Deploy Site Selection and RFP Studio v17.1 collision recovery

DEPLOYMENT_NOTES.md

@@ -1,6 +1,6 @@
 # Deployment notes
 
-Deployment package: v17.0-guided-four-step-incentive-workflow (2026-08-20)
+Deployment package: v17.1-variable-secret-collision-recovery (2026-08-20)
 
 Protected runtime: v17-guided-four-step-incentive-workflow
 
@@ -13,6 +13,11 @@ Validation controls:
 - Requires the canary to reach `RUNNING` and expose the protected runtime markers.
 - Deletes the canary after validation.
 - Does not touch production unless the canary passes.
+- Detects names present in both Variables and Secrets before confirmation.
+- After explicit DEPLOY approval, removes only allowlisted duplicate copies in
+  the wrong category and refuses to guess about unrecognized collisions.
+- Never creates runtime Variables as Secrets and never deletes the five
+  allowlisted application credential/encryption Secrets.
 - Always refreshes the release-specific application-source key in production.
 - Preserves the persistent RFP data-encryption key unless it is missing.
 - Verifies uploaded production README, requirements, and encrypted app hashes.

README.md

@@ -14,11 +14,13 @@ short_description: Site selection, RFP responses, and incentives.
 
 Encrypted private Gradio application.
 
-Protected runtime: `v17-guided-four-step-incentive-workflow`. Deployment package: `v17.0-guided-four-step-incentive-workflow (2026-08-20)`.
+Protected runtime: `v17-guided-four-step-incentive-workflow`. Deployment package: `v17.1-variable-secret-collision-recovery (2026-08-20)`.
 
 The updater first proves this exact five-file package in a temporary private
 canary Space. Production is not modified unless the canary reaches `RUNNING`,
 the protected runtime markers are present, and the runtime remains stable.
+Before production upload, it also resolves known Variable/Secret name collisions
+by deleting only the duplicate copy in the wrong category.
 
 Guided workflow: