elapsed | 1,330 s |
| Export | 3,071,683 bytes; database 2,613,248 bytes |
| Status | `complete`; `aborted_reason` null, `failed_reason` null |

**Not a repeated-turn benchmark.** Every scheduled operation fired and is in the
timeline: 3 restarts, 1 undo, 1 undo→redo, 2 retries, 1 take selection, 2 Save
Points, 1 Save Point restore, 1 divergence, 2 state corrections, 3 knowledge
imports, memory activation, 1 deliberate failed call, 1 export, the planted clue
and the planted independent fact, and the recall probe.

### H.1 M01–M04

| | Verdict | What decides it |
| --- | --- | --- |
| **M01** 100-turn campaign | **PASS** | 102 accepted turns, each with a committed action and state document |
| **M02** Restart during long campaign | **PASS** | 3 genuine `uvicorn` restarts; everything that survived crossed as bytes on disk |
| **M03** Long-run context stability | **PASS** | prompt 13,492–14,982 tokens over the last 70 turns against a 16,384 budget; canon present 102/102; window verified 102/102 |
| **M04** Long-run memory recall | **PASS**, and qualified | the clue was planted at depth 1, the history floor reached depth 72, and it was **not** in the recent window; it reached the prompt through **authoritative state**. `m04_verdict: recovered_through_state_only`. §K keeps the distinction the criterion was written around |

### H.2 State and derived-work integrity

**0 post-turn failures across 102 turns, and no `database is locked` error.** The
only failure-shaped events in the whole timeline are the two the run creates on
purpose: the scheduled `failed_call` at turn 69 (a model name the server does not
serve — A05/L01 evidence) and the independent-fact precondition notes (§K).
Narrative-state proposals were recorded, applied or refused as designed across
the run, and no accepted narration carried an unresolved protocol block (§J).

## I. Context-window / A1 evidence

**Every turn `fits`.** Across all 102 accepted turns the accounting status was
`fits` — **0 `exceeded`, 0 `truncation_suspected`** — and the window was verified
at 16,384 on every one.

**The ten largest stored prompts**, re-counted against what the server itself
reported:

| Turn | App estimate | Server count | Difference | Window | Output reserve | Safety reserve | Observed margin | Status |
| ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | :--- |
| 86 | 14,990 | 15,005 | +15 | 16,384 | 500 | 820 | 879 | fits |
| 83 | 14,978 | 14,993 | +15 | 16,384 | 500 | 820 | 891 | fits |
| 97 | 14,965 | 14,980 | +15 | 16,384 | 500 | 820 | 904 | fits |
| 41 | 14,960 | 14,975 | +15 | 16,384 | 500 | 820 | 909 | fits |
| 66 | 14,951 | 14,966 | +15 | 16,384 | 500 | 820 | 918 | fits |
| 33 | 14,941 | 14,956 | +15 | 16,384 | 500 | 820 | 928 | fits |
| 35 | 14,940 | 14,955 | +15 | 16,384 | 500 | 820 | 929 | fits |
| 77 | 14,940 | 14,955 | +15 | 16,384 | 500 | 820 | 929 | fits |
| 38 | 14,927 | 14,942 | +15 | 16,384 | 500 | 820 | 942 | fits |
| 45 | 14,922 | 14,937 | +15 | 16,384 | 500 | 820 | 947 | fits |

**The reserve is preserved on every re-counted prompt.** The estimate runs
exactly **15 tokens below** the server's own count on all ten — a constant,
known offset rather than drift — and the smallest observed margin anywhere in the
run is **879 tokens**, against the documented safety reserve of 820.

**Against v1.** M11's closeout recorded a remaining margin of **23–42 tokens**.
The same measurement on this candidate is **879 at its tightest** — roughly
twenty to thirty times the headroom, which is what WP-A1 was for.

## J. Protocol-leak / A2 evidence

**Release-gate result: 0.** Across the run's **105 stored AI actions**,
`protocol_leaks` reports **0 leaking**, `example_ids` empty.

Measured separately, by the detector's own four rules:

| Shape | Count in this run |
| --- | --- |
| State/section heading with an indented entry | **0** |
| Event list (`"events"`) | **0** |
| Event-call syntax (`create_entity(`, `set_scene(`, …) | **0** |
| Hard-limit / continue-hint echo | **0** |

The browser run agrees independently: `protocol_shapes_in_narration` **0** across
its narrated turns (§G).

**The known mid-reply echo did not recur — and is still not fixed.** WP-B.1
recorded one stored reply (action 153, depth 143) where the narrator echoed the
length hint mid-reply and then continued the story, which A2's trailing cleanup
does not remove. Replaying **that stored fixture through this candidate's
detector** still flags it — 1 of 105 AI actions, matched by the hard-limit/hint
rule alone. So the residual is live (§T.2); what this release run shows is that
no equivalent shape occurred in **its** 105 replies. This report does not claim
protocol leakage is solved.

Ordinary fact and state restatement in prose was not counted: it is measurement,
not application-owned protocol, and no rule treats it as a leak.

## K. Memory / WP-B evidence

### K.1 At the final recall point

| | |
| --- | --- |
| **Created** | 19 memories in the bank; 12 summaries |
| **Retained** | the planting turn's era survived to the end of a 102-turn run |
| **Ranked** | 4 memories were selected into the prompt at the recall point |
| **Injected** | the memory section reached the prompt (14,395 tokens that turn) |
| **Independent-memory verdict** | **not demonstrated** — `precondition_failed: absent_from_later_narration` |

### K.2 The independent-fact probe, precondition by precondition

| Precondition | Held? |
| --- | --- |
| The planted turn is outside the history window (planted depth 3, floor 72) | **yes** |
| Absent from authoritative state | **yes** |
| Absent from the summary | **yes** |
| Absent from imported knowledge | **yes** |
| Absent from later narration | **no** — 6 violations, the first at turn 6 |

The narrator restated the planted fact in later narration, so the probe could not
isolate memory as the only path. The run therefore **records no independent
recovery**, and nothing here is relabelled as one.

### K.3 The two statements the contract requires, kept apart

```text
deterministic independent-memory recovery: PASS
reference-model independent-memory limitation: ACCEPTED RESIDUAL
```

- **Deterministic** (`WP-B.2` §I, and the suite on this candidate): the
  `independent_full` scenario fails on v1.0.0 at creation and returns
  `recovered_through_memory_independent` on the candidate, with isolation
  asserted every turn and provenance resolving to the planting turn.
- **Reference model:** failed on the precondition-valid attempt in WP-B.2, and
  in this release run the attempt was not precondition-valid at all. The failing
  stage remains **memory creation** — the summariser's content selection.
- **No new regression.** B2.1 ranking, B2.2 eviction and B2.3 excerpt creation
  all pass deterministically in the 1,723-test suite on this candidate, and the
  bank behaved normally through the run (19 memories, ranked and injected). What
  this run shows is the known summariser-quality limitation, not a fault in
  ranking, eviction or injection.

## L. Identity diagnostic

**Scripted half — complete.** `tools/m11_identity.py --scripted` on the
candidate: 10 identity stresses, **0 signals**, verdict *no objective identity
defect detected*.

**The detector's negative control fires.** With `--inject`, the same harness on
the same candidate raises **7 signals** — `shared_display_name` once and
`duplicate_character_creation` on turns 5–10 — and preserves each turn's
evidence. A clean run therefore means something: the check is capable of
failing.

**Model-backed half — complete, on the candidate, with memory on.**
Evidence: `…/release-87a4032/identity-memory/`.

| | |
| --- | --- |
| Model | **`qwen2.5:3b-instruct-16k`** (the reference narrator) |
| Context window | **16,384** |
| Memory status | **on** — `memoryBankEnabled: true`, embedding model `nomic-embed-text` |
| Summary status | **on** — `autoSummarize: true`; **1 summary written** |
| **Identity signals** | **0** across all 10 stresses |
| **Stored protocol shapes** | **0** of 10 AI actions, by the release-gate detector |
| Fixture | accepted successfully — five entities kept distinct (`bill`, `alice`, `roger`, `john`, `office`) |
| State proposals | recorded and applied with no shared display name and no duplicate creation |
| Scripted detector self-test | still fires (7 signals under `--inject`) |

**A harness correction made during validation, and what it does not invalidate.**
The diagnostic shipped with `embedding_model=""` and the memory bank switched
off, so a release run of it would have reported a clean identity result with
memory never taking part — which is not what the gate asks for. Two lines now
read `AIDND_TEST_EMBED_MODEL` and enable the bank. **Harness-only: no product
code changed**, so no product evidence became stale; the corrected harness
repeated its own check, which is the run reported above.

**One honest observation:** with memory enabled the bank still wrote **0
memories** in this 10-beat campaign — 21 actions is enough to pass
`MEMORY_START`, but the summary pass is what ran and produced the single
summary. Memory was configured and active; it was not meaningfully *exercised*
here. The bank's real exercise is the 102-turn run (§K), which wrote 19.

**No claim about the historical root cause.** The post-M8 identity finding's
campaign was destroyed and its cause cannot be established. A clean run here is
evidence that the product does not do the things it can be blamed for on this
fixture — not a discovery of what happened then.

## M. Recovery

`tools/m11_recovery.py` against **the integrated run's own bundle**
(3,071,683 bytes), imported into a database file that never existed, in a
directory that never existed, by a second server process — so migrations ran
from nothing and this is the fresh-install path as well as the import path.

**16 checks, 16 passed, 0 failed.**

| Claim | Result |
| --- | --- |
| The destination database did not exist beforehand | PASS |
| The bundle imports into a clean directory | PASS — 209 actions in the file, 121 on the active line |
| The active transcript is not empty | PASS |
| Authoritative state came across | PASS — 6 entities, 1 fact |
| The campaign's own canon came across | PASS |
| The narration-length choice came across | PASS |
| Redo availability matches what the file said | PASS |
| Retained (undone) history came across | PASS — **88 actions retained beyond the active line** |
| Both Save Points restore | PASS — *On the ridge*, *Before the ridge* |
| Every imported class came across, with content | PASS — 3 sources |
| The moved campaign accepts a new change, unrefused | PASS |
| The bundle carries no secret | PASS |
| The moved campaign exports again, same story length | PASS |

**One thing this does not prove, stated rather than implied.** The long run
ended with its head at the tip, so the file's head was at the tip and Redo was
correctly unavailable after import. The **undone-head** case (I07) is proved by
§N's upgrade campaign, which ends on an Undo with Redo available and survives
both bundle directions, and by `test_m9_portability.py` in the suite — not by
this bundle.

## N. v1.0.0 upgrade compatibility

A campaign **built and played by the `432f041` application** in its own
worktree, then opened by the candidate. Evidence:
`…/release-87a4032/upgrade/upgrade-report.json`.

**Phase 1 — v1.0.0 builds it.** 20 turns accepted, 39 actions, canon knowledge
imported, a Save Point taken, one Undo so the head is not at the tip, narration
length chosen, memory bank and auto-summary on. It contains what §11 item 9
names: retained history, an undone head with Redo available, a Save Point,
**6 memories**, **2 summaries**, imported knowledge, a narration-length choice
and narrative state. Settings hold a **loopback placeholder**
(`http://127.0.0.1:11434/v1`) — no real hostname is in the evidence database.

**Phase 2 — the candidate opens the same file.** Nothing was copied; the
candidate's migrations ran against it.

| Field | Before | After |
| --- | --- | --- |
| transcript | 39 actions | **identical** |
| newest action (the head) | — | **identical** |
| total / can_undo / can_redo | 39 / true / **true** | **identical** |
| checkpoints | 1 | **identical** |
| narrative state | 7 keys | **identical** |
| memories | **6** | **identical** |
| summaries | **2** | **identical** |
| knowledge sources | 1 | **identical** |
| narration length | `brief` | **identical** |
| memory_bank_enabled / auto_summarize | true / true | **identical** |
| settings | loopback placeholder | **identical** |
| **schema `user_version`** | **94** | **94** |

**All 15 census fields compared identical; 0 differ.** Schema parity is exact:
v1.0.0 and the candidate both stamp `user_version` 94 with 93 migrations, so the
upgrade required no migration at all, and nothing was rewritten in passing. A
fresh-install database from the candidate carries the same 94 (§M's import ran
migrations from nothing).

**A first pass at this gate was discarded.** It played 5 turns, which is below
the memory and summary thresholds, so it compared **0 memories against 0
memories** and proved nothing about two of the criterion's required contents;
its settings also carried the live hostname rather than a placeholder. Both were
corrected and the gate was rerun — the run reported above.

## O. Bundle compatibility

| Direction | Result |
| --- | --- |
| **v1.0.0 export → imported by v1.1** | **PASS** — imported, id 2 |
| **v1.1 export → offered to v1.0.0** | **ACCEPTED** — v1.0.0 imported it, id 1 |

Both directions were **executed**, not inferred from the unchanged format
string. The format is `ai-dnd-adventure-v3` on both sides, and it did not change
during release validation.

Backward import succeeding means the compatibility question the brief raised —
whether optional or additive v1.1 evidence data would break a v1.0.0 importer —
is answered in the negative for this campaign's contents: v1.0.0 accepted the
candidate's bundle whole. No bundle-format change was made or needed.

## P. WP-D regression

Reconfirmed on the candidate; no backup-affecting product code changed after
WP-D, so its 117 MB browser measurement is not repeated (the owner's brief
permits this).

| Claim | Result |
| --- | --- |
| The completed backup copy is verified with `PRAGMA integrity_check` | **PASS** — `app/backup.py:193`, docstring at 198–201 records why the full check replaced `quick_check` |
| The corruption fixture still separates the two pragmas | **PASS** — `quick_check` → `ok`, `integrity_check` → `row 145 missing from index i_t_k` |
| Oversized export still succeeds and is delivered | **PASS** |
| Importability metadata names the effective ceiling | **PASS** — "This export is larger than this version's **20 MB** import limit (… bytes). The file was exported successfully, but this version cannot import it." |
| Normal export unchanged in content | **PASS** |
| Oversized import still refused | **PASS** — 413 naming the limit |
| Suite | **12 passed** (`tests/test_v11_d_recovery.py`) |

## Q. WP-E regression

| Claim | Result |
| --- | --- |
| Contrast audit exit code | **0** |
| All applicable control boundaries ≥ 3:1 | **PASS** — every boundary pair clears 3:1 (1.4.11) |
| Applicable text contrast still compliant | **PASS** — every text pair clears 4.5:1 (1.4.3); baselines 14.57 / 13.57 / 5.48 / 5.88 unchanged |
| Browser boundary checks | **PASS** — the 10 WP-E rows in §G |
| Focus visibility | **PASS** — M11's visible-focus check inside the 38, plus WP-E's focused-edge measurement |
| Gate tests | **11 passed** (`tests/test_v11_e_contrast.py`), including 2.99:1 failing and 3.00:1 passing |

```text
OWNER SCREENSHOT APPROVAL: APPROVED
```

Approved by the owner in the release-validation brief of 2026-09-16. **No visual
code changed during release validation**, so that approval remains valid; had any
changed, it would have been void and new screenshots would have been required.

## R. Release-shaped smoke test

The **final no-cache candidate image**, a fresh volume, published on loopback,
with the private CA installed into the container's own trust store. Evidence:
`…/release-87a4032/smoke/`.

**15 checks, 15 passed, 0 failed.**

| Claim | Result |
| --- | --- |
| The container starts | PASS |
| The application answers on loopback | PASS |
| The port is published on **loopback only** | PASS — `8000/tcp -> 127.0.0.1:…` |
| This machine's **LAN address does not serve** the application | PASS |
| The first page loads | PASS — HTTP 200 |
| The shell references no remote origin | PASS — none found |
| A CSP is served | PASS |
| **The approved HTTPS narrator verifies through its private CA** | PASS — HTTP 200 through `tlstrust.ssl_context()`, **no bypass** |
| **A public endpoint is refused** | PASS — HTTP 400 |
| A campaign is created | PASS |
| **One real narrator turn is accepted** | PASS |
| The container restarts and serves again | PASS |
| The transcript survived the restart | PASS |
| The narrative state survived the restart | PASS |
| **Firefox renders the reopened campaign** | PASS — 470 characters of story |

**A finding worth recording, and it is not a product defect.** The first attempt
failed at `PUT /api/settings` with **HTTP 400**. The cause: a `.local` name is
mDNS, a Docker container has no mDNS resolver, and `endpoints.py` correctly
refuses an endpoint whose address it cannot classify — the policy behaving
exactly as designed. The fix is to resolve the name inside the container
(`--add-host`), **not** to substitute the IP address, because the certificate is
issued for the hostname and substituting the address would have quietly bypassed
the hostname verification this test exists to prove. Harness-only; no product
code changed.

This is supplemental evidence, not a substitute for the gates above.

## S. Security / local-only review

| Claim | Evidence on the candidate |
| --- | --- |
| Served on loopback only | every harness reached the application on `127.0.0.1`; the documented container run publishes loopback |
| Endpoint policy | `app/endpoints.py` admits loopback (v4 and v6), the three RFC1918 ranges, link-local, IPv6 unique-local and CGNAT, and refuses the public Internet; a name resolving to both a private and a public address is refused |
| Inference actually used | trusted-LAN **HTTPS** with a private CA for the browser gate (§G); plain HTTP to a LAN GPU host for the long run, which `SECURITY-THREAT-MODEL.md` §83 permits and which is not A06 evidence |
| No secret in exports | offline gate, WP-D tests and the M11 suite |
| CSP served | `default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self'; img-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'` |
| Other headers | `x-content-type-options: nosniff`, `referrer-policy: same-origin`, `x-frame-options: DENY` |
| No remote origin in the shell | offline gate: the page names none, and every asset is local |

`'unsafe-inline'` remains on `style-src` only, because React writes inline
`style` attributes; it is deliberately absent from `script-src`.

## T. Known residual risks

Each is classified, and none is collapsed into another category.

### T.1 WP-B reference-model memory limitation — ACCEPTED RESIDUAL

```text
deterministic independent memory: PASS
reference-model independent memory: FAIL
failing stage: memory creation — the summariser's content selection
owner decision: accepted for v1.1
```

**Status on this candidate:** unchanged, and no broader regression. The release
long run did not demonstrate independent recovery, but it also could not: its
probe failed the `absent_from_later_narration` precondition because the narrator
restated the fact (§K.2). Ranking, eviction and excerpt creation all pass
deterministically in the 1,723-test suite, and the bank worked normally through
102 turns (19 memories, ranked and injected). **Accepted residual**, carried
visibly, not a blocker.

### T.2 A2 mid-reply application-instruction echo — ACCEPTED RESIDUAL, still live

The known occurrence is WP-B.1's action 153 (depth 143): the narrator echoed the
length hint **mid-reply** and then continued the story, which A2's trailing
cleanup does not remove.

**Reproduced on this candidate.** Replaying that stored fixture through the
release-gate detector still flags it — **1 of 105** AI actions, matched by the
hard-limit/hint rule alone. The extractor still leaves it. This report therefore
does **not** claim protocol leakage is solved.

**But it did not recur in release evidence.** This run's own 105 stored replies
leak **0** (§J), and the browser run's narrated turns leak 0. The brief's
stop-and-report condition — *an equivalent shape occurring in this final run* —
was **not** triggered, so validation continues. No broader sanitizer was written;
that remains for owner review.

### T.3 Doubled full stop in memory-search scene text — ACCEPTED RESIDUAL

`"rain outside.."` when the state's scene summary already ends in punctuation.
Only the embedding query sees it; the effect is one stray token. Not changed
during release validation, deliberately: cleanliness is not a reason to alter
product behaviour after evidence is taken.

### T.4 K1 — "Correct" on an Important Facts row is always refused

**Reproduced, unchanged on this candidate**, deterministically and without a
browser: Correct on a Characters row (`subject='mara'`) applies, **201**; Correct
on an Important Facts row (`subject='f1'`) is refused, **400 — "add_fact names
subject='f1', which does not exist."** The cause is frontend-side: the panel
sends the row key as `add_fact.subject`, and the validator checks `subject` as an
entity reference.

**Classification: v1.2 backlog, not a release blocker.** It blocks no v1
REQUIRED test — C04 passes through the working correction paths (§C) — and WP-C's
State-panel correction coverage passes. It is a narrow bug with an obvious fix
(offer Correct only against entities, or send facts without a subject), but
fixing it during release validation would change product code after the evidence
above was taken, which the brief forbids without a product brief. **Left for the
owner.**

### T.5 Import ceiling and scheduled backups — INTENTIONAL, not unfinished work

The 20 MB import ceiling is deliberate and unchanged; WP-D made it honest rather
than raising it. Scheduled backups remain unbuilt by design. Neither is a
residual defect.

### T.6 Harness corrections made during validation — no product evidence invalidated

Three, all harness-only, each named where it occurred: the identity diagnostic
did not enable memory (§L); the smoke test needed hostname resolution inside the
container (§R); and the first upgrade campaign was too short to write memories
and carried a live hostname (§N). **No product code changed at any point during
release validation**, so no black-box or long-run evidence became stale. Each
corrected harness repeated its own affected check.

## U. Deferred v1.2 / future work

| Item | Why it is deferred |
| --- | --- |
| Raising the import ceiling, or a streaming import | The plan assigns it to v1.2; WP-D's scope was honesty about the limit, not the limit |
| Scheduled backups; a restore button | Explicitly out of WP-D's scope |
| K1's Correct-on-a-fact-row fix (§T.4) | A narrow frontend bug needing a product brief |
| A broader mid-reply protocol sanitizer (§T.2) | Needs owner review; A2's cleanup is deliberately trailing-only |
| The doubled full stop (§T.3) | Cosmetic, embedding-query only |
| K05 generate local image, K06 multi-turn video | FUTURE tests; both need a media provider this release does not build |
| Reference-model independent memory (§T.1) | Needs a stronger summariser or a different creation strategy — a v1.2 investigation, not a v1.1 fix |

## V. Documentation changes

Current documents were brought up to date. **No historical milestone report was
rewritten, and no failed WP-B real-model evidence was turned into success.**

| Document | Change |
| --- | --- |
| `README.md` | Status now says v1.0.0 **remains** the released version, that all six v1.1 packages are complete and accepted, that release validation passed on candidate `87a4032`, that WP-B ships with a documented limitation, and that **no `v1.1.0` tag exists and `main` is unchanged`**. Also corrected a stale figure: the schema is versioned at **94**, not "92 and counting" |
| `planning/V1.1-PLAN.md` | WP-D/WP-E recorded as signed `87a4032`; the release-validation outcome summarised with its residuals; the three owner events named as still outstanding |
| `planning/VERSION.md` | Same status correction, plus a new revision entry for the closeout |
| `planning/README.md` | Current-state paragraph rewritten for the same facts |
| `planning/reports/v1.1/V1.1-WP-E-REPORT.md` | `OWNER SCREENSHOT APPROVAL: PENDING` → **`APPROVED`**, with the source (the release-validation brief) and date recorded, and a note that the signed commit predated the review |
| `planning/reports/v1.1/V1.1-RELEASE-REPORT.md` | **New** — this document |
| `DEVELOPMENT.md` | Unchanged: its WP-C/WP-D sections already describe the candidate as built |

**New tools committed with this closeout** (harness only, no product code):
`backend/tools/v11_upgrade_check.py` (Gate 9) and
`backend/tools/v11_release_smoke.py` (§R), plus two narrow corrections to
`backend/tools/m11_identity.py` (read `AIDND_TEST_EMBED_MODEL`; enable the memory
bank) so the diagnostic can run with memory on.

## W. Final release decision

**The question this validation set out to answer:** does candidate `87a4032`
preserve the complete v1 contract and satisfy every accepted v1.1 package on one
integrated release tree?

| Gate | Result |
| --- | --- |
| 1 Package acceptance | **PASS** — six packages accepted; WP-B's qualification carried whole (§B.1) |
| 2 v1 acceptance contract | **PASS** — 81 PASS, H09 NOT APPLICABLE, 0 waived, 0 weakened, 0 reclassified (§C) |
| 3 Suites, lint, build, Docker | **PASS** — 1,723 / 175 / 0 errors; image SPA file-for-file identical (§D, §E) |
| 4 Offline / no-network | **PASS** — 23/23 on the candidate image (§F) |
| 5 Browser release run | **PASS** — 101/0/0 over trusted-LAN HTTPS, every turn `fits` (§G) |
| 6 Integrated long run | **PASS** — 102 turns, M01–M04, 0 post-turn failures (§H) |
| 7 Identity diagnostic | **PASS** — 0 signals, 0 protocol shapes, memory on (§L) |
| 8 Recovery | **PASS** — 16/16 on the run's own bundle (§M) |
| 9 v1.0.0 upgrade | **PASS** — 15/15 identical, schema parity at 94 (§N) |
| 10 WP-D regression | **PASS** (§P) |
| 11 WP-E regression | **PASS**, screenshots approved (§Q) |
| Bundle compatibility | **Both directions execute and import** (§O) |
| Release smoke | **PASS** — 15/15 from the shipped image (§R) |

**A1** holds its reserve on every re-counted prompt, with a smallest margin of
**879 tokens** against v1's 23–42. **A2**'s release-gate leak count is **0**.
**WP-B**'s deterministic independent-memory recovery passes and its
reference-model limitation remains an accepted, documented residual — stated in
§K.3 in both halves, never shortened to "WP-B passed".

No product code was changed at any point during release validation, so no
evidence was invalidated. Three harness corrections were made and each corrected
harness repeated its own check (§T.6).

```text
V1.1 RELEASE VALIDATION:
PASS
```

### What this decision is not

These are separate, and only the first is done:

```text
WP-A-E accepted:              YES
release validation passed:    YES
release candidate prepared:   YES  (87a4032, with this report)
release commit signed:        NO
main updated to v1.1:         NO
v1.1.0 tagged:                NO
```

The closeout changes are **staged and uncommitted**. Nothing was committed,
pushed, merged or tagged by this validation. The owner's next decision is to
review this evidence, resolve anything they disagree with, then sign the v1.1
release commit and publish `v1.1.0`.