Postmaster MCP v9.8.1

9.8.1 - 2026-09-06

Fixed / changed

• Fixed the Structured Data WebGUI #data loading regression by removing the
  global body MutationObserver loop introduced in v9.8.0. Structured Data
  context synchronization is now event-driven and performs idempotent writes.
• Made the initial Structured Data workspace count-free: the WebGUI now reads
  only project table metadata and no longer calls describe_project,
  status, migration history, audit history, or per-table COUNT(*) queries
  on the critical rendering path.
• Added count-free table pagination with 10 rows by default, selectable
  10/20/50/100 rows per page, stable _row_id ordering, and previous/next
  navigation using LIMIT page_size + 1 rather than a total-row count.
• Removed the eager 10,000-row JSON export from table Browse rendering.
• Preserved the public v9.8 structured-data MCP contract, including
  db_describe_project row counts and the exact 118-command surface.
• postmaster-mcp.yml, requirements.txt, Cloudflare Worker/configuration,
  mail semantics, persistent data schema, and secret/private-key handling are
  unchanged.

Postmaster MCP v9.8.0

9.8.0 - 2026-09-05

Added / changed

• Added the Project-Scoped Structured Data Layer as an authoritative operational-data complement to semantic Memory and Files, with every structured operation enforced inside an exact owner_id + project_id scope and physical storage namespaces kept internal.
• Added exactly 21 MCP tools for structured-data status/inspection, schema management, validated queries, CRUD/upsert/import/export, indexes/views, migrations, audit, authoritative overrides and structured-record-to-memory links, taking the composed MCP surface from 97 to 118 commands.
• Added a shared StructuredDataService used by both the MCP surface and the Structured Data WebGUI control plane so project isolation, validation, provenance/audit, idempotency, override/effective-value semantics, migrations and destructive-operation policy remain consistent across agent and human workflows.
• Added the WebGUI structured-data control plane for project overview, table/schema browsing, row operations, import/export, raw versus effective override state, memory links, migration history/planning, approval review and audit/provenance visibility.
• Added project-scoped read-only SQL supporting validated SELECT/read-only WITH access while rejecting mutating/destructive statements, system/admin escapes and dangerous SQLite operations.
• Added additive migration support and review-only destructive schema planning, plus real delete preview with matching-row counts/sample row IDs and explicit confirmation before mutation.
• Added CSV/JSON/JSONL import/export, idempotent write replay protection, auditable provenance, authoritative overrides with raw/effective values, and deterministic SQLite connection lifecycle handling.

Storage / compatibility / safety / deployment

• The v9.8.0 V1 backend is self-contained SQLite on the existing durable data volume and introduces no new Python dependency. requirements.txt remains unchanged.
• postmaster-mcp.yml remains unchanged. The only workflow-specific environment delta is the CI-only writable POSTMASTER_STRUCTURED_DATA_DB=/tmp/postmaster-ci-structured-data.db; the production default under /data is unchanged.
• Existing outbound invariants remain preserved: persistent idempotency and no resend after sent=true, Sent-clean, private BCC with no historical BCC rediscovery, one logical Sent archive, historical detracking before current tracking, Safe Email zero-network defaults, and no secret/private-key exposure.
• This is a source release only. Production activation, runtime switching, Portainer activation/configuration and Cloudflare Worker/configuration changes are not performed by publishing v9.8.0 and remain separate owner-controlled operations.

Postmaster MCP v9.7.2

9.7.2 - 2026-08-31

Fixed / changed

• Fixed Stored File public downloads at the terminal /t/c/<opaque-token> boundary without weakening Cloudflare Access. New direct ResourceLinks use fresh random high-entropy sfc1_ bearer capabilities whose public value contains no file ID, recipient, delivery ID or SHA and is not derived from Stored File identity.
• Added DB-first Stored File capability resolution in the existing analytics database. Unknown public tokens fail closed through indexed lookup with zero FileStore scan/enumeration and zero network; valid capabilities bind the exact private file_id + sha256 + created_at incarnation before reading canonical local FileStore bytes.
• Tracked Stored File links remain occurrence-specific per campaign/delivery/recipient, record click telemetry, and terminate by serving exact local bytes directly instead of redirecting to /files/*. Normal tracked web links retain their historical click-recording 302 behavior.
• Fixed forward already-sent v9.7.1 tracking rows whose target is a valid local signed /files/<id>?expires=...&sig=... capability: the route validates the historical capability locally, preserves its expiry semantics and serves bytes without an internal HTTP/DNS/reverse-proxy hop.
• Delete invalidates public and tracked Stored File capabilities; delete followed by recreation of the same file ID does not resurrect an old token because exact-incarnation created_at is verified together with SHA-256.
• Corrected the final composed runtime_v960 mail-client factory to use the instance-scoped v9.7.2 client and the runtime-bound v9.7.2 tracking store, preserving canonical detracking-before-current-tracking behavior.

Storage / compatibility / safety / deployment

• The persistent migration is additive and lazy in the existing analytics DB: private stored_file_capabilities plus Stored File capability/incarnation reference columns and supporting indexes on tracking_links; no destructive migration or eager installer initialization is introduced.
• The composed MCP surface remains exactly 97 command names. The complete v9 runtime workflow is green with 467 tests on the final fix PR head, including Stored File random bearer, recipient/delivery differentiation, DB-only unknown-token failure, exact-incarnation/delete-recreate semantics, final runtime composition, v9.7.1 compatibility, normal web 302, Sent-clean/Bcc/idempotency/privacy and Safe Email zero-network regressions.
• postmaster-mcp.yml is unchanged; requirements.txt is unchanged; the canonical Cloudflare Worker source/configuration is unchanged. Cloudflare Access is not weakened and no internal HTTP reverse proxy to /files is introduced.
• The public tree remains provider-neutral and contains no new secret/private-key material. Stored File bytes continue to come from the canonical local File Store.
• This is a source release boundary only. Publishing v9.7.2 does not itself activate production, restart the runtime, mutate Portainer, change Cloudflare, deploy a Worker or authorize update-latest; production activation remains a separate preview + explicit owner-approval lifecycle.

Postmaster MCP v9.7.1

9.7.1 - 2026-08-31

Fixed / changed

• Shipped the complete post-v9.7.0 source backlog through PRs #36, #37, #38, #39, #40 and #41: durable stored-file share links; WebGUI interaction and Full HTML partial-success regressions; privacy-scoped tracking telemetry and contextual Inbox/Sent tracking; attachment metadata/download/cache-only previews plus the Inbox floating composer; project/resource UX improvements; and a consolidated Mail Safety / Reputation information architecture.
• Stored-file public share links now remain durable without weakening canonical File Store authorization or introducing a parallel public file identifier path.
• Full HTML rendering now isolates individual passive-resource failures from an otherwise usable document while preserving the existing explicit two-step consent boundary, Safe Email zero-network default, cache-first reopen behavior and prohibition on navigation/action/form/CTA auto-fetches.
• Added private account-scoped tracking enrichment for WebGUI telemetry while keeping public MCP tracking schemas unchanged. Source IP is validated/canonicalized and kept private; country-level geography uses only the already-supplied edge country signal with no external geolocation lookup; Sent correlation is exact Message-ID; human-vs-machine classification and geography remain estimates, never proof of a human read; WebGUI enrichment is read-only and fail-open.
• Inbox message detail now surfaces attachments with explicit download and best-effort cache-only preview for suitable PDF, text, image, video and audio types. Preview failure never blocks attachment metadata/download and performs no IMAP/HTTP/DNS fetch. The floating Inbox composer preserves To/Cc/Bcc, drafts, Stored File attachments, suppression confirmation and existing outbound safety semantics.
• Memories/Skills and Files now open directly from their rows/titles, editors remain contextual, active project scope is explicit, and project aggregates distinguish Memories, Skills, Tasks and Files while preserving existing CRUD/auth and project filtering.
• Consolidated Mail Health, Suppressions, Domain controls, Recipient controls and Security into one primary Mail Safety destination with clear safety, reputation/deliverability, authorization/policy and security sections. Existing compatibility views/routes and backend capabilities remain routable.

Storage / compatibility / safety / deployment

• The composed MCP surface remains exactly 97 command names (delta = 0 from v9.7.0) with no public MCP schema delta.
• Added one private, additive SQLite sidecar table, tracking_sensitive_telemetry, in the existing analytics database. Sensitive telemetry retention is 30 days; base tracking rows remain intact when sidecar retention expires. No destructive migration or separate analytics database is introduced.
• requirements.txt is unchanged. postmaster-mcp.yml remains byte-for-byte unchanged at Git blob f250cc5c33cae66ffe6cd8eea8c30cb49e8203a9. The canonical Cloudflare Privacy Proxy Worker source and example configuration are unchanged.
• The public tree remains provider-neutral and contains no new secret material. HMAC secrets, Ed25519 private signing material and other Privacy Proxy secrets remain server-side/private.
• Existing outbound safety invariants remain in force: historical Postmaster tracking is normalized before current tracking; persistent idempotency is not bypassed by force_send; a successful send is not repeated because of later read-only failures; recipient and Sent MIME retain clean-MIME semantics; Bcc stays absent from recipient/received views while sender-side Bcc metadata remains private; reply/follow-up never rediscovers historical Bcc; one logical outbound operation creates one canonical Sent archive; synchronizer/cache paths remain read-oriented only.
• The composed acceptance suite contains 459 tests and the v9 runtime workflow is green at the pre-release composed-main boundary.
• This is a source release boundary only. Runtime activation, production deployment, Portainer mutation and Cloudflare Worker deployment are not performed or authorized by publishing v9.7.1 and remain separate owner-controlled actions.

Postmaster MCP v9.7.0

9.7.0 - 2026-08-24

WebGUI visual refresh — enterprise operational redesign

PRESENTATION / RESPONSIVE / ACCESSIBILITY ONLY.

Material changes

• Complete WebGUI visual redesign.
• Dense operational + enterprise executive visual hierarchy.
• Desktop/tablet/mobile responsive redesign.
• Compact enterprise navigation and contextual shell.
• Improved Inbox/Sent/Compose presentation.
• Tasks list/calendar responsive presentation.
• Knowledge/Memories/Skills responsive drill-down presentation.
• Mobile full-screen readers/editors/sheets.
• Accessibility/focus/dialog/reduced-motion improvements.
• Visual state and table/layout improvements.

Compatibility / functional freeze

• No functional behavior changes.
• MCP command-name delta: 0 (97 -> 97).
• MCP schema delta: 0.
• Backend/API semantics delta: 0.
• Mail behavior delta: 0.
• Tracking semantics delta: 0.
• Privacy Proxy / Full HTML / High-Noise semantics delta: 0.
• Lifecycle delta: 0.
• Scheduler semantics delta: 0.
• Knowledge/File Store semantics delta: 0.
• Persistent DB/schema/migration delta: 0.
• Cloudflare Worker delta: 0.
• postmaster-mcp.yml delta: 0.
• requirements.txt delta: 0.

Postmaster MCP v9.6.9

9.6.9 - 2026-08-24

Fixed / changed

• Added one shared passive-content service used by WebGUI and MCP. Safe Email and the first Full HTML intent remain zero-network; only an explicit authorized Full HTML fetch may request genuine passive rendering resources through the Privacy Proxy. Total fetch failure stays in Safe Email, action/navigation URLs are never auto-fetched, and browser/MCP diagnostics expose aggregate counts/state instead of raw proxy/Worker exception detail.
• Reused the persistent mailbox remote-resource cache for both positive content and negative tombstones, changed newly generated resource keys to opaque privacy-preserving hashes, and added explicit refresh semantics. Cache-only reopen performs no origin fetch.
• Closed the WebGUI all-failure negative-cache loop: a normal Safe Email reopen remains zero-network, while the failure state now exposes a distinct explicit retry action that sends refresh_remote=1, bypasses/replaces the tombstone only for that authorized network cycle, and never introduces automatic retries.
• Added bounded passive-resource resolution inside successfully fetched remote stylesheets. CSS url(...) targets are resolved relative to the stylesheet origin, reclassified through the existing passive-resource security classifier, fetched only through the authenticated Privacy Proxy, persisted in the same stable message cache and rewritten to local resource references. Bounds cover stylesheet/resource counts, bytes, MIME types, concurrency and execution time; recursive CSS crawling is not introduced and @import is explicitly sterilized at depth 0 for v9.6.9.
• Moved High-Noise decoy invocation behind the shared genuine-work boundary: decoys run only when an explicitly authorized request has real passive origin cache misses, remain bounded by the existing privacy controls, and do not repeat on cache-only reopen.
• Added explicit MCP command fetch_email_remote_content; normal get_email remains inspection/static and zero-network. The composed MCP command-name surface changes from 96 to 97 (delta = +1). The returned rendered_html is explicitly a Postmaster-local representation: passive references use local cache resource identifiers rather than arbitrary Base64 expansion.
• Corrected individualized outbound Sent archiving so a successful logical fanout creates exactly one canonical IMAP Sent APPEND while preserving distinct per-recipient delivery IDs and Message-IDs. Sender-side operation metadata maps To/Cc/Bcc and delivery IDs privately; Bcc remains absent from recipient MIME and is not rediscovered by reply/follow-up flows.
• Clarified normal group-send identity: one MIME/DATA submission may have multiple SMTP RCPT recipients sharing one Message-ID, but those To/Cc/Bcc rows are sender-private logical recipient mappings, not persisted tracking deliveries and not public delivery_id values. The normal send response therefore keeps its historical contract instead of manufacturing delivery_<hash> IDs; deliveries remains reserved for authoritative individualized/tracking rows.
• Corrected shared-Message-ID reply correlation. A unique individualized delivery Message-ID still resolves its exact real delivery; a normal group Message-ID identifies the logical out_* operation and the inbound From address disambiguates the matching To/Cc/Bcc mapping when unique. Unknown or ambiguous senders keep the logical-operation match without inventing an exact delivery/recipient match, and private Bcc role metadata is not exposed through the inbound/public correlation surface.
• Added canonical-Sent follow-up regression coverage: follow-up preserves threading and historical visible To/Cc semantics, never rediscovers historical Bcc, accepts new Bcc only from explicit follow-up input, creates a new out_* operation without overwriting the original one, archives one clean canonical Sent copy, and retains the existing outbound detracking invariant.
• Enriched Sent WebGUI detail with To/Cc/Bcc from sender-private metadata while preserving the original date. Received detail never exposes sender-side Bcc metadata. The existing successful-detail-only Seen boundary remains unchanged and covered by its v9.6.8 regression test.
• Replaced the ChatGPT/MCP-native preview-to-execute bearer confirmation-token lifecycle with persistent server-side pending approvals. Pending state uses exact binding digests, opaque preview IDs for correlation only, a hard maximum 300-second TTL, atomic one-shot consumption, replay/expiry/wrong-target/wrong-operation/stale-state rejection and restart-safe SQLite persistence; execute schemas no longer accept confirmation_token.

Storage / compatibility / safety / deployment

• Added /data/mcp_pending_approvals_v969.db for pending approval state and reused the single /data/outbound_operations_v969.db for logical outbound operations, authoritative real-delivery mappings, and an additive logical-recipient-mapping table. Existing unreleased v9.6.9 synthetic delivery_<24-hex> rows are migrated forward into logical recipient mappings on store initialization; no additional outbound database is introduced. The existing /data/mailbox_cache.db remote-resource table is reused for top-level and nested passive positive/negative cache entries; no separate CSS store is introduced and newly generated cache keys are opaque hashes.
• requirements.txt is unchanged; postmaster-mcp.yml is unchanged; the canonical Cloudflare Privacy Proxy Worker source is unchanged. No analytics schema change or new dependency is introduced.
• This tranche prepares source/tests and release metadata only. No stable tag, GitHub release, merge, deployment, production runtime switch, Portainer change, Worker deployment or Cloudflare change is performed.

Postmaster MCP v9.6.8

9.6.8 - 2026-08-23

Fixed / changed

• Fixed the outbound detracking/Sent-clean regression at the final composed mail-client boundary. Historical Postmaster click wrappers and open pixels are now canonicalized locally before any current-delivery instrumentation even when higher newsletter/stored-file/threaded paths call the inherited individualized-send boundary directly; unresolved active-origin tokens continue to fail closed.
• Added final-composed-runtime/MCP regression coverage above the v9.6.4 helper tests for send, reply and follow-up, tracked and untracked delivery, recipient MIME, independently clean Sent MIME, repeated generations/no nesting and fail-closed unresolved tokens. The unchanged v9.6.4 detracking suite continues to verify zero HTTP/DNS/network requests and zero tracking events during historical normalization.
• Hardened the second explicit Full HTML confirmation so it performs genuine passive-resource fetches through the configured Privacy Proxy, classifies the aggregate result as success, partial success or failure, and renders only successfully cached resources. An all-failure result remains in Safe Email instead of falsely claiming Full HTML success.
• Made final high-noise wiring explicit at the route-composition boundary after the second Full HTML confirmation. Existing safety bounds remain unchanged: at most 4 decoys per message/load, 2 per domain and concurrency 2, with navigation/action links excluded and all existing Privacy Proxy SSRF, redirect, replay, content-type and size protections preserved.
• Successful received-message detail opens now set IMAP Seen through the existing mail abstraction, update cached flags and clear the selected unread indicator in the same WebGUI response. A failed detail load does not mark the message read.
• Full HTML diagnostics expose only safe aggregate state/counts; Privacy Proxy per-fetch exception text, HMAC material, Ed25519 private-key material, signatures and provisioning/confirmation tokens are not surfaced to the browser.

Compatibility / safety / deployment

• The composed MCP command-name surface remains exactly 96 names (delta = 0 from v9.6.7); no command is added or removed and no lifecycle command schema/classification is changed.
• requirements.txt is unchanged; postmaster-mcp.yml is unchanged; no persistent database/storage schema or migration is introduced; the canonical Worker source is unchanged.
• Existing persistent outbound idempotency, suppression semantics, preview-first one-time lifecycle confirmation, Ed25519 provisioning/no-TOFU, Safe Email zero-network default and provider-neutral public-tree boundaries remain intact.
• Stable source/release publication remains separate from production activation. Publishing v9.6.8 does not itself restart, deploy, switch the production runtime, mutate Portainer/Cloudflare, replace the Worker or reprovision/rotate the Privacy Proxy.

Postmaster MCP v9.6.7

9.6.7 - 2026-08-23

Fixed / changed

• Replaced lifecycle-sensitive use of polymorphic MCP commands with six stable command names split by nature: runtime_status, runtime_version_change_preview, runtime_version_change_execute, privacy_proxy_status, privacy_proxy_provisioning_preview, and privacy_proxy_provisioning_execute. The v9.6.7 layer never removes/re-adds a legacy command name and keeps each new command schema/annotation set stable across discovery, preview, reconnect, approval, and execute.
• Added truthful MCP annotations: status/preview commands are read-only and non-destructive; runtime status and Privacy Proxy status/preview are closed-world, runtime preview is open-world for stable GitHub release discovery, and execute commands are writes/open-world. Execute annotations conservatively set destructiveHint=true because the fixed command names include rollback/deprovision, while responses distinguish destructive rollback/deprovision from non-destructive update/pin/switch/prepare/provision/rotate/reconcile operations.
• Replaced process-local v9.6.4/v9.6.6 confirmation state in the final v9.6.7 MCP flows with stateless HMAC-authenticated 300-second tokens plus persistent one-time nonce consumption in SQLite. Token issuance is read-only after startup initialization; execute atomically consumes the nonce, mismatched attempts consume it, replay is rejected across reconnect/restart, and the token carries only scope/nonce/timestamps plus a binding digest rather than secret material.
• Runtime confirmations bind operation, exact verified stable vX.Y.Z target, current selector, current build and current local release identity. update-latest preview resolves an exact release and approved execute uses the existing one-shot restart_ref_once bootstrap control so the first restart cannot silently jump to a newer release discovered after approval.
• Privacy Proxy confirmations retain the v9.6.6 action/Worker-origin/key-id/fingerprint/generation/pending binding and add the current local proxy/provisioning state. The generated proxy HMAC secret and Ed25519 private signing key remain excluded from MCP/chat/log/audit/error output.
• Added MCP client lifecycle tests that perform separate connect/list/preview/disconnect/reconnect/list/execute/status sequences for runtime version control and Privacy Proxy provisioning, including stable schemas/annotations, read-only previews, controlled confirmation-backend restart, one-time replay rejection and current-state binding.

Compatibility / safety / deployment

• The composed MCP command-name surface is 96 names (delta = +6 from the historical 90 through v9.6.6). Six lifecycle commands are added; no command is removed. build_status and set_amp_account_state retain their v9.6.6-compatible schemas/behavior and are deprecated specifically for lifecycle-sensitive version-change/provisioning flows rather than being mutated again.
• Existing v9.6.6 Ed25519 provisioning, public-key pinning/no-TOFU, server-to-server secret transfer, pending -> verify -> active, monotonic generations, replay/timestamp/origin/key/generation checks, SSRF/redirect controls, bounded previous-secret grace, reconcile, deprovision and legacy Worker POSTMASTER_PROXY_SECRET fallback remain covered.
• New local confirmation persistence is additive: /data/mcp_confirmation_v967.key plus SQLite /data/mcp_confirmation_v967.db with mcp_confirmation_consumed. No new dependency is required and requirements.txt is unchanged.
• postmaster-mcp.yml remains byte-for-byte unchanged at Git blob f250cc5c33cae66ffe6cd8eea8c30cb49e8203a9; no Portainer/bootstrap edit is required for this source release.
• Stable source/release publication remains separate from production activation. Publishing v9.6.7 does not itself restart, deploy, switch the production runtime, provision a production Worker, or enable the Privacy Proxy.

Postmaster MCP v9.6.6

9.6.6 - 2026-08-23

Added / changed

• Added MCP-native Privacy Proxy secret provisioning through the existing set_amp_account_state command with additive status, prepare_provisioning, provision, rotate, reconcile, and deprovision actions; no new MCP command name is introduced.
• Postmaster now generates an Ed25519 keypair internally for provisioning trust. The private signing key is encrypted at rest and never returned; MCP exposes only the public key, key-id, and SHA-256 fingerprint for explicit Worker pinning.
• Added preview-first, short-lived one-time confirmation tokens for every mutating provisioning action. Tokens are bound to the exact action, Worker origin, key fingerprint/key-id, generation, and current pending state and are consumed after one attempt.
• Postmaster now generates the proxy HMAC secret internally, persists it encrypted as pending, and sends it directly to the Worker over a server-to-server /provision request signed with Ed25519. The provisioning signature binds method, path, Worker origin, timestamp, nonce, body digest, monotonic generation, operation, and key-id.
• The example Worker now fails closed unless the Ed25519 public key/key-id is explicitly pinned, verifies signatures/timestamps/nonces/generations, rejects replay and rollback/out-of-order rotations, and stores active/previous HMAC state in the existing SQLite-backed NONCE_GUARD Durable Object. The previous secret is accepted only during a bounded rotation grace period (120 seconds requested by Postmaster, 300 seconds hard maximum).
• Provisioning promotion is pending -> verify -> active: Postmaster verifies /health with the pending HMAC secret before replacing the local active secret. Interrupted provision/rotation remains recoverable with reconcile, which reuses the same encrypted pending secret and generation with a fresh signed request.
• Added provider-neutral Worker deployment documentation and a complete MCP-client wizard covering status inspection, prepare/public-key pinning, provision preview/confirmation, server-to-server provisioning, health verification, enablement, rotation, reconcile, deprovision, and interruption recovery.

Compatibility / safety / deployment

• The composed MCP command-name surface remains exactly 90 names (delta = 0); v9.6.6 extends existing schemas/status only.
• Normal /health and /fetch authentication remains HMAC-SHA256 with timestamp/nonce anti-replay. Legacy privacy_proxy_secret input and Worker POSTMASTER_PROXY_SECRET fallback remain supported for existing/manual deployments.
• The existing Durable Object binding is reused; no new Cloudflare binding, port, dependency, or requirements.txt change is required. Local provisioning metadata is an additive SQLite table protected by the existing persistent Fernet key.
• Generated HMAC secrets and Ed25519 private keys are excluded from MCP responses, bounded errors, documentation examples, and the public tree. Worker configuration contains public-key placeholders only.
• postmaster-mcp.yml remains byte-for-byte unchanged at Git blob f250cc5c33cae66ffe6cd8eea8c30cb49e8203a9.
• Stable source/release publication remains separate from production activation. Publishing v9.6.6 does not itself deploy/update the Worker, pin a production key, create a production secret, restart Postmaster, switch the production runtime, or change Cloudflare/Portainer configuration.

Postmaster MCP v9.6.5

9.6.5 - 2026-08-23

Fixed / changed

• Restored the richer pre-v9.6.2 WebGUI presentation on top of the existing v9.6.2 lazy-fragment shell: grouped Operate / Organize / Control navigation, icons, Domain controls / Recipient controls footer, project color accents and the v9.5.3 account palette are restored without replacing routes, handlers, renderers or the lazy fragment script.
• Bridged the v9.6.3 visual-restoration token names (--surface / --border) to the v9.6.2 shell tokens (--card / --line) and neutralized the obsolete fixed-sidebar main offset inside the grid shell while preserving responsive/mobile behavior.
• Added release-identity correction for the reused lazy shell: WebGUI branding now derives from the checked-out local VERSION, and responses expose X-Postmaster-WebGUI for the actually loaded release instead of a hard-coded v9.6.2 identity.
• Added production-integration regression coverage for the final composed runtime, including overlay install order, WebGUI groups/icons/footer/colors, all 18 lazy navigation targets, unchanged lazy lifecycle/AbortController/generation guard, active-target preservation, v9.6.3/v9.6.4 routes and final renderer composition.
• Added real MCPServer registry/schema regression coverage for the composed application, including the modern get_email inspection/content-mode contract, Privacy Proxy arguments on set_amp_account_state, v9.6.4 version-control arguments on build_status, and per-send confirm_suppressed_recipients on send/reply/follow-up.

Compatibility / safety / deployment

• Corrective patch release only: the MCP command-name surface remains exactly 90 names (delta = 0); schema corrections are additive/compatibility-restoring and add no new MCP command name.
• postmaster-mcp.yml is unchanged; requirements.txt is unchanged; no persistent database/storage migration or schema change is introduced.
• Stable source/release publication remains separate from production activation. Publishing v9.6.5 does not itself deploy, restart, switch, or otherwise alter the live production runtime.
• The ChatGPT/client MCP discovery-cache mismatch remains classified separately. The release verifies the server-side composed registry/schema contract and does not claim that any stale client discovery cache has been physically invalidated.