Release date: April 21, 2026
Status: Locked for v66.0.0 release prep
This document defines the product-truth freeze for Receiz v66.0.0. It carries forward the v64.0.0 value-loop baseline while recording local proof continuity, offline identity continuity, local twin projection, verified-snapshot persistence, and stronger-known-state preservation as explicit non-regression behavior at release time.
For this offline verifier repository, the release is represented as current-release documentation, canonical release artifacts, local-proof reference documents, shipped HTML version markers, and package-metadata alignment only. The verifier trust contract remains unchanged relative to v60.0.0.
v66.0.0 obeys the Receiz authority model:
Identity is local. Proof is local. State is deterministic. History is append-only. Memory is compact. Sync is propagation.
The server, database, and network remain useful for discovery, publication, global propagation, appends, and online enrichment. They must not delay, erase, or downgrade stronger verified truth already held by the node.
The release does not relax the core Receiz authority model:
- File-backed proof remains the authority for artifact truth.
- Verified-register-backed local proof outranks weaker legacy or offline evidence.
- A valid local identity root remains authoritative when the network session is missing, anonymous, unavailable, or weaker.
- Deterministic route state and verified snapshots remain the authority for first paint and continuity truth.
- Local twin register projection remains authoritative for visible local replies when it exists.
- Wallet and market surfaces must preserve locally known positions and ledger truth until a stronger state is proven.
- History is append-only; correction happens through stronger appended truth, not mutation of old proof.
- Sync propagates known truth; it does not make known local truth provisional.
- Receipt rendering must classify proof authority.
- Verified-register-backed proof must outrank legacy offline evidence.
- Receipt details and proof popovers must expose stronger local authority without letting older payloads reframe it.
- Wallet transaction receipts must verify deterministic ledger proof bundles before treating ledger claims as truth.
- A weaker network or legacy payload must not demote a stronger local proof block.
- Account surfaces must preserve a valid bootstrap/keyfile/PBI-backed local identity when the session API is unavailable or weaker.
- Anonymous or missing network session payloads must not erase locally held identity proof.
- Network session is enrichment over a local identity root, not permission for the account surface to exist.
- Offline identity continuity may be enriched online, but it must not be invalidated by transport absence alone.
- The public twin may project from the local twin mind register and local model path before the network stream is needed.
- Local twin register projection must win for the visible reply when it exists.
- The online stream path remains available when no local register projection exists.
- Online stream hydration must not silently replace a settled local projection.
- Browser local model support must use a deterministic fallback when the WebLLM rail is unavailable.
- Twin mind PNG import must use portable public-key verification rather than server-secret HMAC authority for canonical import.
- World profile/public/me API snapshots must be allowed to opt into service-worker offline persistence for deterministic or private route truth.
- Explore route snapshots must behave as durable verified local truth and reconcile into the visible view without replacing useful already-visible content.
- Wallet must project the durable wallet graph during first render instead of applying it in a later visible correction.
- Market snapshot continuity must preserve known local positions and refuse lagging payloads that temporarily drop a buy or sell already known locally.
- Tracked positions must require a transport payload to prove a stronger state before it can remove visible local position truth.
- Offline persistence must be explicit through
x-receiz-offline-persistresponse headers. - Deterministic public snapshots and private account snapshots must be stored as local truth carriers, not generic cache guesses.
- The app-shell fallback may remain a resilience path.
- Route truth must still be carried by verified snapshots and deterministic payloads.
- Release-governed version surfaces must move together to
v66.0.0across package metadata, shipped verifier artifacts, public release badges, current release documentation, and canonical release docs. - Public-facing version truth must not drift between shipped HTML entrypoints, docs indexes, release artifacts, and repository metadata.
- This offline verifier repository must reflect that lockstep rule in
package.json,README.md,RELEASE_NOTES.md,CHANGELOG.md,docs/README.md,docs/governance/README.md,docs/FORMAT.md,site/index.html,apps/offline-verifier.html,apps/offline-record-seal.html, andapps/offline-settlement.html.
docs/experience-first-engineering.mddocs/deterministic-surfaces.mddocs/verified-history-first-principles.mddocs/offline-verified-register.mddocs/value-loop-invariants.mddocs/releases/v66.0.0-product-truth.mddocs/releases/v66.0.0-process.md
- The existing online twin brain stays intact.
- The server runtime stays intact.
- The database stays useful for global register propagation, discovery, sync, and verified additions.
- Online AI stays useful when it can add capability, but it is not allowed to make known local truth provisional.
- PBI-backed offline account creation is still the next larger pass, not part of this release cut.
- The
v64.0.0value-loop invariants remain in force. - The offline verifier proof-format and producer-payload contract remain unchanged by this documentation cut.
Twin mind portable import/export requires the public-key signing environment to be present in production:
RECEIZ_WORLD_TWIN_MIND_SIGNING_PRIVATE_KEY_PEMRECEIZ_WORLD_TWIN_MIND_SIGNING_PUBLIC_KEY_PEMRECEIZ_WORLD_TWIN_MIND_KEY_ID
No new database migration is required by the release docs themselves. Existing production schema requirements from the value-loop and world/profile releases still apply.
Implementation details may change after v66.0.0 only if they preserve the authority boundaries and locked local-proof behaviors above. If a future change materially alters one of these truths, it should ship under a new explicit release note and updated product-truth freeze.
A change is out of bounds for v66.0.0 if it:
- asks the network to reconfirm a proof the node already holds before moving known local truth
- replaces a stronger verified local block with a weaker remote payload
- treats anonymous or missing session data as permission to erase a valid local identity root
- silently replaces a settled local twin projection with an online stream response
- imports twin mind PNG data using server-secret HMAC authority instead of portable public-key verification
- removes visible wallet, market, tracked-position, World, or Explore truth without a stronger proven state
- treats service-worker route truth as generic cache data instead of explicit verified snapshots
- makes a settled screen visibly reload from background hydration
- allows package metadata, public badges, shipped verifier artifacts, or current-release docs to advertise different release numbers
- changes release truth without updating the versioned release docs and aligned repository version surfaces