release(email): prepare App12 trusted no-diff upgrade

README.md

@@ -16,11 +16,11 @@ Email builds without a Deft source checkout or private Deft imports. Operators u
 
 ## Supported compatibility set
 
-The [published compatibility manifest](https://github.com/Maneek21/deft-email/releases/download/v1.9.0-preview.30/compatibility.json) is the authoritative detached public release record. The repository [`release/compatibility.json`](release/compatibility.json) is its source template and also records that URL. The published record identifies the Host version/commit/image/schema, App and Runtime versions, each component's Kit, public assets, checksums and corresponding source. Use its verified publication state and release assets; a candidate record or open PR does not establish that downloads are available.
+The [published compatibility manifest](https://github.com/Maneek21/deft-email/releases/download/v1.9.0-preview.31/compatibility.json) is the authoritative detached public release record. The repository [`release/compatibility.json`](release/compatibility.json) is its source template and also records that URL. The published record identifies the Host version/commit/image/schema, App and Runtime versions, each component's Kit, public assets, checksums and corresponding source. Use its verified publication state and release assets; a candidate record or open PR does not establish that downloads are available.
 
-Release bundle **1.9.0-preview.30** builds App **1.9.1-preview.11** and Runtime **0.4.0-preview.28**, both with the exact published Kit **0.1.0-alpha.42** from Host134. Email owns its author/runtime domain modules and uses clean Kit entry points. The supported Host requires schema **131** and the exact generic contracts in the manifest. An older stable Host or a matching schema number alone is insufficient.
+Release bundle **1.9.0-preview.31** builds App **1.9.1-preview.12** and Runtime **0.4.0-preview.28**, both with the exact published Kit **0.1.0-alpha.42** from Host134. Email owns its author/runtime domain modules and uses clean Kit entry points. The supported Host requires schema **131** and the exact generic contracts in the manifest. An older stable Host or a matching schema number alone is insufficient.
 
-This release requires Host **0.3.0-preview.137 or newer**. It adds an opted-in read-only Reply snapshot combining saved-draft existence and exact original hydration under fresh final checks, alongside clearer mailbox states and action notices, early technical renewal, scoped service reacquisition after expired leases, durable Gmail refresh reconciliation and a process-lifetime writer lock. A Host-authorized, receipt-backed registration transition lets a trusted compatible App upgrade continue without operator-file or token edits. Host installation trust is explicitly off by default; current account, private-storage, metadata and effect permissions remain independent. No renewal or recovery path sends a message or retries a provider effect. [Recovery and rollout details](runtime/UNATTENDED-RECOVERY.md).
+This release requires Host **0.3.0-preview.138 or newer**. It adds an opted-in read-only Reply snapshot combining saved-draft existence and exact original hydration under fresh final checks, alongside clearer mailbox states and action notices, early technical renewal, scoped service reacquisition after expired leases, durable Gmail refresh reconciliation and a process-lifetime writer lock. A Host-authorized, receipt-backed registration transition lets a trusted compatible App upgrade continue without operator-file or token edits. Host installation trust is explicitly off by default; current account, private-storage, metadata and effect permissions remain independent. No renewal or recovery path sends a message or retries a provider effect. [Recovery and rollout details](runtime/UNATTENDED-RECOVERY.md).
 
 Previous release bundle **1.9.0-preview.18** selects Host **0.3.0-preview.125**. The Runtime now accepts background sessions that the Host delivers when an owner re-establishes background access after an App upgrade, so nobody copies session tokens into operator files. The App and both Kit packages are unchanged. Host preview.125 still uses schema120; no schema migration is needed.
 

app/package.json

@@ -7,7 +7,7 @@
     "@deft/app-kit": "file:deft-app-kit-0.1.0-alpha.42.tgz",
     "esbuild": "0.28.2"
   },
-  "version": "1.9.1-preview.11",
+  "version": "1.9.1-preview.12",
   "scripts": {
     "build": "node build.mjs",
     "test": "node --test release-package.test.mjs imported-history.test.mjs",

app/release-package.test.mjs

@@ -23,7 +23,7 @@ test('packed public Kit keeps the displayed target on a mailbox refresh', async
 
 test('fresh package authenticates its manifest and worker artifact against public Kit42', () => {
   assert.equal(DEFT_APP_KIT_VERSION, '0.1.0-alpha.42');
-  assert.equal(metadata.version, '1.9.1-preview.11');
+  assert.equal(metadata.version, '1.9.1-preview.12');
   assert.equal(compatibility.email.tag, 'v' + rootMetadata.version);
   assert.equal(compatibility.email.app_version, metadata.version);
   assert.equal(compatibility.host.minimum_version, '0.3.0-preview.138');

docs/author-independence.md

@@ -2,7 +2,7 @@
 
 The developer-preview claim is specific: a developer can build this connected Email App from its public repository and public Author Kit packages, sideload it into a compatible Deft Host, deploy its provider Runtime separately, and update Email without changing that Host. It does not claim that operator setup is automatic or that any older Deft release accepts these contracts.
 
-Use [the compatibility manifest](https://github.com/Maneek21/deft-email/releases/download/v1.9.0-preview.30/compatibility.json) for exact artifacts and [verification](verification.md) for acceptance. Historical demo results remain tied to their own versions.
+Use [the compatibility manifest](https://github.com/Maneek21/deft-email/releases/download/v1.9.0-preview.31/compatibility.json) for exact artifacts and [verification](verification.md) for acceptance. Historical demo results remain tied to their own versions.
 
 ## Ownership
 

docs/compatibility.md

@@ -2,13 +2,13 @@
 
 [`release/compatibility.json`](../release/compatibility.json) is the source template and entry point. Follow its `authoritative_release_manifest` URL for the single authoritative detached cross-component release record. Use that resolved record for exact Host and Email commits, versions, image digests, schema/contracts, Kit artifacts, download locations, checksums and corresponding source. The publication state in that record distinguishes a prepared candidate from a verified public release. Do not replace its pins with a branch tip, a similarly named preview or a demo image.
 
-## Release preview.30 contract
+## Release preview.31 contract
 
-Bundle preview.30 requires Host138 or newer and pairs App1.9.1-preview.11 with Runtime0.4.0-preview.28. Read-only Reply hydration uses current-source presentation data while repeating fresh authority checks; first-save revalidation is unchanged. Both use the exact Kit42 archive published by Host134. Historical Kits and their original source offers remain immutable. Rollback requires matched Host/App/Runtime and data snapshots.
+Bundle preview.31 is an App-only no-diff upgrade candidate requiring Host138 or newer and pairing App1.9.1-preview.12 with the exact unchanged Runtime0.4.0-preview.28 from preview.30. No Runtime redeployment is required. Read-only Reply hydration uses current-source presentation data while repeating fresh authority checks; first-save revalidation is unchanged. Both use the exact Kit42 archive published by Host134. Historical Kits and their original source offers remain immutable. Rollback requires matched Host/App/Runtime and data snapshots.
 
 | Component | Version/contract |
 |---|---|
-| Email App | `1.9.1-preview.11` |
+| Email App | `1.9.1-preview.12` |
 | App Author Kit | `0.1.0-alpha.42` |
 | Email Runtime | `0.4.0-preview.28` |
 | Runtime Author Kit | `0.1.0-alpha.42` |
@@ -18,7 +18,7 @@ Bundle preview.30 requires Host138 or newer and pairs App1.9.1-preview.11 with R
 
 Kit42 isolates app-owned domain behavior behind clean core and experience/core entries while retaining deprecated compatibility exports. Both consumers adopt its exact published Host134 bytes; this is a reviewed API/ownership migration. [Release provenance](kit42-preparation.md), immutable pins, both frozen locks, and vendor/domain provenance checks bind the artifact.
 
-Host138 reduces generic current-authority payload, validation and SQL costs. Deploy it before enabling App11/Runtime28. Host137 supplied opted-in compound seed snapshots and current-opening recovery proof; Host136 supplied generic source-seeded forms, scoped read recovery and hidden-image presentation; Runtime27 also preserves the old source_refs creation path. The Host must also provide generic record-form v3, prepared supplemental effects, inspection v2, source nomination v2, reviewed persistent-permission policy, the consent-continuation phase gate and the resource-refresh contract. Schema131 alone does not prove those later fixes are present; use the manifest's exact Host artifact.
+Host138 reduces generic current-authority payload, validation and SQL costs. Deploy it before enabling App12/Runtime28. Host137 supplied opted-in compound seed snapshots and current-opening recovery proof; Host136 supplied generic source-seeded forms, scoped read recovery and hidden-image presentation; Runtime27 also preserves the old source_refs creation path. The Host must also provide generic record-form v3, prepared supplemental effects, inspection v2, source nomination v2, reviewed persistent-permission policy, the consent-continuation phase gate and the resource-refresh contract. Schema131 alone does not prove those later fixes are present; use the manifest's exact Host artifact.
 
 Bundle preview.17 pairs App preview.14 and Runtime preview.17 with Host preview.125. Searched and conversation messages are now published as Task sources, so Email → Task works for newly found messages, and draft opening is bounded. Host preview.125 carries the matching Task-review recovery, backend reliability and agent fixes from the 18 October release rehearsal. Both Kit packages are unchanged. Host preview.125 still uses schema120; it adds no migration.
 

docs/independence-upgrade.md

@@ -2,7 +2,11 @@
 
 The existing example is an optional private note on a draft, up to 1000 characters, kept out of outgoing MIME. It is already implemented; no new feature is needed to demonstrate independence. New drafts may use the note, while retained pre-note drafts keep their original form without an on-read migration.
 
-Current App and Runtime identities come from [the compatibility manifest](https://github.com/Maneek21/deft-email/releases/download/v1.9.0-preview.30/compatibility.json). This source is App `1.9.1-preview.11` and Runtime `0.4.0-preview.28`, both with published Kit42 from Host134. Historical App7/Runtime9 upgrade/retention receipts apply only to those frozen versions. [Verification](verification.md) records which final-release evidence was reused and which checks were rerun.
+Current App and Runtime identities come from [the compatibility manifest](https://github.com/Maneek21/deft-email/releases/download/v1.9.0-preview.31/compatibility.json). This source is App `1.9.1-preview.12` and Runtime `0.4.0-preview.28`, both with published Kit42 from Host134. Historical App7/Runtime9 upgrade/retention receipts apply only to those frozen versions. [Verification](verification.md) records which final-release evidence was reused and which checks were rerun.
+
+## App12 no-diff candidate
+
+App12 changes the App version while retaining App11's exact Experience artifact, UI/domain bytes and authority declarations. Runtime28 source, version and packaged bytes are unchanged. A later ordinary green release and trusted stage/context/review/activate exercise must retain the existing Runtime28 sole writer and require eligible continuity, `authority_carry_forward`, no authority diff, no blockers, and zero permission/reconnect/recovery steps. Local packaging evidence does not establish that the live upgrade has occurred.
 
 ## Trusted compatible upgrade and restart recovery
 

docs/limitations.md

@@ -1,6 +1,6 @@
 # Developer-preview limitations
 
-This preview demonstrates a connected, independently deployed Email App using public Deft contracts. It is intended for developers and operators, with Gmail as the accepted provider path. It does not promise effortless onboarding, full Gmail/Outlook parity or production-scale operation. Exact published identities and acceptance belong to [the compatibility manifest](https://github.com/Maneek21/deft-email/releases/download/v1.9.0-preview.30/compatibility.json) and [verification](verification.md).
+This preview demonstrates a connected, independently deployed Email App using public Deft contracts. It is intended for developers and operators, with Gmail as the accepted provider path. It does not promise effortless onboarding, full Gmail/Outlook parity or production-scale operation. Exact published identities and acceptance belong to [the compatibility manifest](https://github.com/Maneek21/deft-email/releases/download/v1.9.0-preview.31/compatibility.json) and [verification](verification.md).
 
 ## Known behavior
 

docs/release.md

@@ -1,6 +1,6 @@
 # Developer-preview release procedure
 
-This release demonstrates an independently built connected App using public Author Kit contracts. It does not certify a production mail service or add roadmap features. [The compatibility manifest](https://github.com/Maneek21/deft-email/releases/download/v1.9.0-preview.30/compatibility.json) is authoritative for the final integrated source and artifacts; [limitations](limitations.md) must accompany the prerelease.
+This release demonstrates an independently built connected App using public Author Kit contracts. It does not certify a production mail service or add roadmap features. [The compatibility manifest](https://github.com/Maneek21/deft-email/releases/download/v1.9.0-preview.31/compatibility.json) is authoritative for the final integrated source and artifacts; [limitations](limitations.md) must accompany the prerelease.
 
 ## Freeze and integrate
 

docs/setup.md

@@ -1,6 +1,6 @@
 # Developer-preview setup
 
-Use the exact Apps-enabled Host and public artifacts in [the authoritative compatibility record](https://github.com/Maneek21/deft-email/releases/download/v1.9.0-preview.30/compatibility.json). The supported Host requires schema **131** and the matching generic contracts, not merely an older compatible-looking release label. Check the record's publication state and download hashes before starting. [Verification](verification.md) distinguishes previous demo evidence from final public acceptance.
+Use the exact Apps-enabled Host and public artifacts in [the authoritative compatibility record](https://github.com/Maneek21/deft-email/releases/download/v1.9.0-preview.31/compatibility.json). The supported Host requires schema **131** and the matching generic contracts, not merely an older compatible-looking release label. Check the record's publication state and download hashes before starting. [Verification](verification.md) distinguishes previous demo evidence from final public acceptance.
 
 The external consumer path is: obtain compatible Deft → independently build Email → sideload/review it → configure the separately operated Runtime, HTTPS/OAuth and authority → use Email and source integrations → [upgrade Email against the same Host](independence-upgrade.md). This requires operator work; no Deft source checkout, private import, native Email adapter or SQL patch is part of the Email installation.
 

docs/verification.md

@@ -1,6 +1,12 @@
 # Verification and acceptance
 
-Use [the authoritative compatibility record](https://github.com/Maneek21/deft-email/releases/download/v1.9.0-preview.30/compatibility.json) for the exact release source, artifacts, checksums and publication state. A prepared candidate is not published merely because its files build. The final public prerelease must link its acceptance results and disclose unverified behavior.
+Use [the authoritative compatibility record](https://github.com/Maneek21/deft-email/releases/download/v1.9.0-preview.31/compatibility.json) for the exact release source, artifacts, checksums and publication state. A prepared candidate is not published merely because its files build. The final public prerelease must link its acceptance results and disclose unverified behavior.
+
+## App12 no-diff candidate: local evidence
+
+The Email31/App12 candidate uses the same UI/domain and Runtime source as Email30/App11. Each App package was built twice with identical bytes per version. After normalizing only `manifest.version`, the App12 manifest equals App11, including the exact Experience digest `sha256:19d7691bcf24c94e7abce5379ca431025d1fa63294bd731356d76fe38f5acd9a`. The Worker bundle is identical (`1b5929e929f5a273c2328ae5b1b12c6a1e8b30f96ee69d43d4d2aa570a827d58` SHA256).
+
+Runtime28 remains version `0.4.0-preview.28`; all 372 tracked Runtime files, Kit42 archives and producer/provenance records are unchanged. Both source packages produce the same Runtime archive SHA256 `f61a18c099adf3b11a95c7e9fba6161291423f999fb91c1c7d81f919b4f51b0b`. Fresh local App package tests (8), UI tests (48), immutable pin/vendor provenance and standalone Runtime archive checks (166 server-reachable modules; startup/shutdown with synthetic private configuration) passed. These are local artifact results; no future CI result, public release or live trusted upgrade is claimed. A later live no-diff exercise must reuse the existing sole Runtime28 writer and record zero permission-review, reconnect and recovery steps without Send.
 
 ## Evidence that can be reused
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "deft-email-preview",
-  "version": "1.9.0-preview.30",
+  "version": "1.9.0-preview.31",
   "private": true,
   "license": "AGPL-3.0-only",
   "type": "module",