Deploy SAT & ACT Learning Lab 1.7.7+hfbuild3

DEPLOYMENT_NOTES.md

@@ -1,4 +1,4 @@
-# Deployment notes — SAT & ACT Learning Lab 1.7.6+hfbuild3
+# Deployment notes — SAT & ACT Learning Lab 1.7.7+hfbuild3
 
 Target private Space: `DearmonAnalytics/SAT_ACT_Learning_Lab`
 
@@ -6,7 +6,7 @@ Turso database: `dearmon-sat-act-learning-lab`
 
 Schema namespace: `sat_act_learning_lab_v1`
 
-Encrypted-source secret: `SAT_ACT_APP_FERNET_V1_7_6_HFBUILD3_E5866A94B4E1_6BE5E0AD5249`
+Encrypted-source secret: `SAT_ACT_APP_FERNET_V1_7_7_HFBUILD3_067CBFE1E7D0_C1A4FBDDCEB8`
 
 ## Runtime contract
 
@@ -95,7 +95,7 @@ Encrypted-source secret: `SAT_ACT_APP_FERNET_V1_7_6_HFBUILD3_E5866A94B4E1_6BE5E0
 
 Core secrets are `OPENAI_API_KEY`, `TURSO_DATABASE_URL`, `TURSO_AUTH_TOKEN`,
 `LEARNER_ID_HMAC_SECRET`, `INSTRUCTOR_EXPORT_SECRET`, and
-`SAT_ACT_APP_FERNET_V1_7_6_HFBUILD3_E5866A94B4E1_6BE5E0AD5249`. Live avatar video additionally uses optional
+`SAT_ACT_APP_FERNET_V1_7_7_HFBUILD3_067CBFE1E7D0_C1A4FBDDCEB8`. Live avatar video additionally uses optional
 `SIMLI_API_KEY`.
 
 Email recovery uses `AUTH_RECOVERY_EMAIL_ENABLED`, `AUTH_SMTP_HOST`,
@@ -117,7 +117,7 @@ packaged Simli client route, and transport settings are listed in
 `environment.example` used to prepare this deployment. Remote avatar-client
 module overrides are intentionally rejected.
 
-Version 1.7.6+hfbuild3 uses immutable item/timing/scoring snapshots and explicit recovery
+Version 1.7.7+hfbuild3 uses immutable item/timing/scoring snapshots and explicit recovery
 compatibility contracts. Resume only a saved contract that is explicitly supported;
 legacy checkpoints follow the tested compatibility allowlist. Incompatible work
 stays blocked and requires an approved transition or learner choice, never silent
@@ -133,7 +133,7 @@ validated application patch. This Space explicitly selects python_version:
 "3.12.13"; the builder verifies agreement with runtime.txt and the loader.
 Health verification records the actual interpreter before deployment succeeds.
 
-Acceptance testing for v1.7.6+hfbuild3 must verify the exact Dearmon Analytics paper,
+Acceptance testing for v1.7.7+hfbuild3 must verify the exact Dearmon Analytics paper,
 ink, blue, teal, and coral palette; compact 1,240-pixel workspace; bundled
 same-origin Inter, Source Serif 4, and Geist Mono; and one crisp DA gradient rule
 across the compact chooser and three shadow-free horizontal Practice rails.
@@ -210,7 +210,7 @@ safe retries without prompting the deployer operator.
 
 ## Key lifecycle and rollback
 
-The current loader reads only `SAT_ACT_APP_FERNET_V1_7_6_HFBUILD3_E5866A94B4E1_6BE5E0AD5249`. A later release must generate a
+The current loader reads only `SAT_ACT_APP_FERNET_V1_7_7_HFBUILD3_067CBFE1E7D0_C1A4FBDDCEB8`. A later release must generate a
 new versioned, fingerprinted secret name. The deployer adds that secret before
 the repository commit and retains earlier keys. Roll back by reverting the
 Space repository to the prior commit recorded in `deployment_receipt.json`.

README.md

@@ -14,7 +14,7 @@ short_description: Dynamic SAT/ACT practice, mastery, and reasoning graphs
 
 # Dearmon Analytics SAT & ACT Learning Lab
 
-Release `1.7.6+hfbuild3` provides original dynamic practice for current SAT and
+Release `1.7.7+hfbuild3` provides original dynamic practice for current SAT and
 ACT skill blueprints, a complete eight-level question-skill hierarchy,
 individual mastery tracking, targeted practice, and test-like diagnostic
 sessions with separate raw results and unofficial practice-score estimates. It adds username/password
@@ -25,7 +25,7 @@ Signed-in students can also download their complete personalized Topic Graph as
 a branded PNG, printable PDF, accessible hierarchy-and-concepts CSV, and
 verification manifest; demo sessions remain nonexportable.
 
-Release 1.7.6+hfbuild3 retains the exact Dearmon Analytics paper, ink, blue, teal, and
+Release 1.7.7+hfbuild3 retains the exact Dearmon Analytics paper, ink, blue, teal, and
 coral system established in v1.4.4 for the compact 1,240-pixel workspace. Bundled Inter, Source Serif 4, and
 Geist Mono fonts are served from same-origin routes. The compact test chooser
 and closely stacked Section → Domain → Narrow Topic rails use one restrained DA
@@ -45,7 +45,7 @@ printable exam/answer-key PDFs so raw LaTeX is never the learner-facing
 fallback. The collapsed item-specific Concepts Needed swim lane, complete
 analogous worked examples, separate hints, and mastery whitening remain.
 
-Release 1.7.6+hfbuild3 assigns all 1,983 trusted built-in question profiles their full
+Release 1.7.7+hfbuild3 assigns all 1,983 trusted built-in question profiles their full
 Exam → Section → Official Domain → Official Skill Family → Narrow Exam
 Target → Prerequisite Bundle → Atomic Skill → Observable Failure Attribute
 path. Each stable profile contains its complete ancestor and transitive-
@@ -73,7 +73,7 @@ pretest/EFT items and AI supplemental printable items are excluded. Fewer than
 eight observed items or less than one quarter of a standard section remains a
 preliminary, very-low-confidence result below the reporting threshold.
 
-Release 1.7.6+hfbuild3 retains one OpenAI-assisted follow-up beneath each graded
+Release 1.7.7+hfbuild3 retains one OpenAI-assisted follow-up beneath each graded
 explanation and a signed-in cross-question Learning Diagnostic. The diagnostic
 unlocks only after strict majority coverage of both Reading and Math for the
 same exam. It sends OpenAI only allowlisted aggregate performance evidence—not
@@ -126,7 +126,7 @@ attribute-level mastery or retention records.
 This private Space uses the separate Turso database
 `dearmon-sat-act-learning-lab` and schema namespace
 `sat_act_learning_lab_v1`. Its encrypted application uses the versioned Space
-secret `SAT_ACT_APP_FERNET_V1_7_6_HFBUILD3_E5866A94B4E1_6BE5E0AD5249`.
+secret `SAT_ACT_APP_FERNET_V1_7_7_HFBUILD3_067CBFE1E7D0_C1A4FBDDCEB8`.
 
 Required Space secrets are `OPENAI_API_KEY`, `TURSO_DATABASE_URL`,
 `TURSO_AUTH_TOKEN`, `LEARNER_ID_HMAC_SECRET`, `INSTRUCTOR_EXPORT_SECRET`, and
@@ -153,13 +153,17 @@ Username passwords are stored as independently salted scrypt records. Account
 lockouts persist in the database, password changes revoke earlier sessions,
 and verified legacy name/class/PIN profiles can be converted without moving
 their mastery history. Each account receives a one-time-display offline
-recovery key that rotates after use. Email one-time-code recovery is optional;
-configure `AUTH_RECOVERY_EMAIL_ENABLED`, `AUTH_SMTP_HOST`, `AUTH_SMTP_PORT`,
-`AUTH_SMTP_USERNAME`, `AUTH_SMTP_PASSWORD`, `AUTH_SMTP_FROM_EMAIL`,
-`AUTH_SMTP_STARTTLS`, `AUTH_SMTP_SSL`, and optional
-`AUTH_SMTP_TIMEOUT_SECONDS`; keep provider credentials as Space secrets. Email
-codes expire after 15 minutes and are single-use. Without SMTP, offline
-recovery remains available.
+recovery key that rotates after use. Account email on Hugging Face uses Resend
+over HTTPS because standard SMTP ports are blocked. Set
+`AUTH_EMAIL_PROVIDER=resend`, `AUTH_EMAIL_FROM` to an address on your verified
+sending domain, `AUTH_RESEND_API_KEY` as a Space Secret, and
+`AUTH_RECOVERY_EMAIL_ENABLED=1`. The private kit includes `SETUP_EMAIL.bat`
+and `docs/EMAIL_RECOVERY_SETUP.md` for configuration and delivery checks.
+Provider credentials belong in Secrets, never public Variables or source.
+Use the code from your most recent request: codes expire 15 minutes after
+the request, work once, and are replaced by a newly requested code. Delayed
+emails may arrive out of order. A saved offline recovery key remains available
+when email is unavailable.
 
 The one-click demo has a 45-minute ordinary-use window and starts with clearly
 labeled sample progress. Starting a full simulation reserves its blueprint
@@ -175,7 +179,7 @@ controls, and retention policies.
 
 ## Upgrade note
 
-Version 1.7.6+hfbuild3 uses immutable item/timing/scoring snapshots and explicit recovery
+Version 1.7.7+hfbuild3 uses immutable item/timing/scoring snapshots and explicit recovery
 compatibility contracts. Resume only a saved contract that is explicitly supported;
 legacy checkpoints follow the tested compatibility allowlist. Incompatible work
 stays blocked and requires an approved transition or learner choice, never silent

release_manifest.json

@@ -1,18 +1,18 @@
 {
-  "built_utc": "2026-09-10T01:51:35+00:00",
+  "built_utc": "2026-09-10T02:40:34+00:00",
   "database_name": "dearmon-sat-act-learning-lab",
-  "encrypted_payload_sha256": "ed3c03a1e76da4fa5236d682ecf711b77f07ac6053b97043c216df5f304ba03d",
+  "encrypted_payload_sha256": "784cb86efec55e74284d27a0fe06f7de139ded20c07134a25ec393529f0ebea2",
   "entry_module": "sat_act_lab.app_main",
-  "fernet_secret_name": "SAT_ACT_APP_FERNET_V1_7_6_HFBUILD3_E5866A94B4E1_6BE5E0AD5249",
-  "key_fingerprint_sha256_prefix": "6BE5E0AD5249",
-  "plaintext_archive_sha256": "e5866a94b4e1b40fcdc000fdbcbf83fff1b7f03ecec2ba118e055b21ac60d789",
-  "release_version": "1.7.6+hfbuild3",
+  "fernet_secret_name": "SAT_ACT_APP_FERNET_V1_7_7_HFBUILD3_067CBFE1E7D0_C1A4FBDDCEB8",
+  "key_fingerprint_sha256_prefix": "C1A4FBDDCEB8",
+  "plaintext_archive_sha256": "067cbfe1e7d05138b561196e01a3a714de69cae3ca6b76817b20e8263c49361e",
+  "release_version": "1.7.7+hfbuild3",
   "schema_namespace": "sat_act_learning_lab_v1",
   "schema_version": "dearmon-sat-act-release-v1",
   "source_members": {
     "sat_act_lab/__init__.py": {
       "bytes": 71,
-      "sha256": "52c61b3428c8a761de3feae966590b9f3720a2697c965e7a97e4a9d070fc51aa"
+      "sha256": "c3c48266f6a0a5dd410ecd9d961bd92a4b656f3da748faa07f48ce3d103b0687"
     },
     "sat_act_lab/act_english_bank.py": {
       "bytes": 79622,
@@ -35,8 +35,8 @@
       "sha256": "e2e964945f7eb773ac6a4b47a9e2568b61ef738dce0ccf131895b76037e42acf"
     },
     "sat_act_lab/app_main.py": {
-      "bytes": 545046,
-      "sha256": "7c08957ed7fef99a337c24dd5baf7f55b5ad174a44582bc0306f6e83c934be69"
+      "bytes": 545433,
+      "sha256": "dd4fb4e8d9a010c1643db6d5e3d2477773830d2e21b4f5765117059da456fb33"
     },
     "sat_act_lab/assessment_checkpoint.py": {
       "bytes": 9801,
@@ -47,8 +47,8 @@
       "sha256": "4e1064938705964b668ed9c4bcc1dda8e88049c1229b754df9d8487a99ddeebf"
     },
     "sat_act_lab/auth.py": {
-      "bytes": 84909,
-      "sha256": "a98d56e67ddac57297577ce44850c83d5d7d17d65947245f067fa2dd7557cf17"
+      "bytes": 92254,
+      "sha256": "45af9ab18f32688485669c1404d48d6ca05b7e51b57dc632f4c2310971b2af4b"
     },
     "sat_act_lab/avatar.py": {
       "bytes": 80369,
@@ -87,8 +87,8 @@
       "sha256": "56a701be1dd14e4c03677f839172098f677a6d9793131a9814aee6a22fbcc6eb"
     },
     "sat_act_lab/deployment_readiness.py": {
-      "bytes": 17630,
-      "sha256": "f1567a76e8adfcea2e01dce74453ab20d5bd13784e38019694f2d0e2c0fb0e8d"
+      "bytes": 16863,
+      "sha256": "af9a4bb1911c9a1adbc96784e14c76167ade0b91b7c5920e69d68f44f4280912"
     },
     "sat_act_lab/diagnostic_reports.py": {
       "bytes": 75654,
@@ -246,19 +246,19 @@
     },
     "DEPLOYMENT_NOTES.md": {
       "bytes": 18324,
-      "sha256": "2ea7b210fab9f5e84f95ca114d917374fc85eebdfd4c34a2331331778212b36c"
+      "sha256": "80abdb1d7d8476954ae908e0a29a82d1def8a411a9901c491bbfa9c05ddc88ba"
     },
     "README.md": {
-      "bytes": 15413,
-      "sha256": "48ccb839c6ff1be94f544dceccd1718a93f343b3307963d11916f0eb3bd3368b"
+      "bytes": 15713,
+      "sha256": "7a132d952c1919e1e96db1981851a338d0e24fa5ea963e5467dcaa36d3fe0051"
     },
     "THIRD_PARTY_NOTICES.md": {
       "bytes": 73850,
       "sha256": "288997d5002f0932271a0a7173a2cf074f63e3c2ad0cd9195a6c32e4c29e452b"
     },
     "app.py": {
-      "bytes": 2036844,
-      "sha256": "b1fa5686552cf9c72f1cbf9fdeb8d1c8e2214edcb870e4f2b937a5d2de667de5"
+      "bytes": 2040137,
+      "sha256": "910fe7eba3f194c69c1ba4bd70aa4310ee202b7a9356ea1d8d43d657a613fec2"
     },
     "pre-requirements.txt": {
       "bytes": 44842,