# Release changes - 2026-10-06

V2 UI and enquiry overview remain the base. V1 production deployment intent is restored with fresh configuration and documentation rather than old verification claims.

- Migration-only startup, explicit demo/reset isolation, no default demo password, corrected local ports and nonroot production images.
- Reauthenticated password/email/MFA changes, pending verified email replacement, single-use MFA challenges, session revocation, notices and capability guards.
- Fail-closed ClamAV screening and stricter private file validation.
- Versioned ranking preview/approval/activation/rollback and independent professional appeal review; organic weights unchanged and payment remains outside scoring.
- Serialized enquiry routing, search indexes, actual public firm offices, client notifications and complete paged enquiry export.
- Durable worker status, truthful storage/billing/backup health, Redis TLS/auth/database selection, stronger webhook address screening and recursive audit redaction.
- Terms page, forward migration, isolated regression harness, dependency security patches and removal of unused S3 presigner.

See VERIFICATION.md for actual outcomes and external-service limitations. Initial comparison/audit artifacts are in docs; the manifest is regenerated from the final shipped files.

## Restored and preserved

Restored from V1 intent: standalone production Compose, deployment guidance, verification report and regenerated release manifest. Old V1 hashes/test results are not reused. Preserved from V2: password visibility controls, client/professional/staff layouts, lawyer-wise enquiry overview, search/filter/pagination and existing billing, firm, lead, ranking, SEO and privacy workflows.

## Removed or excluded

No existing functional feature file was deleted. Removed demo shortcuts/password display from the login component and the unused S3 presigner package. Production image removes seed source/compiled fixtures, test scripts and test files. Demo fixtures remain development-only so isolated regression tests can exercise realistic data. Release packaging excludes dependencies/builds/cache/logs, environment secrets, uploads, earlier archives and disposable verification artifacts; these remain intact in the working directory.

## Database and configuration

Forward migration 0008 adds pending email requests, ranking governance metadata/appeals, worker health and enquiry search indexes, plus the MFA challenge enum. Existing migrations/data remain intact. A fresh schema snapshot and explicit snake_case generation setting prevent duplicate future schema changes. Production mode is explicit and fail-closed, startup migrates only, database/cache/scanner have private network access, web domains are set during builds and local alternate ports are used consistently.