Unreleased

This is the living release note for the next coordinated AppSurface version after 0.2.0-preview.8. It stays provisional until the next tag is cut.

What is taking shape

• Add merged public changes here as they land.

Included in the next coordinated version

Release and docs surface

• Add release-facing changes here as they land.

Rich Markdown authoring for Docs

• ForgeTrust.AppSurface.Docs now renders bounded Markdown callouts and contextual two-to-four-path tabs without requiring raw HTML or a client-only component. Pages keep a complete source-ordered baseline for static export and no-JavaScript readers; the optional accessible tabs enhancement preserves fragments, browser history, and Turbo-frame navigation. Invalid directives remain visible as literal source and appear in harvest health with stable remediation diagnostics, so documentation repositories can adopt the feature incrementally.

Coverage evidence execution

• appsurface coverage run and appsurface coverage gate now share one private execution engine with the built-in evidence run coverage producer. Coverage policies therefore evaluate the same collection, merge, gate, patch-target, artifact, and watchdog behavior regardless of which supported workflow invokes it; the private support package is not a new consumer dependency or installation choice.
• When an evidence policy supplies --diff-file, planning captures a bounded immutable snapshot before execution starts. Replacing that file later in the run cannot change the patch coverage input that the resolved policy evaluates.

Ordered local Keycloak seeds

• ForgeTrust.AppSurface.Auth.Aspire.Keycloak now exposes an AppHost-only, strictly ordered RealmReady() and WithLocalSeed(...) lifecycle for finite consumer-owned local projects. It keeps Keycloak Admin API clients, credentials, retries, mutation policy, and idempotent application state in the consumer worker while AppSurface supplies only the baseline proof, dependency graph, typed secret-reference validation, and redacted diagnostics.

• Start with the two-worker Keycloak AppHost sample. It demonstrates a persistent, rerun-safe broker/identity/fixture convergence chain and distinguishes startup-time local seeding from request-time DevAuth personas.

• ForgeTrust.AppSurface.Web.Tailwind now resolves its standalone CLI from a verified cache for the machine running the build, so normal consumers no longer restore a native runtime companion into application output. Direct runtime packages remain available for explicit compatibility workflows.

• Build automation that previously matched the missing-runtime ASTW004 diagnostic must handle the classified ASTW012 acquisition diagnostic instead; use the Tailwind diagnostic guide to distinguish cache, manifest, checksum, and offline recovery actions.

Typed Durable Work exits

• ForgeTrust.AppSurface.Durable now lets ProviderKeyed Work opt into a closed executor result: success, a proven pre-effect retry, terminal application failure, or an explicitly ambiguous external outcome. Existing IDurableWorkerExecutor<TWork, TResult> registrations remain unchanged; the PostgreSQL provider keeps effect permits, retry timing, cancellation, and fencing authoritative rather than exposing a direct state mutation or retry hook.
• Register the exit-aware contract as a new immutable Work version only after every worker that can discover it runs exit-capable Provider/PostgreSQL binaries. Follow the package guide's fleet-complete rollout and rollback boundary; a legacy provider fails conservatively instead of treating a non-success exit as a successful completion.

Migration watch

• Record-breaking or behavior-changing guidance here before it moves into the tagged release note.