Release 0.2.0-preview.12

This is the release note for AppSurface 0.2.0-preview.12 after 0.2.0-preview.11. It stays provisional until the next tag is cut.

What is taking shape

Included in the next coordinated version

Release and docs surface

Immediate feedback for RazorWire forms

• RazorWire now shows an app-authored status as soon as an enhanced form submission is accepted, including waits for lazy anti-forgery preparation or a slow server. Forms without an applicable status use a compact top bar by default. The form loading guide explains indicator boundaries, styling, opt-outs, duplicate submission protection, and retry behavior after token failure.

Larger published Docs archives

• The AppSurface Docs archive verifier now accepts --max-rewritten-file-size-bytes so operators can check an exact tree against the same explicit rewrite limit configured on a mounting host. The default remains 4 MiB, and the supported ceiling remains 32 MiB. Hosts mounting the 0.2.0-preview.11 docs archive need a 16 MiB limit for its 8.7 MB search index; the release publication workflow uses that limit while preserving the immutable tagged archive.

Explicit dialog responses for RazorWire

RazorWire applications can return a status or save response in a supplied accessible modal shell, including an app-owned form. Choose OpenDialog* explicitly, overwrite a pending body with ReplaceDialog*, and use CloseDialog() to close after success. The response builder keeps one dialog slot and exposes HasActiveDialog; overwritten content is never rendered.

Start with the dialog response guide and the MVC example. They cover validation focus, response ordering and stale-flow protection, full HTML fallbacks, and application concurrency responsibilities.

DevAuth persona fixture activation

• Hosts can opt into an awaited, request-scoped DevAuth handler that prepares local fixtures after a valid persona selection queues its protected cookie and before DevAuth redirects or renders the control page. The default remains unchanged without a handler; hosts own readiness, persistence, deadlines, and recovery because cookie delivery and fixture writes are not atomic. See the activation contract and compiled shared-candidate example.

Passive Durable external activation service (#804)

• Add a provider-neutral external activation service and canonical v1 reference for payload-free wakes, explicit cooperative request budgets, validated outcomes, recovery guidance, and bounded activity tags. The authenticated PostgreSQL reference host and executable first-start guide show restricted-role provisioning, explicit schema and epoch setup, typed CLI acceptance, pre-heartbeat probes, and an authorized empty wake without starting a worker loop. Its PostgreSQL lifecycle test verifies persisted Work completion and bounded activation telemetry export through ForceFlush.

Inline mapped Google secret startup reads

• Google Secret Manager configuration now performs a cold, no-token mapped secret fetch on the first caller instead of scheduling that synchronous client call on a worker. Concurrent reads of the same exact resource still share one fetch; audited or cancellable reads retain their bounded worker path and per-caller cancellation. Apps using mapped Google secrets need no code change. The package guide explains how a slow synchronous client call can still hold the first caller until the configured lookup timeout.

Migration watch

Complete runtime-set PostgreSQL preflight

• appsurface durable schema preflight now requires --role-pairs-file and --migration-owner-role, including for one-pair stores. It checks every runtime in the unchanged complete manifest in one fenced read-only snapshot, reports the credential's pair and manifest hash, and rejects policy, grant, owner or privilege drift. Update existing invocations to supply both reviewed inputs.
• A successful owner diagnostic cannot replace runtime credential evidence. The schema-11 operations checklist requires matching StoreId and epoch, one pass per distinct runtime, both lane proofs and a continuous owner guard through activation. Candidate and public package proofs are separate gates; structural preflight does not initialize the epoch or authorize a later deployment.