Adversarial Notes IMAP bulk FETCH misses appended Note and blocks structural replay #1273

Open
opened 2026-10-07 00:25:23 +00:00 by kayg · 1 comment
Owner

Evidence from adv31 / #1202

Product head 139d4378e, real Notes IMAP TLS listener and disposable Home. The Notes IMAP probe concluded with two findings:

FINDING: appended Note was not served back by FETCH
FINDING: structural replay could not locate served base
Notes IMAP probe: 2 finding(s)

The valid APPEND did not report failure. The probe then selects Notes and sends UID FETCH 1:* (UID BODY.PEEK[]), which is a bulk read of the campaign Home after large Editor and upload fixtures. The implementation has a complete-command deadline and an 8 MiB FETCH response bound. The probe does not report the tagged FETCH response, so the cause is not yet isolated between those limits and a projection defect. Its structural edit checks stop when the served MIME base is absent.

No crash, authorization leak or failed APPEND was reported. Do not infer data loss solely from the missing bulk FETCH body. Preserve assertions and file this as an unresolved IMAP availability/structural-replay coverage gap. A focused small-Home replay can establish whether the underlying structural contract still passes. Notes submission's separate live protocol regressions completed with zero findings.

## Evidence from adv31 / #1202 Product head 139d4378e, real Notes IMAP TLS listener and disposable Home. The Notes IMAP probe concluded with two findings: ``` FINDING: appended Note was not served back by FETCH FINDING: structural replay could not locate served base Notes IMAP probe: 2 finding(s) ``` The valid APPEND did not report failure. The probe then selects Notes and sends UID FETCH 1:* (UID BODY.PEEK[]), which is a bulk read of the campaign Home after large Editor and upload fixtures. The implementation has a complete-command deadline and an 8 MiB FETCH response bound. The probe does not report the tagged FETCH response, so the cause is not yet isolated between those limits and a projection defect. Its structural edit checks stop when the served MIME base is absent. No crash, authorization leak or failed APPEND was reported. Do not infer data loss solely from the missing bulk FETCH body. Preserve assertions and file this as an unresolved IMAP availability/structural-replay coverage gap. A focused small-Home replay can establish whether the underlying structural contract still passes. Notes submission's separate live protocol regressions completed with zero findings.
Author
Owner

Additional evidence for #1273: one Probe note row exists in note_items. The corresponding file exists and contains the fixture text. Thus the missing bulk FETCH body is not an absent APPEND source.

The focused small-Home replay passed its initial APPEND/FETCH and reached structural/serial APPEND. It then stopped with TimeoutError at the client's existing 15-second TLS read bound. No assertion was changed or timeout raised. The original full probe completed its remaining malformed-literal, isolation and IDLE checks and reported the two bulk FETCH/served-base findings. The separate submission probe had zero findings. Structural replay remains incompletely verified; no data-loss claim is made.

Additional evidence for #1273: one Probe note row exists in note_items. The corresponding file exists and contains the fixture text. Thus the missing bulk FETCH body is not an absent APPEND source. The focused small-Home replay passed its initial APPEND/FETCH and reached structural/serial APPEND. It then stopped with TimeoutError at the client's existing 15-second TLS read bound. No assertion was changed or timeout raised. The original full probe completed its remaining malformed-literal, isolation and IDLE checks and reported the two bulk FETCH/served-base findings. The separate submission probe had zero findings. Structural replay remains incompletely verified; no data-loss claim is made.
Commenting is not possible because the repository is archived.
No labels
No milestone
No project
No assignees
1 participant
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal-v0#1273
No description provided.