Release 0.2.0-preview.5

This is the release note for AppSurface 0.2.0-preview.5 after 0.2.0-preview.4. It stays provisional until the next tag is cut.

What is taking shape

• The machine-held ForgeTrust.AppSurface.Durable.PostgreSql source preview now persists one-transition durable Flows: migration 0003 adds forced-RLS Flow state, command, history, wait, timer, and payload-free dispatch records; the new PostgreSqlDurableFlowClient supplies idempotent start/event/cancel/release operations; and an internal fenced processor proves event/timer races plus atomic child-Work projection through a timed real-PostgreSQL verifier. It still starts no hosted worker, applies no automatic DDL, and remains excluded from publication until later slices.
• appsurface coverage run now records monotonic per-operation progress, emits 30-second heartbeats by default, and warns after 10 minutes without observable progress. --watchdog fail additionally performs bounded whole-process-tree cleanup, writes privacy-minimized incident evidence when possible, and exits 124 with ASCOV121.
• appsurface secrets transfer plan|apply now plans and applies declared LocalSecrets and Google Secret Manager promotion jobs against existing Google secrets only. Plans bind configuration digest, expiry, and destination preconditions; --apply is required for mutation, production jobs require explicit confirmation, and all text/JSON diagnostics stay value-safe.
• ForgeTrust.AppSurface.Aspire.Testing now closes Aspire 13.4.4's partial-provider cleanup gap for profile tests. The builder captures the verified Aspire root provider immediately before host resolution, disposes it immediately when a non-process-fatal host construction fails, retains it for best-effort builder disposal after a process-fatal failure, preserves the original non-process-fatal build exception when cleanup also fails, and transfers ownership unchanged to the returned application after a successful build. Aspire dependencies now publish 13.4.4 as a minimum instead of an exact constraint, so consumers can select later versions without NU1608; an unfamiliar host-registration shape emits a trace warning and continues without the additional cleanup.
• ForgeTrust.AppSurface.Docs search results now render a bounded, safe rich summary presentation for authored Markdown emphasis and inline code while preserving the existing schema-v1 summary field, ranking behavior, and legacy-client fallback. The additive optional summaryPresentation payload is display-only: it carries no HTML, attributes, or URLs; external clients can ignore it or validate it atomically and fall back to summary then snippet.
• ForgeTrust.RazorWire now owns a deterministic Turbo 8.0.23 default: <rw:scripts /> emits an exact package-carried, same-origin runtime before RazorWire, while explicit custom and host-managed policies cover app-owned same-origin files or fully host-owned URL, integrity, CSP, and load-order requirements. The upgrade from 8.0.12 is API-neutral and carries an explicit upstream-risk review plus focused Drive, Frame, Stream, form, island, and Behavior Kit compatibility evidence.
• ForgeTrust.RazorWire Form Interactions now keeps duplicated mark-for-removal fields model-bindable by restoring the app-authored inactive value, defaulting to false, while identity and concurrency fields still clear. Combined duplicate, add, mark-delete, and submit workflows no longer fail with an empty Boolean value.
• The proof-only ForgeTrust.RazorWire.Cli export resolver now preserves caller cancellation while it probes application readiness. ResolveAsync returns OperationCanceledException when the caller cancels, including between zero-delay polling iterations, rather than reclassifying cancellation as a readiness timeout; treat cancellation as caller-owned control flow. This changes no command or package option.

Included in the next coordinated version

Release and docs surface

• appsurface coverage run now defaults to the VSTest coverlet.collector driver, validates each selected project's effective test runner and direct package references before cleanup or execution, and normalizes one validated Cobertura attachment per invocation into the stable artifact path. Native Microsoft Testing Platform projects fail preflight because they require coverlet.MTP; --coverage-driver msbuild remains available only as an explicit compatibility path and emits a reliability warning.
• appsurface coverage gate now applies a configurable --tolerance grace margin to overall and patch thresholds. The default 0.5 percentage point tolerance reduces rounding-related flakiness, 0 preserves strict enforcement, effective thresholds never fall below 0, invalid values fail before evaluation, and console plus Markdown and JSON reports show the effective thresholds they enforce while retaining configured thresholds for automation.
• ForgeTrust.AppSurface.Web.OpenApi now uses Microsoft.AspNetCore.OpenApi 10.0.9 and directly requires Microsoft.OpenApi in the range [2.7.5, 3.0.0), keeping .NET 10 consumers on the supported 2.x line above the range affected by GHSA-v5pm-xwqc-g5wc while preserving existing OpenAPI and Scalar APIs and endpoint behavior.
• appsurface coverage run can now start long-running non-exclusive test projects earlier with --schedule longest-first. It reuses prior timings.json data when available, preserves integration and Playwright projects as exclusive barriers, supports explicit priority projects, fails invalid explicit timing or priority input before tests run, warns and preserves input order for unmeasured projects when inferred prior timings are missing or unusable, and keeps artifact names stable.
• appsurface coverage run now supports repeatable --exclude-test-project segment globs for solution-discovered tests. Exclusions are normalized and case-insensitive, reject stale or malformed patterns before side effects, remain visible in list and dry-run output, preserve solution compilation, and are proven through the packaged CLI consumer with an excluded failing sentinel project.
• The ASP.NET Core DevAuth example now has deterministic, staged startup proof: synchronous build failures stop immediately, child exits and Kestrel readiness are observed separately, a child-owned listening record gates the real-loopback HTTP workflow, and cleanup targets only the recorded child. A child-scoped standard .NET host setting avoids configuration-reload stalls in restricted file-watcher environments without changing normal example or consumer behavior. Focused in-process host coverage complements rather than replaces the real-socket verifier, and failures preserve only bounded, sanitized, allowlisted evidence. This is a contributor-experience correction; it adds no package API, package or production-host runtime behavior, package version, or release implication.
• The coordinated package graph now addresses GHSA-pgww-w46g-26qg by pinning AppSurface Docs to exact AngleSharp [1.5.2], HtmlSanitizer [9.1.949-beta], and AngleSharp.Css [1.0.0-beta.216] dependencies. This is a dependency-only upgrade: AppSurface Docs public APIs, registration, configuration, and consumer usage are unchanged. The beta sanitizer/CSS pair is intentional only for preview releases; stable package verification rejects either prerelease dependency until issue #682 selects compatible stable versions. The Docs security boundary remains narrow: sanitization covers rendered package-documentation fragments, not general UGC or host CSP. The RazorWire CLI also carries the coordinated parser upgrade in its proof-only bundled tool graph, but remains excluded with publish_decision: do_not_publish; see its installation and publication boundary. The sanitizer regression proof passed all four Chromium variants: text/html and application/xhtml+xml, each exercised through title and style RCDATA handling.
• ForgeTrust.AppSurface.Web named canary evaluation is now available in preview: applications register typed, application-owned proof evaluators and explicitly map one fixed protected route family. Completed evaluations add required name, ready, and status fields plus optional typed evidence, a marker fingerprint, and up to 16 registration-declared bounded details. Existing AppSurfaceCanaryResult(status) construction remains source-compatible. Consumers must tolerate optional omissions, unknown fields, and property reordering; the contract remains preview until the #625 caller proves polling and operator actions. The canonical guide includes a complete forwarding evaluator, a contrasting migration fixture, copyable System.Text.Json and jq consumers, the #623-to-#624 upgrade contract, and separate under-5-minute authenticated-host and under-15-minute cold-path onboarding targets. The package emits fixed completion event 62401 with typed evaluation and host facts only; marker, reason, summary, correlation, and custom detail values remain response-only. Bounds and declarations constrain shape but do not classify or redact application-authored text. The default adapter still returns 200 only for pass and 503 for completed non-pass states; authenticated diagnostic consumers can opt into status-preserving AlwaysOk. Authorization remains host-owned and fail-closed, and triggering, retries, polling, aggregation, health-check adaptation, and /ready behavior remain outside this primitive.
• ForgeTrust.AppSurface.Web health and readiness probes are now opt-in. New hosts avoid ASP.NET Core health-check registration and /health plus /ready endpoint mapping unless WebOptions.Health.Enabled is explicitly set to true; enabled probes also avoid general route-handler binding during startup. Hosts whose deployment or monitoring infrastructure consumes those probes must enable the shared flag; paths, readiness tags, response semantics, validation, and authorization behavior are unchanged.
• ForgeTrust.RazorWire upgrades its package-owned Turbo UMD payload from 8.0.12 to 8.0.23 while preserving the existing Bundled, same-origin CustomPath, and HostManaged runtime-source contract. Static CDN and hybrid exports continue to materialize the exact bundled runtime.

Migration watch

• Existing silent coverage runs can retain that behavior with --heartbeat-interval 0 --watchdog off; use --no-progress-timeout to tune intentionally quiet suites without disabling watchdog classification.
• Existing appsurface coverage run consumers that reference coverlet.msbuild must replace it with coverlet.collector, or explicitly pass --coverage-driver msbuild while completing the migration. The command never silently falls back between drivers.
• Existing hosts that consume /health or /ready must set WebOptions.Health.Enabled = true when upgrading.
• Hosts using HostManaged with a Turbo version other than 8.0.23 own compatibility testing for that version. Turbo 8.0.23 removes upstream-deprecated Turbo.clearCache(), data-turbo-cache="false", and legacy form polyfills; these were never AppSurface-defined APIs.