kayg/calternal
Watch
1
0
Fork
You've already forked calternal
 0
Code Issues 802 Pull requests Projects Releases Packages Wiki Activity Actions 462

MAIL M2: Mail mode — reader, threads, safe HTML, search (DESIGN §45) #396

New issue
Closed
opened 2026-09-29 04:40:50 +00:00 by kayg · 38 comments
kayg commented 2026-09-29 04:40:50 +00:00
Owner
Copy link

MAIL M2: the Mail mode — reader and search (DESIGN §45, build order: accounts and sync (M1, done #313) → reader and search → send and actions (M3))

Build exactly what DESIGN §45 decided for reading (read the whole section and docs/research/mail-plugin.md, mail-threads.md):

  • Mail mode in the mode tray (plugin, on by default, admin-toggleable), sidebar with accounts and folders (sub-views live in the sidebar, DESIGN §34), unified inbox.
  • One newest-first stream; a thread opens at the newest message; received-time ordering with the sender's Date shown; thread grouping per §45 (reply forks stay OPEN — do not build).
  • Message reader: safe HTML rendering (sanitized, remote content blocked by default with a per-sender "load images", no scripts, no tracking pixels, links opened safely), plain-text and format=flowed, attachments listed with Save to Files, Print.
  • Search: sender, subject, recipients and full body across all accounts through the shared Search index (§45; attachment text is #293, later); Mail filters/pills in ⌘K.
  • Classification per §45 (list headers, sender domain, receipt patterns; no AI model) with "sender here" correction.
  • Deep links to every message and thread (stable calternal IDs), Copy link everywhere.
  • Parity (#395): every reader action available in API/CLI/MCP/WebMCP.

Gates before release (§45): hostile MIME/HTML tests (malformed MIME, huge parts, nested multiparts, charset tricks, CSS/HTML exploits, remote-content leaks), cross-User authorization tests, sync recovery tests, one adversarial round, and a measured "newest mail visible" time and search latency on a large mailbox (e.g. 100k messages). Production-build screenshots at 390/820/1440, light and dark.

## MAIL M2: the Mail mode — reader and search (DESIGN §45, build order: accounts and sync (M1, done #313) → **reader and search** → send and actions (M3)) Build exactly what DESIGN §45 decided for reading (read the whole section and docs/research/mail-plugin.md, mail-threads.md): - Mail mode in the mode tray (plugin, on by default, admin-toggleable), sidebar with accounts and folders (sub-views live in the sidebar, DESIGN §34), unified inbox. - One **newest-first** stream; a thread opens at the newest message; received-time ordering with the sender's Date shown; thread grouping per §45 (reply forks stay OPEN — do not build). - Message reader: safe HTML rendering (sanitized, remote content blocked by default with a per-sender "load images", no scripts, no tracking pixels, links opened safely), plain-text and format=flowed, attachments listed with Save to Files, Print. - Search: sender, subject, recipients and full body across all accounts through the shared Search index (§45; attachment text is #293, later); Mail filters/pills in ⌘K. - Classification per §45 (list headers, sender domain, receipt patterns; no AI model) with "sender here" correction. - Deep links to every message and thread (stable calternal IDs), Copy link everywhere. - Parity (#395): every reader action available in API/CLI/MCP/WebMCP. Gates before release (§45): hostile MIME/HTML tests (malformed MIME, huge parts, nested multiparts, charset tricks, CSS/HTML exploits, remote-content leaks), cross-User authorization tests, sync recovery tests, one adversarial round, and a measured "newest mail visible" time and search latency on a large mailbox (e.g. 100k messages). Production-build screenshots at 390/820/1440, light and dark.
mail-m2-screenshots.zip
16 MiB
mail-m2-round3-screenshots.zip
11 MiB
mail-m2-polish-screenshots.zip
14 MiB
kayg commented 2026-09-29 04:41:28 +00:00
Author
Owner
Copy link

Started job/mail-m2 from 00015e652a. Reading DESIGN §45, mail research, M1 projection, and existing web/search integration before implementation. I will report concrete findings and gate output here.

Started job/mail-m2 from 00015e652a153485d9e7adda1c5ee61bc17300db. Reading DESIGN §45, mail research, M1 projection, and existing web/search integration before implementation. I will report concrete findings and gate output here.
kayg commented 2026-09-29 04:45:17 +00:00
Author
Owner
Copy link

Finding: M1 sync already stores a stable UUID and owner-scoped live membership for each message, but the projection has no HTML or full-text index. I am adding sanitized HTML as derived data and an owner-filtered FTS projection. The reader must still use a sandboxed iframe and network-denying CSP. DESIGN §45 marks reply forks OPEN, so I will not infer them from subjects.

Finding: M1 sync already stores a stable UUID and owner-scoped live membership for each message, but the projection has no HTML or full-text index. I am adding sanitized HTML as derived data and an owner-filtered FTS projection. The reader must still use a sandboxed iframe and network-denying CSP. DESIGN §45 marks reply forks OPEN, so I will not infer them from subjects.
kayg commented 2026-09-29 04:58:15 +00:00
Author
Owner
Copy link

Finding: M1's generated OpenAPI contract incorrectly described Mail paging fields as path parameters. The route already reads them from the query string. I changed the schema annotation to Query and regenerated the client; the web type check now reports 0 errors and 0 warnings. The first web test run found one new direct date-format call in MailView; I replaced it with the shared formatter, and its reuse-gate test now passes.

Finding: M1's generated OpenAPI contract incorrectly described Mail paging fields as path parameters. The route already reads them from the query string. I changed the schema annotation to Query and regenerated the client; the web type check now reports 0 errors and 0 warnings. The first web test run found one new direct date-format call in MailView; I replaced it with the shared formatter, and its reuse-gate test now passes.
kayg commented 2026-09-29 05:04:17 +00:00
Author
Owner
Copy link

Finding: M1's keyset page cursor used the extra unreturned row, so opening the next page skipped that message. I changed the cursor to the last returned row and added a 3-message/2-row regression test. This matters for Mail's “Load older messages” control and stable newest-first reading.

Finding: M1's keyset page cursor used the extra unreturned row, so opening the next page skipped that message. I changed the cursor to the last returned row and added a 3-message/2-row regression test. This matters for Mail's “Load older messages” control and stable newest-first reading.
kayg commented 2026-09-29 05:06:05 +00:00
Author
Owner
Copy link

Resumed job/mail-m2 at 00015e65 after the service-tier restart. The worktree contains an uncommitted Mail reader and search slice. I am validating and committing that slice, then will merge dev once and run the final gates and one adversarial round. No merge into dev or deploy is planned.

Resumed job/mail-m2 at 00015e65 after the service-tier restart. The worktree contains an uncommitted Mail reader and search slice. I am validating and committing that slice, then will merge dev once and run the final gates and one adversarial round. No merge into dev or deploy is planned.
kayg commented 2026-09-29 05:14:24 +00:00
Author
Owner
Copy link

Finding: the first Mail mode draft combined only the first 50 messages from each account and had no unified cursor. A User with a large mailbox could not reach older unified Inbox messages. I added an Index query that pages by received time and stable message ID across enabled accounts, live folder generations and the authenticated User. The Mail crate suite passes (21 tests); API client generation and web integration are in progress.

Finding: the first Mail mode draft combined only the first 50 messages from each account and had no unified cursor. A User with a large mailbox could not reach older unified Inbox messages. I added an Index query that pages by received time and stable message ID across enabled accounts, live folder generations and the authenticated User. The Mail crate suite passes (21 tests); API client generation and web integration are in progress.
kayg commented 2026-09-29 05:23:42 +00:00
Author
Owner
Copy link

Category decision (DESIGN §45 does not specify precedence): receipt subject patterns take precedence, then standard List headers, then Auto-Submitted and sender-address/domain notification signals, then People. The User's per-sender correction overrides every guess and is persisted as Security state. The Mail crate suite passes (22 tests). I also constrained the search FTS update trigger to text fields so category corrections do not reindex each message body.

Category decision (DESIGN §45 does not specify precedence): receipt subject patterns take precedence, then standard List headers, then Auto-Submitted and sender-address/domain notification signals, then People. The User's per-sender correction overrides every guess and is persisted as Security state. The Mail crate suite passes (22 tests). I also constrained the search FTS update trigger to text fields so category corrections do not reindex each message body.
kayg commented 2026-09-29 05:39:01 +00:00
Author
Owner
Copy link

Thread decision: the Index assigns a stable thread ID from the provider thread ID when present, otherwise from normalized Message-ID, References and In-Reply-To keys within one connected account. When two partial graphs meet, old thread IDs remain valid through an alias. Existing M1 messages have only their own Message-ID stored, so pre-M2 replies can join when they are refetched; historical groups without a refetch remain a known migration gap. A test covers merge and old-link resolution. Remote HTML images remain stripped by default; per-sender consent permits only absolute HTTPS image sources in sanitized HTML and a CSP-limited frame. The Mail crate suite passes (25 tests).

Thread decision: the Index assigns a stable thread ID from the provider thread ID when present, otherwise from normalized Message-ID, References and In-Reply-To keys within one connected account. When two partial graphs meet, old thread IDs remain valid through an alias. Existing M1 messages have only their own Message-ID stored, so pre-M2 replies can join when they are refetched; historical groups without a refetch remain a known migration gap. A test covers merge and old-link resolution. Remote HTML images remain stripped by default; per-sender consent permits only absolute HTTPS image sources in sanitized HTML and a CSP-limited frame. The Mail crate suite passes (25 tests).
kayg commented 2026-09-29 05:44:59 +00:00
Author
Owner
Copy link

Performance finding on a local 100k-message Mail Index fixture (shared build host, 25 warmed SQL samples): the first unified Inbox query had p50 279.17 ms / p95 371.01 ms because GROUP BY and ORDER BY built temporary trees. A correlated live-membership pick measured p50 0.18 ms / p95 0.26 ms on the same fixture. Common-term Mail search with received-time sorting had p50 259.86 ms / p95 398.58 ms; bounded FTS hit order measured p50 0.06 ms / p95 0.30 ms. I changed those two queries and am running crate tests. These are Index query timings, not end-to-end newest-mail-visible timings.

Performance finding on a local 100k-message Mail Index fixture (shared build host, 25 warmed SQL samples): the first unified Inbox query had p50 279.17 ms / p95 371.01 ms because GROUP BY and ORDER BY built temporary trees. A correlated live-membership pick measured p50 0.18 ms / p95 0.26 ms on the same fixture. Common-term Mail search with received-time sorting had p50 259.86 ms / p95 398.58 ms; bounded FTS hit order measured p50 0.06 ms / p95 0.30 ms. I changed those two queries and am running crate tests. These are Index query timings, not end-to-end newest-mail-visible timings.
kayg commented 2026-09-29 06:09:18 +00:00
Author
Owner
Copy link

Backend finding: at 100,000 projected messages, the original unified Inbox query took p50 279.17 ms / p95 371.01 ms and the original common-term FTS query took p50 259.86 ms / p95 398.58 ms on 25 warm SQLite samples. The indexed live-membership page and bounded FTS stream measured p50 0.664 ms / p95 1.161 ms and p50 0.268 ms / p95 0.406 ms on the same fixture. These are Index query timings, not browser newest-mail-visible timings. The first SQL revision had a malformed owner bind; Mail crate tests caught it and it was fixed before commits 11ccd10a and 4c5cbd8c. Current Mail crate gate: 28 passed, 0 failed. A fake IMAP session now supplies hostile multipart HTML and verifies text extraction and sanitized storage.

Backend finding: at 100,000 projected messages, the original unified Inbox query took p50 279.17 ms / p95 371.01 ms and the original common-term FTS query took p50 259.86 ms / p95 398.58 ms on 25 warm SQLite samples. The indexed live-membership page and bounded FTS stream measured p50 0.664 ms / p95 1.161 ms and p50 0.268 ms / p95 0.406 ms on the same fixture. These are Index query timings, not browser newest-mail-visible timings. The first SQL revision had a malformed owner bind; Mail crate tests caught it and it was fixed before commits 11ccd10a and 4c5cbd8c. Current Mail crate gate: 28 passed, 0 failed. A fake IMAP session now supplies hostile multipart HTML and verifies text extraction and sanitized storage.
kayg commented 2026-09-29 06:38:37 +00:00
Author
Owner
Copy link

Search design finding: DESIGN §32 specifies Tantivy for server-side content in the universal palette. The existing Indexer API accepts Home file paths and has no public plugin-document writer. This branch currently exposes Mail full text through the shared SearchProvider and Mail facet, backed by a rebuildable FTS5 projection in the Mail Index. This meets cross-account sender/subject/recipient/body lookup and the local 100k latency probe, but it is not the one Tantivy Index specified by §32. Moving Mail into Tantivy would require a new cross-crate indexing API; I am reporting that deviation rather than changing the Search crate's behavior inside this job.

Search design finding: DESIGN §32 specifies Tantivy for server-side content in the universal palette. The existing Indexer API accepts Home file paths and has no public plugin-document writer. This branch currently exposes Mail full text through the shared SearchProvider and Mail facet, backed by a rebuildable FTS5 projection in the Mail Index. This meets cross-account sender/subject/recipient/body lookup and the local 100k latency probe, but it is not the one Tantivy Index specified by §32. Moving Mail into Tantivy would require a new cross-crate indexing API; I am reporting that deviation rather than changing the Search crate's behavior inside this job.
kayg commented 2026-09-29 06:41:07 +00:00
Author
Owner
Copy link

Reader decision where §45 is silent: the saved per-sender image choice permits absolute HTTPS image sources in a scriptless, opaque-origin sandboxed iframe. The frame has a deny-by-default CSP and no-referrer policy. Links are stripped from the HTML and exposed as explicit, safe-scheme links outside the frame. There is no image proxy in this slice; a User who permits a sender's remote images makes direct HTTPS requests to that sender's image hosts. Tests cover blocked-by-default resources and hostile HTML/CSS.

Reader decision where §45 is silent: the saved per-sender image choice permits absolute HTTPS image sources in a scriptless, opaque-origin sandboxed iframe. The frame has a deny-by-default CSP and no-referrer policy. Links are stripped from the HTML and exposed as explicit, safe-scheme links outside the frame. There is no image proxy in this slice; a User who permits a sender's remote images makes direct HTTPS requests to that sender's image hosts. Tests cover blocked-by-default resources and hostile HTML/CSS.
kayg commented 2026-09-29 06:51:13 +00:00
Author
Owner
Copy link

Deep-link decision where §33/§45 give no Mail format parameter: /mail/m/{id}?format=plain and /mail/t/{id}?format=plain restore the reader's plain-text view. The HTML view is the default without that parameter. The format action updates the URL in place, and Copy link includes the plain view when selected.

Deep-link decision where §33/§45 give no Mail format parameter: `/mail/m/{id}?format=plain` and `/mail/t/{id}?format=plain` restore the reader's plain-text view. The HTML view is the default without that parameter. The format action updates the URL in place, and Copy link includes the plain view when selected.
kayg commented 2026-09-29 07:07:34 +00:00
Author
Owner
Copy link

Post-merge design finding: dev added DESIGN §48 (one search Index per User; structural isolation) and §49 (provider sign-in moves to Settings → Integrations, while Settings → Mail keeps service preferences). This M2 branch extends M1's shared SQLite Mail projection with owner-filtered reads and continues using M1's Settings → Mail account UI. The new sections require cross-feature migration work (#400/#407) outside this reader slice. The new decisions are now in this branch after the single git merge dev; I am listing the remaining conflicts with them in the final report.

Post-merge design finding: `dev` added DESIGN §48 (one search Index per User; structural isolation) and §49 (provider sign-in moves to Settings → Integrations, while Settings → Mail keeps service preferences). This M2 branch extends M1's shared SQLite Mail projection with owner-filtered reads and continues using M1's Settings → Mail account UI. The new sections require cross-feature migration work (#400/#407) outside this reader slice. The new decisions are now in this branch after the single `git merge dev`; I am listing the remaining conflicts with them in the final report.
kayg commented 2026-09-29 07:20:30 +00:00
Author
Owner
Copy link

Production screenshot finding: the root /mail view showed “Inbox” twice at 820/1440 px because the app chrome already supplies the mode title and MailView added a second root heading. I removed MailView's root heading while retaining its Copy link action. Sub-views keep their own title under the Mail chrome. I am rebuilding and recapturing 390/820/1440 light/dark after the change; no screenshot is committed to git.

Production screenshot finding: the root `/mail` view showed “Inbox” twice at 820/1440 px because the app chrome already supplies the mode title and MailView added a second root heading. I removed MailView's root heading while retaining its Copy link action. Sub-views keep their own title under the Mail chrome. I am rebuilding and recapturing 390/820/1440 light/dark after the change; no screenshot is committed to git.
kayg commented 2026-09-29 07:32:15 +00:00
Author
Owner
Copy link

Production-build review evidence: 54 Mail screenshots, PNG ZIP. The archive includes Inbox empty and populated, category, folder, thread, message HTML and plain text, truncated body, and action menu at 390/820/1440 px in light and dark. The capture script asserted the rendered theme before every screenshot. The root Inbox screenshot reflects commit 16d78dfc, which removed the duplicated title. Screenshots are attached to this issue and are not in git.

Production-build review evidence: [54 Mail screenshots, PNG ZIP](https://git.kayg.org/attachments/7fe13d54-5e60-45e2-846d-879dd6a1ba7e). The archive includes Inbox empty and populated, category, folder, thread, message HTML and plain text, truncated body, and action menu at 390/820/1440 px in light and dark. The capture script asserted the rendered theme before every screenshot. The root Inbox screenshot reflects commit 16d78dfc, which removed the duplicated title. Screenshots are attached to this issue and are not in git.
kayg commented 2026-09-29 07:48:13 +00:00
Author
Owner
Copy link

Post-merge production-build and real-server findings (2026-09-29):

  • 100,000-message synthetic Mail projection: newest message visible after navigation, p50 967.57 ms / p95 1434.39 ms over five samples. The host is shared with concurrent builds, so these include contention.
  • Exact Mail FTS SQL for a unique full-body term returned the indexed hit in approximately 0.19 ms per query over 25 local SQLite executions. The same normal /api/v1/search route returned HTTP 200 with timed_out=true and no hit in all five paced 100,000-message requests, p50 216.40 ms / p95 227.90 ms. One-message control returned the hit in all five requests, p50 36.90 ms / p95 69.20 ms. The shared Search route has a 200 ms provider deadline. This is a remaining search-at-scale gap; no 5xx or data loss was observed in the paced sample. The earlier unpaced 25-request run hit one 503 under concurrent host load and was stopped to avoid piling up work; its body was not captured.
  • The one time-boxed real-server adversarial round passed: anonymous access, Unicode and public-endpoint policy, malformed and oversized JSON, hostile IDs and cursors, and 24 parallel account/Inbox reads. Output: Mail API probe: anonymous access, Unicode and public-endpoint policy, malformed/oversized JSON, hostile IDs/cursors, and 24 parallel account/Inbox reads passed.
  • Six device/theme combinations for each changed Mail screen were captured from the production build and uploaded earlier in this issue. The root Inbox duplicate heading found during review was fixed in commit 16d78dfc.
Post-merge production-build and real-server findings (2026-09-29): - 100,000-message synthetic Mail projection: newest message visible after navigation, p50 967.57 ms / p95 1434.39 ms over five samples. The host is shared with concurrent builds, so these include contention. - Exact Mail FTS SQL for a unique full-body term returned the indexed hit in approximately 0.19 ms per query over 25 local SQLite executions. The same normal `/api/v1/search` route returned HTTP 200 with `timed_out=true` and no hit in all five paced 100,000-message requests, p50 216.40 ms / p95 227.90 ms. One-message control returned the hit in all five requests, p50 36.90 ms / p95 69.20 ms. The shared Search route has a 200 ms provider deadline. This is a remaining search-at-scale gap; no 5xx or data loss was observed in the paced sample. The earlier unpaced 25-request run hit one 503 under concurrent host load and was stopped to avoid piling up work; its body was not captured. - The one time-boxed real-server adversarial round passed: anonymous access, Unicode and public-endpoint policy, malformed and oversized JSON, hostile IDs and cursors, and 24 parallel account/Inbox reads. Output: `Mail API probe: anonymous access, Unicode and public-endpoint policy, malformed/oversized JSON, hostile IDs/cursors, and 24 parallel account/Inbox reads passed`. - Six device/theme combinations for each changed Mail screen were captured from the production build and uploaded earlier in this issue. The root Inbox duplicate heading found during review was fixed in commit 16d78dfc.
kayg commented 2026-09-29 08:07:16 +00:00
Author
Owner
Copy link

Scope audit before the final gate report: the branch implements the reader, sanitized HTML, sender-gated remote images, plain/flowed text, Print, categories, stable message/thread IDs, and Mail results in the shared search palette. #396 remains open because the message list is still per-message rather than grouped by thread; attachment listing and Save to Files are not implemented; and reader actions do not yet have CLI/MCP/WebMCP parity. The §45 reader preferences (read marking after about 1 s), oldest-unread jump, and new-message notice are also outstanding. I will include these gaps in the final report. No reply-fork work was attempted because §45 marks it OPEN.

Scope audit before the final gate report: the branch implements the reader, sanitized HTML, sender-gated remote images, plain/flowed text, Print, categories, stable message/thread IDs, and Mail results in the shared search palette. #396 remains open because the message list is still per-message rather than grouped by thread; attachment listing and Save to Files are not implemented; and reader actions do not yet have CLI/MCP/WebMCP parity. The §45 reader preferences (read marking after about 1 s), oldest-unread jump, and new-message notice are also outstanding. I will include these gaps in the final report. No reply-fork work was attempted because §45 marks it OPEN.
kayg commented 2026-09-29 08:57:34 +00:00
Author
Owner
Copy link

Mail M2 branch report (2026-09-29)

Head: 16d78dfcb0 on job/mail-m2, based on dev and merged from dev once. Pushed; no merge into dev.

Built:

  • Mail mode navigation, account/folder sidebar, unified Inbox with People default, category and folder views, message and thread deep links, Copy link actions.
  • Bounded HTML/plain MIME reader, format=flowed text, strict ammonia sanitization, isolated sandbox iframe with CSP, no remote requests before per-sender image consent, safe external link controls, Print.
  • SQLite FTS projection and shared Search provider for sender, subject, recipients and body; Mail palette kind, category classification and persistent sender correction; stable thread IDs and aliases.
  • Real IMAP fixture tests for hostile MIME and oversized body, cross-User isolation, search and sync recovery; adversarial Mail API probe.

Files: crates/plugins/mail/{src,migrations,Cargo.toml}, apps/web/src/lib/mail, apps/web/src/routes/mail, navigation/search/sidebar integration, contracts/openapi.json, packages/api-client/src/generated.ts, tests/adversarial/mail_api.mjs, Cargo.lock.

Evidence:

  • Production-build screenshots: 54 captures covering changed Mail screens at 390/820/1440 px in light and dark. Uploaded artifact: https://git.kayg.org/attachments/7fe13d54-5e60-45e2-846d-879dd6a1ba7e
  • One time-boxed adversarial round: Mail API probe: anonymous access, Unicode and public-endpoint policy, malformed/oversized JSON, hostile IDs/cursors, and 24 parallel account/Inbox reads passed.
  • 100,000-message synthetic projection: newest visible p50 967.57 ms/p95 1434.39 ms (5 samples, shared loaded host). Normal global Search API p50 216.40 ms/p95 227.90 ms (5 paced samples) but all five had timed_out=true and omitted the unique Mail hit. Exact indexed Mail SQL returned the hit in about 0.19 ms per query. One-message global Search control returned 5/5 hits, p50 36.90 ms/p95 69.20 ms. Search-at-scale remains open.

Gates (output quoted verbatim from the logs):

cargo fmt --check: exit 0, no output.

cargo clippy --all-targets -- -D warnings: interrupted near the job time box, exit 130. Last output:

    Checking tantivy-fst v0.5.0
   Compiling prettyplease v0.3.0
    Checking dashmap v6.2.1
    Checking rand v0.10.3
    Checking futures-lite v2.6.1

cargo test: interrupted near the job time box, exit 130. It never acquired Cargo's build lock. Entire output:

    Blocking waiting for file lock on build directory

cargo test -p calternal-plugin-mail: exit 0 before the dev merge; dev did not modify Mail sources. Result lines:

test result: ok. 30 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.41s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

bun run check: exit 0 after the merge and final visual fix:

svelte-check found 0 errors and 0 warnings

bun run test: exit 1 on the final run because a ThemePicker keyboard submenu test exceeded its 5000 ms timeout under shared-host load. Result lines:

 Test Files  1 failed | 122 passed (123)
      Tests  1 failed | 786 passed (787)
error: script "test" exited with code 1

The same full suite passed immediately before the visual-only heading fix:

 Test Files  123 passed (123)
      Tests  787 passed (787)

The isolated ThemePicker test then passed:

 Test Files  1 passed (1)
      Tests  2 passed (2)

Production bun run build: exit 0:

  Wrote site to "build"
  ✔ done

Post-merge cargo build -p calternal-server: exit 0; the binary ran the screenshots, benchmark and adversarial probe.

cargo clean: exit 0:

     Removed 12886 files, 6.2GiB total

apps/web/build and apps/web/.svelte-kit/output were also removed.

Known gaps:

  • The message list is per message rather than grouped by thread. Attachment listing/Save to Files, reader action parity in CLI/MCP/WebMCP, about-1-second read marking and setting, jump to oldest unread, and new-message notice remain open.
  • The body cache bounds parts at 64 KiB, so larger bodies show a truncation notice rather than the full content.
  • Mail FTS is in the shared SQLite Index, not the per-User Index required by the newly merged DESIGN §48. Account sign-in remains in Settings → Mail rather than the newly merged Integrations design in §49. These need a later cross-crate migration.

Decisions where §45 was silent: category signal precedence is receipt > newsletter > notification > people; thread aliases preserve old links after References merges; remote images are direct HTTPS requests after sender consent; ?format=plain preserves plain-reader deep links. Reply forks were left unbuilt because §45 marks them OPEN.

Mail M2 branch report (2026-09-29) Head: 16d78dfcb081fd9c5810f3fc04c5914d45b62c84 on job/mail-m2, based on dev and merged from dev once. Pushed; no merge into dev. Built: - Mail mode navigation, account/folder sidebar, unified Inbox with People default, category and folder views, message and thread deep links, Copy link actions. - Bounded HTML/plain MIME reader, format=flowed text, strict ammonia sanitization, isolated sandbox iframe with CSP, no remote requests before per-sender image consent, safe external link controls, Print. - SQLite FTS projection and shared Search provider for sender, subject, recipients and body; Mail palette kind, category classification and persistent sender correction; stable thread IDs and aliases. - Real IMAP fixture tests for hostile MIME and oversized body, cross-User isolation, search and sync recovery; adversarial Mail API probe. Files: crates/plugins/mail/{src,migrations,Cargo.toml}, apps/web/src/lib/mail, apps/web/src/routes/mail, navigation/search/sidebar integration, contracts/openapi.json, packages/api-client/src/generated.ts, tests/adversarial/mail_api.mjs, Cargo.lock. Evidence: - Production-build screenshots: 54 captures covering changed Mail screens at 390/820/1440 px in light and dark. Uploaded artifact: https://git.kayg.org/attachments/7fe13d54-5e60-45e2-846d-879dd6a1ba7e - One time-boxed adversarial round: `Mail API probe: anonymous access, Unicode and public-endpoint policy, malformed/oversized JSON, hostile IDs/cursors, and 24 parallel account/Inbox reads passed`. - 100,000-message synthetic projection: newest visible p50 967.57 ms/p95 1434.39 ms (5 samples, shared loaded host). Normal global Search API p50 216.40 ms/p95 227.90 ms (5 paced samples) but all five had timed_out=true and omitted the unique Mail hit. Exact indexed Mail SQL returned the hit in about 0.19 ms per query. One-message global Search control returned 5/5 hits, p50 36.90 ms/p95 69.20 ms. Search-at-scale remains open. Gates (output quoted verbatim from the logs): `cargo fmt --check`: exit 0, no output. `cargo clippy --all-targets -- -D warnings`: interrupted near the job time box, exit 130. Last output: ``` Checking tantivy-fst v0.5.0 Compiling prettyplease v0.3.0 Checking dashmap v6.2.1 Checking rand v0.10.3 Checking futures-lite v2.6.1 ``` `cargo test`: interrupted near the job time box, exit 130. It never acquired Cargo's build lock. Entire output: ``` Blocking waiting for file lock on build directory ``` `cargo test -p calternal-plugin-mail`: exit 0 before the dev merge; dev did not modify Mail sources. Result lines: ``` test result: ok. 30 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.41s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` `bun run check`: exit 0 after the merge and final visual fix: ``` svelte-check found 0 errors and 0 warnings ``` `bun run test`: exit 1 on the final run because a ThemePicker keyboard submenu test exceeded its 5000 ms timeout under shared-host load. Result lines: ``` Test Files 1 failed | 122 passed (123) Tests 1 failed | 786 passed (787) error: script "test" exited with code 1 ``` The same full suite passed immediately before the visual-only heading fix: ``` Test Files 123 passed (123) Tests 787 passed (787) ``` The isolated ThemePicker test then passed: ``` Test Files 1 passed (1) Tests 2 passed (2) ``` Production `bun run build`: exit 0: ``` Wrote site to "build" ✔ done ``` Post-merge `cargo build -p calternal-server`: exit 0; the binary ran the screenshots, benchmark and adversarial probe. `cargo clean`: exit 0: ``` Removed 12886 files, 6.2GiB total ``` `apps/web/build` and `apps/web/.svelte-kit/output` were also removed. Known gaps: - The message list is per message rather than grouped by thread. Attachment listing/Save to Files, reader action parity in CLI/MCP/WebMCP, about-1-second read marking and setting, jump to oldest unread, and new-message notice remain open. - The body cache bounds parts at 64 KiB, so larger bodies show a truncation notice rather than the full content. - Mail FTS is in the shared SQLite Index, not the per-User Index required by the newly merged DESIGN §48. Account sign-in remains in Settings → Mail rather than the newly merged Integrations design in §49. These need a later cross-crate migration. Decisions where §45 was silent: category signal precedence is receipt > newsletter > notification > people; thread aliases preserve old links after References merges; remote images are direct HTTPS requests after sender consent; `?format=plain` preserves plain-reader deep links. Reply forks were left unbuilt because §45 marks them OPEN.
kayg commented 2026-09-29 09:01:08 +00:00
Author
Owner
Copy link

Starting the mail-m2 resume on branch job/mail-m2 at 16d78dfcb081fd9c5810f3fc04c5914d45b62c84. The worktree is clean. I am refreshing origin/dev because local dev is behind the visible #398 merge, then I will merge dev once and resolve conflicts with both sides in mind.

Starting the mail-m2 resume on branch `job/mail-m2` at `16d78dfcb081fd9c5810f3fc04c5914d45b62c84`. The worktree is clean. I am refreshing `origin/dev` because local `dev` is behind the visible #398 merge, then I will merge `dev` once and resolve conflicts with both sides in mind.
kayg commented 2026-09-29 09:01:56 +00:00
Author
Owner
Copy link

Merge finding: the refreshed dev tip was b96693da1f24922778aba5652176a36aba30c500. Local dev is checked out in /home/kayg/Developer/calternal, so I merged the current origin/dev tip once into job/mail-m2 instead of moving that other worktree's branch. The only conflict was the shared sidebar import: I kept MailSidebar and combined the new swipe helper import with Mail's existing gesture imports. Merge-resolution commit: 44d21b72aaabf744d62fe53813148121a8e201fb.

Merge finding: the refreshed dev tip was `b96693da1f24922778aba5652176a36aba30c500`. Local `dev` is checked out in `/home/kayg/Developer/calternal`, so I merged the current `origin/dev` tip once into `job/mail-m2` instead of moving that other worktree's branch. The only conflict was the shared sidebar import: I kept MailSidebar and combined the new `swipe` helper import with Mail's existing gesture imports. Merge-resolution commit: `44d21b72aaabf744d62fe53813148121a8e201fb`.
kayg commented 2026-09-29 09:11:37 +00:00
Author
Owner
Copy link

Parity finding: #395's source-backed adapter matrix is present on the refreshed dev tree. The initial merge commit tree did not contain its three tracked files, although origin/dev did. I restored docs/parity-matrix.md, docs/parity-exceptions.json, and scripts/parity_matrix.py from that dev tip in a56d3e86, so Mail reader adapters can use the checked matrix. #395's current generator records 156 pre-existing adapter gaps; I will limit this job to the Mail reader routes it touches.

Parity finding: #395's source-backed adapter matrix is present on the refreshed dev tree. The initial merge commit tree did not contain its three tracked files, although `origin/dev` did. I restored `docs/parity-matrix.md`, `docs/parity-exceptions.json`, and `scripts/parity_matrix.py` from that dev tip in `a56d3e86`, so Mail reader adapters can use the checked matrix. #395's current generator records 156 pre-existing adapter gaps; I will limit this job to the Mail reader routes it touches.
kayg commented 2026-09-29 09:58:16 +00:00
Author
Owner
Copy link

M2 findings and decisions:

  • MailView.svelte compared message flags against a JavaScript string containing two literal backslashes. The Mail projection returns one \Seen flag, so a message could still look unread after its provider state changed. The reader now compares the same flag value as the API.
  • Attachment reads can use up to 25 MiB per request. The Mail router now admits at most four provider reads at once and returns HTTP 429 when those slots are full, so overload does not create an unbounded queue.

I am running the Mail crate tests against these changes now.

M2 findings and decisions: - `MailView.svelte` compared message flags against a JavaScript string containing two literal backslashes. The Mail projection returns one `\Seen` flag, so a message could still look unread after its provider state changed. The reader now compares the same flag value as the API. - Attachment reads can use up to 25 MiB per request. The Mail router now admits at most four provider reads at once and returns HTTP 429 when those slots are full, so overload does not create an unbounded queue. I am running the Mail crate tests against these changes now.
kayg commented 2026-09-29 10:13:10 +00:00
Author
Owner
Copy link

The Mail CLI attachment download wrote the user-selected output path directly with OpenOptions. That bypassed the filesystem confinement rule. I added Root::write_new_file_at_root in calternal-fs, which creates one private new file relative to a held directory handle with openat2 and RESOLVE_BENEATH, and routed the Mail export through it. The helper rejects an existing destination and symlink. I will run the calternal-fs and calternal-cli crate gates.

The Mail CLI attachment download wrote the user-selected output path directly with `OpenOptions`. That bypassed the filesystem confinement rule. I added `Root::write_new_file_at_root` in `calternal-fs`, which creates one private new file relative to a held directory handle with `openat2` and `RESOLVE_BENEATH`, and routed the Mail export through it. The helper rejects an existing destination and symlink. I will run the `calternal-fs` and `calternal-cli` crate gates.
kayg commented 2026-09-29 10:21:10 +00:00
Author
Owner
Copy link

I added attachment Copy link actions and restored the selected attachment from a deep link. The Mail API has no separate attachment ID, so the link uses the stable message ID plus the provider section ID: /mail/m/<message-id>?attachment=<section-id> or /mail/t/<thread-id>?attachment=<message-id>:<section-id>. Opening the link opens the attachment inspector and selects the item. I recorded this grammar in docs/DESIGN.md and made WebMCP accept the same links.

I added attachment Copy link actions and restored the selected attachment from a deep link. The Mail API has no separate attachment ID, so the link uses the stable message ID plus the provider section ID: `/mail/m/<message-id>?attachment=<section-id>` or `/mail/t/<thread-id>?attachment=<message-id>:<section-id>`. Opening the link opens the attachment inspector and selects the item. I recorded this grammar in `docs/DESIGN.md` and made WebMCP accept the same links.
kayg commented 2026-09-29 10:37:20 +00:00
Author
Owner
Copy link

Finding #396: the one-second read timer could expire while the browser tab was hidden. It then discarded the timer without marking the message read when the User returned. MailView now cancels that interval and starts a fresh visible second when the reader becomes visible. A manual read-state change and route change also clear the pending timer. Web verification is pending.

Finding #396: the one-second read timer could expire while the browser tab was hidden. It then discarded the timer without marking the message read when the User returned. MailView now cancels that interval and starts a fresh visible second when the reader becomes visible. A manual read-state change and route change also clear the pending timer. Web verification is pending.
kayg commented 2026-09-29 10:47:29 +00:00
Author
Owner
Copy link

Finding #396: the first cargo clippy -p calternal-plugin-mail --all-targets -- -D warnings pass reported six style warnings: two collapsible conditions in html.rs, one needless lifetime in routes.rs, two collapsible conditions and one manual_contains in sync.rs. I am applying the clippy suggestions so the required warning-free gate can pass.

Finding #396: the first `cargo clippy -p calternal-plugin-mail --all-targets -- -D warnings` pass reported six style warnings: two collapsible conditions in `html.rs`, one needless lifetime in `routes.rs`, two collapsible conditions and one `manual_contains` in `sync.rs`. I am applying the clippy suggestions so the required warning-free gate can pass.
kayg commented 2026-09-29 12:53:41 +00:00
Author
Owner
Copy link

Search cause found on the 100k-message protocol: SQLx uses SQLite 3.51.3, whose plan started with SEARCH mail_messages USING INDEX mail_messages_page (owner_id=?), then tested FTS across the owner's rows. Python's plan started with the FTS virtual-table match and used a rowid lookup. The Mail pool wait was only 1–8 ms; the query stage used 176–203 ms and timed out. The comparable pre-fix run returned p50 220.30 ms / p95 225.10 ms, 0/5 Mail hits, and 5/5 timeouts. I am forcing FTS to drive the Mail query while keeping the owner, enabled-account, and live-membership checks.

Search cause found on the 100k-message protocol: SQLx uses SQLite 3.51.3, whose plan started with `SEARCH mail_messages USING INDEX mail_messages_page (owner_id=?)`, then tested FTS across the owner's rows. Python's plan started with the FTS virtual-table match and used a rowid lookup. The Mail pool wait was only 1–8 ms; the query stage used 176–203 ms and timed out. The comparable pre-fix run returned p50 220.30 ms / p95 225.10 ms, 0/5 Mail hits, and 5/5 timeouts. I am forcing FTS to drive the Mail query while keeping the owner, enabled-account, and live-membership checks.
kayg commented 2026-09-29 14:59:09 +00:00
Author
Owner
Copy link

mail-m2 status

The job reached its four-hour limit while cargo clippy -p calternal-server --all-targets -- -D warnings was still compiling dependencies. I stopped further work at that limit. The server Clippy gate did not produce a final result, cargo test -p calternal-server was not run, and the one-time adversarial run and production screenshots were not completed. No screenshots were attached.

Built and committed

  • Mail M2 backend and UI: thread-grouped lists, attachment metadata and bounded provider downloads, Save to Files, owner-scoped read-marking preferences, read-state actions, oldest-unread navigation, new-message notice, and Mail settings.
  • CLI Mail reader commands and safe root-relative, create-only attachment export through calternal-fs.
  • MCP Mail reader actions with scoped write actions.
  • OpenAPI/client contract and parity matrix. The Mail reader routes in the matrix show CLI, MCP, and WebMCP coverage.
  • A test-only adversarial probe and fixture for new Mail API cases and 54 review captures. The probe source passes node --check; it was not run on a real server.
  • Search fix: force FTS to drive the join. SQLite 3.51.3 had chosen the owner/time index first and checked FTS for every message.

Commits: 1d123b23, 02213412, b7f30ae1, 1402fa8b, 52a52ca2, c9f285ff, 12057292, 21ba5163.

Head: 21ba51632bf3ab2b2564ed5d95b094636928acab. The worktree is clean. No push or deploy was made. The requested one-time git merge dev was already completed earlier in the job.

Search benchmark

The same five-request, one-second-spaced protocol used a production web build and 100,000 seeded Mail messages.

  • Before the fix: API client p50 220.30 ms, p95 225.10 ms; 0/5 hits and 5/5 timed out.
  • After the fix: API client p50 90.80 ms, p95 592.40 ms; 5/5 hits and 0/5 timed out.
  • The server handler times after the fix were 20.183, 21.552, 64.001, 78.607, and 98.955 ms (p50 64.001 ms, p95 98.955 ms). The 592.40 ms client p95 includes one outlier while the server handler was 98.955 ms; client scheduling is a likely cause, but this is an inference.
  • The fixed SQLite plan starts with SCAN message_search_fts VIRTUAL TABLE INDEX 0:M6, then looks up mail_messages by rowid. The old plan started with mail_messages_page(owner_id=?) and scanned the 100k messages before FTS matching.

Gate output

cargo clippy -p calternal-plugin-mail --all-targets -- -D warnings:

    Checking calternal-plugin-mail v0.0.1 (/home/kayg/Developer/calternal-wt/mail-m2/crates/plugins/mail)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 15.57s

cargo test -p calternal-plugin-mail:

test result: ok. 33 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.52s

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo clippy -p calternal-fs --all-targets -- -D warnings:

    Checking calternal-fs v0.1.0 (/home/kayg/Developer/calternal-wt/mail-m2/crates/calternal-fs)
    Checking proptest v1.11.0
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 3m 44s

cargo test -p calternal-fs:

test result: ok. 39 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 16.29s
test result: ok. 42 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 6.69s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo clippy -p calternal-cli --all-targets -- -D warnings:

    Checking calternal-cli v0.0.1 (/home/kayg/Developer/calternal-wt/mail-m2/crates/calternal-cli)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 1.24s

cargo test -p calternal-cli:

test result: ok. 25 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.76s
test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.07s

bun run check:

Text sizes use shared role tokens.
svelte-check found 0 errors and 0 warnings

bun run test:

Test Files  125 passed (125)
     Tests  799 passed (799)

python3 scripts/parity_matrix.py --check:

Parity matrix: 169 web API actions, 106 shortcuts, 2 static commands, 113 menu actions, 28 settings groups, 151 actions with adapter gaps

cargo build -p calternal-server passed after the Mail search change. Server Clippy was interrupted at the time limit while still compiling dependencies (process exit 143); no final Clippy output was produced. Server tests were not run. cargo fmt completed after the final Rust edits; a final cargo fmt --check was not rerun.

cargo clean output:

     Removed 16266 files, 7.8GiB total

The production web build output was removed after use.

Decisions and known gaps

  • Attachment deep links use /mail/m/{message-id}?attachment={section-id} and /mail/t/{thread-id}?attachment={message-id}:{section-id}. They use stable message IDs and MIME section IDs.
  • MCP lists attachment metadata. It does not return attachment bytes because the MCP response cap is 1 MiB and a Mail download can be 25 MiB. CLI export and WebMCP Save to Files handle the byte transfer.
  • The parity matrix covers the attachment-list API on all three adapters. It does not inventory the binary download route.
  • The adversarial probe was not run, and the 390/820/1440 light/dark production screenshots were not captured or attached.
  • The server Clippy and server test gates remain incomplete because of the four-hour time limit.
  • The per-user Mail index work (#400) and Integrations sign-in work (#407) were left untouched.
## mail-m2 status The job reached its four-hour limit while `cargo clippy -p calternal-server --all-targets -- -D warnings` was still compiling dependencies. I stopped further work at that limit. The server Clippy gate did not produce a final result, `cargo test -p calternal-server` was not run, and the one-time adversarial run and production screenshots were not completed. No screenshots were attached. ## Built and committed - Mail M2 backend and UI: thread-grouped lists, attachment metadata and bounded provider downloads, Save to Files, owner-scoped read-marking preferences, read-state actions, oldest-unread navigation, new-message notice, and Mail settings. - CLI Mail reader commands and safe root-relative, create-only attachment export through `calternal-fs`. - MCP Mail reader actions with scoped write actions. - OpenAPI/client contract and parity matrix. The Mail reader routes in the matrix show CLI, MCP, and WebMCP coverage. - A test-only adversarial probe and fixture for new Mail API cases and 54 review captures. The probe source passes `node --check`; it was not run on a real server. - Search fix: force FTS to drive the join. SQLite 3.51.3 had chosen the owner/time index first and checked FTS for every message. Commits: `1d123b23`, `02213412`, `b7f30ae1`, `1402fa8b`, `52a52ca2`, `c9f285ff`, `12057292`, `21ba5163`. Head: `21ba51632bf3ab2b2564ed5d95b094636928acab`. The worktree is clean. No push or deploy was made. The requested one-time `git merge dev` was already completed earlier in the job. ## Search benchmark The same five-request, one-second-spaced protocol used a production web build and 100,000 seeded Mail messages. - Before the fix: API client p50 `220.30 ms`, p95 `225.10 ms`; `0/5` hits and `5/5` timed out. - After the fix: API client p50 `90.80 ms`, p95 `592.40 ms`; `5/5` hits and `0/5` timed out. - The server handler times after the fix were `20.183`, `21.552`, `64.001`, `78.607`, and `98.955 ms` (p50 `64.001 ms`, p95 `98.955 ms`). The 592.40 ms client p95 includes one outlier while the server handler was 98.955 ms; client scheduling is a likely cause, but this is an inference. - The fixed SQLite plan starts with `SCAN message_search_fts VIRTUAL TABLE INDEX 0:M6`, then looks up `mail_messages` by rowid. The old plan started with `mail_messages_page(owner_id=?)` and scanned the 100k messages before FTS matching. ## Gate output `cargo clippy -p calternal-plugin-mail --all-targets -- -D warnings`: ```text Checking calternal-plugin-mail v0.0.1 (/home/kayg/Developer/calternal-wt/mail-m2/crates/plugins/mail) Finished `dev` profile [unoptimized + debuginfo] target(s) in 15.57s ``` `cargo test -p calternal-plugin-mail`: ```text test result: ok. 33 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.52s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` `cargo clippy -p calternal-fs --all-targets -- -D warnings`: ```text Checking calternal-fs v0.1.0 (/home/kayg/Developer/calternal-wt/mail-m2/crates/calternal-fs) Checking proptest v1.11.0 Finished `dev` profile [unoptimized + debuginfo] target(s) in 3m 44s ``` `cargo test -p calternal-fs`: ```text test result: ok. 39 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 16.29s test result: ok. 42 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 6.69s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` `cargo clippy -p calternal-cli --all-targets -- -D warnings`: ```text Checking calternal-cli v0.0.1 (/home/kayg/Developer/calternal-wt/mail-m2/crates/calternal-cli) Finished `dev` profile [unoptimized + debuginfo] target(s) in 1.24s ``` `cargo test -p calternal-cli`: ```text test result: ok. 25 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.76s test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.07s ``` `bun run check`: ```text Text sizes use shared role tokens. svelte-check found 0 errors and 0 warnings ``` `bun run test`: ```text Test Files 125 passed (125) Tests 799 passed (799) ``` `python3 scripts/parity_matrix.py --check`: ```text Parity matrix: 169 web API actions, 106 shortcuts, 2 static commands, 113 menu actions, 28 settings groups, 151 actions with adapter gaps ``` `cargo build -p calternal-server` passed after the Mail search change. Server Clippy was interrupted at the time limit while still compiling dependencies (process exit `143`); no final Clippy output was produced. Server tests were not run. `cargo fmt` completed after the final Rust edits; a final `cargo fmt --check` was not rerun. `cargo clean` output: ```text Removed 16266 files, 7.8GiB total ``` The production web build output was removed after use. ## Decisions and known gaps - Attachment deep links use `/mail/m/{message-id}?attachment={section-id}` and `/mail/t/{thread-id}?attachment={message-id}:{section-id}`. They use stable message IDs and MIME section IDs. - MCP lists attachment metadata. It does not return attachment bytes because the MCP response cap is 1 MiB and a Mail download can be 25 MiB. CLI export and WebMCP Save to Files handle the byte transfer. - The parity matrix covers the attachment-list API on all three adapters. It does not inventory the binary download route. - The adversarial probe was not run, and the 390/820/1440 light/dark production screenshots were not captured or attached. - The server Clippy and server test gates remain incomplete because of the four-hour time limit. - The per-user Mail index work (#400) and Integrations sign-in work (#407) were left untouched.
kayg commented 2026-09-29 15:01:28 +00:00
Author
Owner
Copy link

Resuming round 3 on branch job/mail-m2. Base SHA: b96693da1f. Current head: 21ba51632b. I am reviewing #395 parity integration and will merge dev once before final gates.

Resuming round 3 on branch job/mail-m2. Base SHA: b96693da1f24922778aba5652176a36aba30c500. Current head: 21ba51632bf3ab2b2564ed5d95b094636928acab. I am reviewing #395 parity integration and will merge dev once before final gates.
kayg commented 2026-09-29 15:01:55 +00:00
Author
Owner
Copy link

Finding during the required dev merge: the job branch and dev both changed WebMCP registration/confirmations, CLI commands, layout confirmation state, and the parity generator/docs. The parity conflict is an add/add; I am taking dev's #395 generator and matrix as the base and folding Mail reader coverage into that shared framework.

Finding during the required dev merge: the job branch and dev both changed WebMCP registration/confirmations, CLI commands, layout confirmation state, and the parity generator/docs. The parity conflict is an add/add; I am taking dev's #395 generator and matrix as the base and folding Mail reader coverage into that shared framework.
kayg commented 2026-09-29 15:29:16 +00:00
Author
Owner
Copy link

The merged CLI reader surface is covered: cargo test -p calternal-cli passed 26 unit tests and 15 output-contract tests. The parity matrix now uses dev's generator and currently marks all M2 Mail reader routes across CLI, MCP and WebMCP.

The merged CLI reader surface is covered: cargo test -p calternal-cli passed 26 unit tests and 15 output-contract tests. The parity matrix now uses dev's generator and currently marks all M2 Mail reader routes across CLI, MCP and WebMCP.
kayg commented 2026-09-29 18:00:44 +00:00
Author
Owner
Copy link

Finding: the first final cargo clippy -p calternal-server --all-targets -- -D warnings attempt could not compile because the RustEmbed folder apps/web/build/ was absent. The derive then left Frontend::get unavailable. This is a generated production-asset prerequisite; I am building the web app before rerunning the server gates and probe. No source defect was indicated.

Finding: the first final `cargo clippy -p calternal-server --all-targets -- -D warnings` attempt could not compile because the `RustEmbed` folder `apps/web/build/` was absent. The derive then left `Frontend::get` unavailable. This is a generated production-asset prerequisite; I am building the web app before rerunning the server gates and probe. No source defect was indicated.
kayg commented 2026-09-29 20:01:29 +00:00
Author
Owner
Copy link

Resuming Mail M2 round 3 on job/mail-m2.

Current HEAD: adeb41074ebfe5190db1d854efd234211acbdb03.
Current branch base from origin/dev: 43c1377c8fd3b1b495841446989a64156f8ae1e4.

I am reviewing the existing #395 parity integration and Mail boundary probe, then I will finish the shared parity rows, run the requested API adversarial probe and capture the required production screenshots before final gates.

Resuming Mail M2 round 3 on `job/mail-m2`. Current HEAD: `adeb41074ebfe5190db1d854efd234211acbdb03`. Current branch base from `origin/dev`: `43c1377c8fd3b1b495841446989a64156f8ae1e4`. I am reviewing the existing #395 parity integration and Mail boundary probe, then I will finish the shared parity rows, run the requested API adversarial probe and capture the required production screenshots before final gates.
kayg commented 2026-09-29 21:59:50 +00:00
Author
Owner
Copy link

mail-m2 round 3: finished (resumed by Claude after the Codex usage limit)

Head: 8d19b921a6cd9d02f7eca39c0294018233460743 on job/mail-m2. The worktree is clean. No push, no merge into dev.

State at resume

  • The last Codex commit c1db3e2b4 merges origin/dev at 369ab6a2f. It has no conflict markers. git diff origin/dev HEAD shows only Mail M2 files, so no dev changes were lost. MailSection.svelte uses dev's SettingsCard in all groups (#402). origin/dev has no newer commits, so no second merge was necessary.
  • The parity matrix uses dev's #395 framework (scripts/parity_matrix.py, docs/parity-matrix.md, docs/parity-exceptions.json). All the M2 Mail reader routes show CLI, MCP and WebMCP coverage. The regenerate check gives no diff.

Done in this session

  • Adversarial probe run (tests/adversarial/mail_api.mjs) against a server built from the merged tree. It passes. The first runs found:
    • Real finding (fixed, c87db6665): GET /api/v1/mail/threads/{id}/oldest-unread answered 200 {"message":null} for another User's thread and for unknown thread IDs. The thread list and attachment routes answer 404 for these IDs, and the OpenAPI contract documents 404. No data leaked because the query is owner-scoped. The route now answers 404 when the caller cannot see the thread. Regression test: oldest_unread_hides_threads_the_caller_cannot_see.
    • Real finding (fixed, 8d19b921a): a non-transient Mail Index error gave a generic 500 and wrote no log line. The error is now logged on the server with tracing::error!. The response stays generic.
    • Probe defects (fixed): the probe expected 200 from the Mail write routes, but their contract answers 204. The fixture's flags_json had an invalid JSON escape, which caused the silent 500 above. The probe also sent {"read":true} to the remote-content route, and its Save to Files locator was ambiguous when there were 2 attachments. The probe now prints server diagnostics when it fails.
  • New Rust test for hostile MIME: malformed_headers_and_deep_multipart_nesting_still_sync. It uses broken encoded-words, an unknown charset, a header line with no colon, a 200 KiB header, a bad Date and 256 nested multipart/mixed levels. Sync completes, the message enters the projection and the body stays bounded. The existing tests already cover huge parts, charset/CSS tricks, scripts, cid: and remote images.
  • Probe coverage: hostile HTML (script, @import and url() CSS exfiltration, remote images before consent, cid: loop) makes 0 remote requests before consent. After consent, only the sanitized HTTPS image loads. Another User's message, attachment, thread messages, thread attachments, oldest-unread, read-state and image-consent routes all answer 404. Another User's Mail does not appear in Search. Save to Files with a ../../../../etc/passwd attachment name writes one safe path segment in the User's Home. The probe also sends hostile, malformed and oversized IDs and bodies, 24 parallel account reads and 24 parallel Inbox reads, and checks the 1-second visible read delay.
  • Screenshots: 42 production-build PNGs. The 7 surfaces are the unified Inbox, a thread, an HTML message with the remote-image consent bar, the attachment list with Save to Files, Mail search results, the new-message notice and oldest-unread navigation. Each is at 390, 820 and 1440 px, in light and dark. They are attached as mail-m2-round3-screenshots.zip (https://git.kayg.org/attachments/4a168ad1-dec7-4ac5-99ed-e001e410233f). They are also in the worktree at artifacts/mail-m2/mail-*.png.

Visual issues I saw in the screenshots (not fixed; for the orchestrator's review)

  1. The sandboxed HTML body iframe has a fixed tall height. A short message shows a large empty white box: about 500 px at 390 px width and about 550 px at 1440 px.
  2. In the attachment inspector, the second row fades under the list's scroll mask. The ../../../../etc/passwd row's meta line and Save button are almost unreadable (1440 dark).
  3. In the Inbox, a lone "Copy link" button floats above the list on the right. Each row has its own large "Copy link" button, and each thread card has a large "Copy message link" button. This makes the page heavy.
  4. The captures use fullPage, so the fixed app background stops at the first viewport and the area below is flat black or grey. This is a capture artifact, not what a User sees while scrolling.

Gate output (verbatim)

cargo fmt --check: exit 0, no output.

cargo clippy -p <crate> --all-targets -- -D warnings:

== clippy calternal-plugin-mail
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 37.05s
== clippy calternal-fs
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 5.82s
== clippy calternal-cli
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 24.52s
== clippy calternal-server
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 2m 18s

cargo test -p <crate>:

== test calternal-plugin-mail
test result: ok. 35 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.38s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
== test calternal-fs
test result: ok. 39 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 7.87s
test result: ok. 42 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 14.83s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
== test calternal-cli
test result: ok. 26 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.76s
test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.04s
== test calternal-server
test result: ok. 83 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 7.32s

bun run check (apps/web):

Text sizes use shared role tokens.
1790714462780 COMPLETED 1894 FILES 0 ERRORS 0 WARNINGS 0 FILES_WITH_PROBLEMS

bun run test (apps/web):

 Test Files  129 passed (129)
      Tests  826 passed (826)

bash packages/api-client/check-generated.sh: exit 0 (git diff --exit-code clean).

✨ openapi-typescript 7.13.0
🚀 ../../contracts/openapi.json → src/generated.ts [410.2ms]

python3 scripts/parity_matrix.py --check:

Parity matrix: 174 web API actions, 106 shortcuts, 2 static commands, 113 menu actions, 30 settings groups, 155 actions with adapter gaps

Adversarial probe:

Mail API probe: remote-content isolation, hostile IDs, cross-User message/thread/attachment isolation, safe attachment names and 24 parallel account/Inbox reads passed

The web gates ran after the merge and before this session's changes. Those changes touch only Rust and test-probe files, so the web results still apply. Mail migrations 0003–0008 do not collide with origin/dev, which has only 0001–0002. cargo clean removed 9.3 GiB. The web build output was deleted.

Remaining / known gaps

  • The visual issues 1–3 above.
  • These gaps are carried over from earlier rounds: Mail FTS is in the shared Index, not the per-User Index (#400). Account sign-in is still in Settings → Mail (#407). MCP returns attachment metadata only; CLI and WebMCP transfer the bytes. Reply forks are not built because they are OPEN in §45.
  • Build note: the shared sccache server ran at about 10 crates per minute with low host load. RUSTC_WRAPPER= built the server in 2 minutes.
## mail-m2 round 3: finished (resumed by Claude after the Codex usage limit) Head: `8d19b921a6cd9d02f7eca39c0294018233460743` on `job/mail-m2`. The worktree is clean. No push, no merge into dev. ### State at resume - The last Codex commit `c1db3e2b4` merges `origin/dev` at `369ab6a2f`. It has no conflict markers. `git diff origin/dev HEAD` shows only Mail M2 files, so no dev changes were lost. `MailSection.svelte` uses dev's `SettingsCard` in all groups (#402). `origin/dev` has no newer commits, so no second merge was necessary. - The parity matrix uses dev's #395 framework (`scripts/parity_matrix.py`, `docs/parity-matrix.md`, `docs/parity-exceptions.json`). All the M2 Mail reader routes show CLI, MCP and WebMCP coverage. The regenerate check gives no diff. ### Done in this session - **Adversarial probe run** (`tests/adversarial/mail_api.mjs`) against a server built from the merged tree. It passes. The first runs found: - **Real finding (fixed, `c87db6665`):** `GET /api/v1/mail/threads/{id}/oldest-unread` answered `200 {"message":null}` for another User's thread and for unknown thread IDs. The thread list and attachment routes answer 404 for these IDs, and the OpenAPI contract documents 404. No data leaked because the query is owner-scoped. The route now answers 404 when the caller cannot see the thread. Regression test: `oldest_unread_hides_threads_the_caller_cannot_see`. - **Real finding (fixed, `8d19b921a`):** a non-transient Mail Index error gave a generic 500 and wrote no log line. The error is now logged on the server with `tracing::error!`. The response stays generic. - **Probe defects (fixed):** the probe expected 200 from the Mail write routes, but their contract answers 204. The fixture's `flags_json` had an invalid JSON escape, which caused the silent 500 above. The probe also sent `{"read":true}` to the remote-content route, and its Save to Files locator was ambiguous when there were 2 attachments. The probe now prints server diagnostics when it fails. - **New Rust test for hostile MIME:** `malformed_headers_and_deep_multipart_nesting_still_sync`. It uses broken encoded-words, an unknown charset, a header line with no colon, a 200 KiB header, a bad Date and 256 nested `multipart/mixed` levels. Sync completes, the message enters the projection and the body stays bounded. The existing tests already cover huge parts, charset/CSS tricks, scripts, `cid:` and remote images. - **Probe coverage:** hostile HTML (script, `@import` and `url()` CSS exfiltration, remote images before consent, `cid:` loop) makes 0 remote requests before consent. After consent, only the sanitized HTTPS image loads. Another User's message, attachment, thread messages, thread attachments, oldest-unread, read-state and image-consent routes all answer 404. Another User's Mail does not appear in Search. Save to Files with a `../../../../etc/passwd` attachment name writes one safe path segment in the User's Home. The probe also sends hostile, malformed and oversized IDs and bodies, 24 parallel account reads and 24 parallel Inbox reads, and checks the 1-second visible read delay. - **Screenshots:** 42 production-build PNGs. The 7 surfaces are the unified Inbox, a thread, an HTML message with the remote-image consent bar, the attachment list with Save to Files, Mail search results, the new-message notice and oldest-unread navigation. Each is at 390, 820 and 1440 px, in light and dark. They are attached as `mail-m2-round3-screenshots.zip` (https://git.kayg.org/attachments/4a168ad1-dec7-4ac5-99ed-e001e410233f). They are also in the worktree at `artifacts/mail-m2/mail-*.png`. ### Visual issues I saw in the screenshots (not fixed; for the orchestrator's review) 1. The sandboxed HTML body iframe has a fixed tall height. A short message shows a large empty white box: about 500 px at 390 px width and about 550 px at 1440 px. 2. In the attachment inspector, the second row fades under the list's scroll mask. The `../../../../etc/passwd` row's meta line and Save button are almost unreadable (1440 dark). 3. In the Inbox, a lone "Copy link" button floats above the list on the right. Each row has its own large "Copy link" button, and each thread card has a large "Copy message link" button. This makes the page heavy. 4. The captures use `fullPage`, so the fixed app background stops at the first viewport and the area below is flat black or grey. This is a capture artifact, not what a User sees while scrolling. ### Gate output (verbatim) `cargo fmt --check`: exit 0, no output. `cargo clippy -p <crate> --all-targets -- -D warnings`: ``` == clippy calternal-plugin-mail Finished `dev` profile [unoptimized + debuginfo] target(s) in 37.05s == clippy calternal-fs Finished `dev` profile [unoptimized + debuginfo] target(s) in 5.82s == clippy calternal-cli Finished `dev` profile [unoptimized + debuginfo] target(s) in 24.52s == clippy calternal-server Finished `dev` profile [unoptimized + debuginfo] target(s) in 2m 18s ``` `cargo test -p <crate>`: ``` == test calternal-plugin-mail test result: ok. 35 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.38s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s == test calternal-fs test result: ok. 39 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 7.87s test result: ok. 42 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 14.83s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s == test calternal-cli test result: ok. 26 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.76s test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.04s == test calternal-server test result: ok. 83 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 7.32s ``` `bun run check` (apps/web): ``` Text sizes use shared role tokens. 1790714462780 COMPLETED 1894 FILES 0 ERRORS 0 WARNINGS 0 FILES_WITH_PROBLEMS ``` `bun run test` (apps/web): ``` Test Files 129 passed (129) Tests 826 passed (826) ``` `bash packages/api-client/check-generated.sh`: exit 0 (`git diff --exit-code` clean). ``` ✨ openapi-typescript 7.13.0 🚀 ../../contracts/openapi.json → src/generated.ts [410.2ms] ``` `python3 scripts/parity_matrix.py --check`: ``` Parity matrix: 174 web API actions, 106 shortcuts, 2 static commands, 113 menu actions, 30 settings groups, 155 actions with adapter gaps ``` Adversarial probe: ``` Mail API probe: remote-content isolation, hostile IDs, cross-User message/thread/attachment isolation, safe attachment names and 24 parallel account/Inbox reads passed ``` The web gates ran after the merge and before this session's changes. Those changes touch only Rust and test-probe files, so the web results still apply. Mail migrations 0003–0008 do not collide with `origin/dev`, which has only 0001–0002. `cargo clean` removed 9.3 GiB. The web build output was deleted. ### Remaining / known gaps - The visual issues 1–3 above. - These gaps are carried over from earlier rounds: Mail FTS is in the shared Index, not the per-User Index (#400). Account sign-in is still in Settings → Mail (#407). MCP returns attachment metadata only; CLI and WebMCP transfer the bytes. Reply forks are not built because they are OPEN in §45. - Build note: the shared `sccache` server ran at about 10 crates per minute with low host load. `RUSTC_WRAPPER=` built the server in 2 minutes.
kayg commented 2026-09-29 22:45:46 +00:00
Author
Owner
Copy link

mail-m2 polish round: done

Head: d4bbdd6fb128c9108fc932f0a7c561f9048478a3 on job/mail-m2. The worktree is clean. No push, no merge.

Commits: 875893d8e (API: unread_count per folder), ebd216dd9 (UI polish), d4bbdd6fb (parity exceptions for the new UI-only actions).

What changed, point by point

  1. Copy link placement: there are no text "Copy link" or "Copy message link" buttons now.
    • The header has ONE Copy link icon button with the warm tooltip and the shortcut L.
    • Thread rows, thread messages and attachments have Copy link in the context menu (right click, long press, Menu key or Shift+F10) and in their ⋯ menu.
    • List rows copy on a right swipe on touch.
    • Links use message, thread and section IDs.
  2. Inbox list: dense two-line rows.
    • Line 1 is the sender, a paperclip glyph when there are attachments, and a right-aligned date. Dates use the app's relative format (the notifications timeLabel, with the full date as the hover title).
    • Line 2 is the subject, then the muted snippet.
    • Unread is an accent dot plus a bolder sender and subject, and an accent-coloured date. There is no "· Unread" text; screen readers hear "Unread:".
    • ⋯ takes the date's place on hover or focus, so the date stays flush right at rest.
  3. Header toolbar: the actions go through usePageChrome into the one mode header. They are icon buttons with warm tooltips and shortcuts: Jump to oldest unread (U), Attachments (A, popover) and Copy link (L), next to the existing ⋯. The ⋯ menu gains Mark as read/unread. The three shortcuts are new registry entries in a new mail group and scope, and they are ignored in text fields.
  4. HTML frame (apps/web/src/lib/mail/frame.ts):
    • Height is automatic from the sandboxed frame. The sandbox is allow-same-origin only and NEVER allow-scripts. The frame CSP still blocks scripts and all network access; images load only after consent.
    • A max of 200dvh applies, after which the frame scrolls inside.
    • The app font and colours are injected at :where() zero specificity. The self-hosted font faces are copied under font-src 'self'.
    • color-scheme matches the app, so the frame stays transparent in dark mode. There is no serif and no white box.
  5. Attachments popover: each item has an icon Save to Files and a ⋯ menu with Copy link. Names use FileName middle truncation on one line and never wrap into the actions. The glyph is centred on the name line (lh unit). The second row no longer fades: the cause was the white frame showing through the glass.
  6. Sidebar:
    • Folder names are humanised with role icons ("INBOX" becomes "Inbox"; Gmail "[Gmail]/Sent Mail" becomes "Sent"). A nested plain folder keeps its full path as a hint.
    • Account headings are the shared section label, truncated, with the full address as the title.
    • Unread badges appear on each folder and on the unified Inbox (the sum of the accounts' Inbox folders). They come from the new MailFolderView.unread_count: one indexed membership scan with a substring test on the stored flags, and a store test covers it.
  7. Screenshots: all 42 are viewport-sized (not full page). They cover 7 screens × 390/820/1440 × light/dark. The new-message capture now reloads per theme, and the search and oldest-unread loops now set the viewport; in the previous round those captures were at the wrong theme or width. I zoomed in on every icon and label row: sidebar icons and badges, row dot and paperclip, notice glyphs, attachment glyphs and the header icons. All are within ±1 px.

The new-message and blocked-images notices are now compact cards with an icon, the text, one action and a hide control. On a narrow card the action moves under the text (container query).

Decisions (not covered by DESIGN)

  • I did not reuse NoticeBanner for the Mail notices, because its --now warning tint reads as an error. The Mail notices are plain cards.
  • The shortcuts are plain letters L / U / A in the mail scope. L matches the block Copy link key.
  • The unified Inbox badge counts unread messages in all Inbox folders across all categories.

Gate output (verbatim)

cargo fmt --check: exit 0
== clippy calternal-plugin-mail
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 35.91s
== test calternal-plugin-mail
test result: ok. 35 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.40s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
== clippy calternal-server
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 2m 16s
== test calternal-server
test result: ok. 83 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 6.55s

bun run check:

1790721580473 COMPLETED 1908 FILES 0 ERRORS 0 WARNINGS 0 FILES_WITH_PROBLEMS

bun run test:

 Test Files  131 passed (131)
      Tests  832 passed (832)

bash packages/api-client/check-generated.sh: exit 0. python3 scripts/parity_matrix.py --check:

Parity matrix: 174 web API actions, 109 shortcuts, 2 static commands, 117 menu actions, 30 settings groups, 155 actions with adapter gaps

Mail adversarial probe (real server, merged tree, UI changes included):

Mail API probe: remote-content isolation, hostile IDs, cross-User message/thread/attachment isolation, safe attachment names and 24 parallel account/Inbox reads passed

Not re-run this round, because the crates are unchanged since round 3 (gates in the previous comment): calternal-fs, calternal-cli.

## mail-m2 polish round: done Head: `d4bbdd6fb128c9108fc932f0a7c561f9048478a3` on `job/mail-m2`. The worktree is clean. No push, no merge. Commits: `875893d8e` (API: `unread_count` per folder), `ebd216dd9` (UI polish), `d4bbdd6fb` (parity exceptions for the new UI-only actions). ### What changed, point by point 1. **Copy link placement:** there are no text "Copy link" or "Copy message link" buttons now. - The header has ONE Copy link icon button with the warm tooltip and the shortcut `L`. - Thread rows, thread messages and attachments have Copy link in the context menu (right click, long press, Menu key or Shift+F10) and in their ⋯ menu. - List rows copy on a right swipe on touch. - Links use message, thread and section IDs. 2. **Inbox list:** dense two-line rows. - Line 1 is the sender, a paperclip glyph when there are attachments, and a right-aligned date. Dates use the app's relative format (the notifications `timeLabel`, with the full date as the hover title). - Line 2 is the subject, then the muted snippet. - Unread is an accent dot plus a bolder sender and subject, and an accent-coloured date. There is no "· Unread" text; screen readers hear "Unread:". - ⋯ takes the date's place on hover or focus, so the date stays flush right at rest. 3. **Header toolbar:** the actions go through `usePageChrome` into the one mode header. They are icon buttons with warm tooltips and shortcuts: Jump to oldest unread (`U`), Attachments (`A`, popover) and Copy link (`L`), next to the existing ⋯. The ⋯ menu gains Mark as read/unread. The three shortcuts are new registry entries in a new `mail` group and scope, and they are ignored in text fields. 4. **HTML frame** (`apps/web/src/lib/mail/frame.ts`): - Height is automatic from the sandboxed frame. The sandbox is `allow-same-origin` only and NEVER `allow-scripts`. The frame CSP still blocks scripts and all network access; images load only after consent. - A max of 200dvh applies, after which the frame scrolls inside. - The app font and colours are injected at `:where()` zero specificity. The self-hosted font faces are copied under `font-src 'self'`. - `color-scheme` matches the app, so the frame stays transparent in dark mode. There is no serif and no white box. 5. **Attachments popover:** each item has an icon Save to Files and a ⋯ menu with Copy link. Names use `FileName` middle truncation on one line and never wrap into the actions. The glyph is centred on the name line (`lh` unit). The second row no longer fades: the cause was the white frame showing through the glass. 6. **Sidebar:** - Folder names are humanised with role icons ("INBOX" becomes "Inbox"; Gmail "[Gmail]/Sent Mail" becomes "Sent"). A nested plain folder keeps its full path as a hint. - Account headings are the shared section label, truncated, with the full address as the title. - Unread badges appear on each folder and on the unified Inbox (the sum of the accounts' Inbox folders). They come from the new `MailFolderView.unread_count`: one indexed membership scan with a substring test on the stored flags, and a store test covers it. 7. **Screenshots:** all 42 are viewport-sized (not full page). They cover 7 screens × 390/820/1440 × light/dark. The new-message capture now reloads per theme, and the search and oldest-unread loops now set the viewport; in the previous round those captures were at the wrong theme or width. I zoomed in on every icon and label row: sidebar icons and badges, row dot and paperclip, notice glyphs, attachment glyphs and the header icons. All are within ±1 px. - Attached: `mail-m2-polish-screenshots.zip` (https://git.kayg.org/attachments/26e5fb41-23f6-4f21-acec-0afde298ce7a) - Local: `/home/kayg/Developer/calternal-wt/mail-m2/artifacts/mail-m2/mail-{inbox,thread,html-consent,attachments,search,new-message,oldest-unread}-{390,820,1440}-{light,dark}.png` The new-message and blocked-images notices are now compact cards with an icon, the text, one action and a hide control. On a narrow card the action moves under the text (container query). ### Decisions (not covered by DESIGN) - I did not reuse `NoticeBanner` for the Mail notices, because its `--now` warning tint reads as an error. The Mail notices are plain cards. - The shortcuts are plain letters `L` / `U` / `A` in the `mail` scope. `L` matches the block Copy link key. - The unified Inbox badge counts unread messages in all Inbox folders across all categories. ### Gate output (verbatim) ``` cargo fmt --check: exit 0 == clippy calternal-plugin-mail Finished `dev` profile [unoptimized + debuginfo] target(s) in 35.91s == test calternal-plugin-mail test result: ok. 35 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.40s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s == clippy calternal-server Finished `dev` profile [unoptimized + debuginfo] target(s) in 2m 16s == test calternal-server test result: ok. 83 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 6.55s ``` `bun run check`: ``` 1790721580473 COMPLETED 1908 FILES 0 ERRORS 0 WARNINGS 0 FILES_WITH_PROBLEMS ``` `bun run test`: ``` Test Files 131 passed (131) Tests 832 passed (832) ``` `bash packages/api-client/check-generated.sh`: exit 0. `python3 scripts/parity_matrix.py --check`: ``` Parity matrix: 174 web API actions, 109 shortcuts, 2 static commands, 117 menu actions, 30 settings groups, 155 actions with adapter gaps ``` Mail adversarial probe (real server, merged tree, UI changes included): ``` Mail API probe: remote-content isolation, hostile IDs, cross-User message/thread/attachment isolation, safe attachment names and 24 parallel account/Inbox reads passed ``` Not re-run this round, because the crates are unchanged since round 3 (gates in the previous comment): `calternal-fs`, `calternal-cli`.
kayg commented 2026-09-30 00:29:47 +00:00
Author
Owner
Copy link

Merged into dev at 1a72e9564 and pushed. Deploy status is on #203.

Merged into dev at 1a72e9564 and pushed. Deploy status is on #203.
kayg closed this issue 2026-09-30 00:29:48 +00:00
kayg commented 2026-10-01 05:20:14 +00:00
Author
Owner
Copy link

Owner decision (2026-10-01): confirmed again. Reuse Apple Mail and especially Gmail keyboard conventions; the shortcut presets (#542) check every Mail letter against them.

**Owner decision (2026-10-01):** confirmed again. Reuse **Apple Mail and especially Gmail** keyboard conventions; the shortcut presets (#542) check every Mail letter against them.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
dev
wip/hiderev-1153
wip/hide4-1153
wip/hide3-1153
wip/hide2-1153
wip/hide-1153
wip/editreg-1132
wip/editorrail3-1113
wip/editorrail2-1113
wip/editorrail-1113
wip/e2e-b2-1071
wip/e2e-b-1071
wip/draw4-1101
wip/draw3-1101
wip/draw2-1101
wip/draw-1101
wip/directory-1199
wip/delete-1119
wip/collabloss-1197
wip/cards2-1083
wip/cards-1083
wip/canvas-visual
wip/canvasvis2-976
wip/calhdr-1112
wip/calcards-1115
wip/browserfix
wip/blocks-1125
wip/allday-1107
wip/agenda-decks
wip/agenda-1086
wip/adv7c-1105
wip/txentry-1198
wip/trayicons2-1095
wip/trayicons-1095
wip/tagperf-1186
wip/sidebar3-1094
wip/segmented-1200
wip/rev2-webperf
wip/rev2-money-ident
wip/previewcard-1098
job/collabloss-1197
wip/palette2-1123
wip/palette-1093
wip/onboard2-1141
job/restyle-settings
wip/onboard-1141.aborted-early
wip/onboard-1141
wip/notifloop-1194
wip/nlpchip-1127
wip/morph-1104
wip/merge-round-7c5
wip/merge-round-7c4
wip/merge-round-7c3
wip/merge-round-7c2
wip/merge-round-7c
wip/mchrome-1084
wip/mailghost2-1094
wip/mailghost-1094
wip/kbpreview2-1118
job/restyle-files
wip/kbpreview-1118
wip/kanban-1092
wip/importhang-1121
job/tagdnd-1187
job/merge30
job/perf-1124
job/tocrail-1191
job/cards-1179
wip/cards2-1179
wip/cards-1179
job/segmented-1200
wip/tocrail-1191
job/hide-1153
wip/tagdnd-1187
wip/restyle-files
wip/perf-1124
wip/merge30j
job/onboard-1141
job/restyle-notes
wip/restyle-notes
job/wizchoices-1140
job/adv-1202
job/notifloop-1194
wip/wizchoices-1140
wip/restyle-1190
job/moneyfmt-1180
job/txentry-1198
wip/moneyfmt2-1180
wip/moneyfmt-1180-r
wip/moneyfmt-1180
job/tagperf-1186
job/pillglass-1189
job/flags-1181
wip/flags-1181
job/restyle-1190
job/restyle-mailmoney
job/restyle-search
job/settingsreg-1195
job/wizard-1140
site/website
wip/wizardrev2-1140
wip/wizardrev-1140
wip/wizard5-1140
wip/wizard4-1140
wip/wizard3-1140
wip/wizard2-1140
wip/wizard-1140
wip/pillglass-1189
wip/settingsreg-1195
job/merge29
job/fu-1171
wip/merge29j
wip/fu-1171
job/fu-1166
job/directory-1199
job/txresearch-1188
wip/fu-1166
job/merge28
job/search-1066
wip/search-1066
wip/merge28j
job/gateslot-1182
job/bulkimport-1157
job/mailnet-1160
wip/mailnetrev-1160
wip/mailnet-1160
wip/bulkrev-1157
wip/bulkimport-1157
job/startup-1161
wip/startup-1161
job/merge27
job/linkcards-1151
wip/linkcards3-1151
wip/linkcards2-1151
wip/linkcards-1151
job/traydate-1144
wip/traydate3-1144
wip/traydate2-1144
wip/traydate-1144
job/draw-1101
wip/merge27j
job/blockpill-1152
wip/blockpill3-1152
wip/blockpill2-1152
wip/blockpill-1152
job/minihover-1149
wip/minihover2-1149
wip/minihover-1149
job/merge25
wip/merge25-r
wip/merge25b
wip/merge25
job/inspector-1129
job/tags-1110
wip/inspector3-1129
wip/inspector2-1129
wip/inspector-1129
wip/tagsrev-1110
wip/tags2-1110
wip/tags-1110
job/dates-1148
wip/datesrev-1148
wip/dates2-1148
wip/dates-1148
job/licence-1145
wip/licence2-1145
wip/licence-1145
job/selfhost-1156
job/merge23
wip/merge23
job/tagfilter-1109
wip/tagfilter2-1109
wip/tagfilter-1109
job/kbd-1134
wip/kbd2-1134
wip/kbd-1134
job/palfoot-1137
wip/selfhost-1156
wip/palfoot2-1137
wip/palfoot-1137
job/toggle-1158
wip/toggle-1158
job/kbpreview-1118
job/docratchet-1155
job/perflint-1133
job/devtests-1159
wip/docratchet-1155
wip/devtests-1159
job/segv-1136
wip/toast-1142
wip/segv-1136
job/toast-1142
job/blockreload-1147
wip/blockreload-1147
job/font-1150
wip/font-1150
job/importui-1120
job/minimonth-1149
wip/importui-1120
wip/minimonth-1149
job/depcheck-1146
wip/perflint-1133
wip/depcheck-1146
job/calcards-1115
job/blocks-1125
job/plus-1128
job/shift-1138
wip/plus2-1128
wip/plus-1128
wip/shift-1138
job/moneyfid-1130
job/editorrail-1113
wip/moneyrev-1130
wip/moneyfid-1130
job/noext-851
wip/noext-851
wip/noext3-851
wip/noext2-851
job/week-1135
wip/week-1135
job/editreg-1132
job/smoke-1122
wip/smoke-1122
job/docs-1143
job/palette2-1123
job/calhdr-1112
job/nlpchip-1127
job/mailghost-1094
job/reconnect-1131
wip/reconnect-1131
job/trayicons-1095
job/delete-1119
job/importhang-1121
job/cards-1083
job/palette-1093
job/mchrome-1084
job/e2e-a-1071
job/canvas-visual
job/previewcard-1098
job/allday-1107
wip/e2e-a2-1071
wip/e2e-a-1071
job/e2e-b-1071
job/adv7c-1105
job/kanban-1092
job/agenda-1086
job/merge-round-7c
job/morph-1104
wip/surfaces-p2
job/merge-round-9
wip/merge-round-9
job/7cfix-small
wip/7cfix-small
job/mailui-1078
job/merge-round-8
wip/merge-round-8
wip/mailui-1078
job/mailround-1038
job/applemail-accept
wip/settitle-1068
wip/mailround2-1038
wip/mailround-1038
wip/e2e-7b
job/crash-1069
wip/crash-1069
job/searchlost-1066
wip/searchlost-1066
job/7b-reconcile
job/flake-1065
wip/flake-1065
wip/merge-round-7b7
wip/merge-round-7b6
wip/merge-round-7b5
wip/merge-round-7b4
wip/7b-reconcile
job/appupdate-1059
job/nfd-1044
wip/appupdate-1059
job/e2e-7b
job/loop-1062
wip/loop-1062
job/pdfprev-1045
job/invtoggle-1053
wip/pdfprev-1045
wip/nfd-1044
wip/invtoggle-1053
job/7bfix-e2e
job/mailstress-b
wip/7bfix-e2e
wip/mailstress-b
job/7bfix-adv
wip/7bfix-adv
job/mailstress-a
job/stack-1054
wip/stack-1054
wip/mailstress-a
job/mailstress-1038
wip/mailstress-1038
job/upload500-1051
wip/upload500-1051
job/share-1034
wip/share-1034
job/syncerr-1037
job/7bfix-photos
wip/7bfix-photos
job/paste-1036
job/setside-1039
wip/setside-1039
wip/paste-1036
job/lease-1042
wip/syncerr-1037
wip/lease-1042
job/7bfix-data
job/passkeybind-1043
wip/apprevoke-1041
job/invite-1035
wip/invite-1035
job/merge-round-7b2
wip/merge-round-7b2
job/mailproxy-486
job/apprevoke-1041
job/rebuild-1033
job/pillborder-1029
wip/pillborder-1029
wip/mailproxy-486
wip/applemail-486
job/headless-998
wip/headless-998
job/groups-1028
wip/groups-1028
job/rebuildwarn-1016
wip/rebuildwarn-1016
job/startup-1011
wip/startup-1011
job/monthpill-1009
job/bgthumb-1025
job/sharetitle-1012
wip/monthpill-1009
wip/bgthumb-1025
wip/sharetitle-1012
job/canvas-cards-977
wip/canvas-cards-977
job/canvas-pencil-978
job/canvas-sketch-990
wip/canvas-sketch-990
wip/canvas-pencil-978
job/canvas-files-989
wip/canvas-files-989
job/canvas-collab-991
wip/canvas-collab-991
job/weekscroll-1018
wip/weekscroll-1018
wip/canvas-core-976
job/canvas-core-976
job/round-drag
wip/round-drag
job/round-settings
job/browserfix
wip/oapi-974
job/oapi-974
job/hist2-integrate
job/mailhtml-726
wip/mailhtml-726
wip/hist2-integrate
job/moneyfu-984
job/drag-1015
wip/drag-1015
job/rename-1017
wip/rename-1017
job/hist2-api
wip/hist2-api
job/oneacct-1014
wip/oneacct-1014
wip/moneyfu-984
job/hist2-bench
job/hist2-restore
wip/hist2-bench
job/hist2-write
job/hotfix-724
wip/hotfix-724
wip/hist2-write
wip/hist2-restore
job/hist2-store
job/hist2-ui
wip/hist2-ui
wip/hist2-store
job/searchstarve-965
job/shutdown-963
wip/shutdown-963
wip/pubedit-981
job/pubedit-981
job/analytics-973
wip/searchstarve-965
job/authflash-850
job/weeklane-969
job/pvtitle-1004
job/hist-975
wip/authflash-850
job/voicepill-617
wip/pvtitle-1004
job/headring-1003
wip/weeklane-969
wip/voicepill-617
wip/headring-1003
wip/analytics-973
job/agentscope-980
wip/thumbsandbox-988
job/thumbsandbox-988
wip/hist-975
job/links-856
wip/links-856
job/davetag-966
wip/davetag-966
job/filesstorm-1000
job/hoverpad-725
wip/filesstorm-1000
job/ffmpegblas-993
job/merge-round-7a
wip/hoverpad-725
wip/ffmpegblas-993
job/nowdot-1002
wip/verify-7a
job/noteid-857
wip/nowdot-1002
wip/noteid-857
wip/merge-round-7a
wip/agentscope-980
job/imapedge
job/a11yfix2
wip/imapedge-941
wip/imapedge
wip/a11yfix2
job/notetask-986
job/logheading
wip/logheading-998
job/textthumb-652
job/photolive-987
wip/photolive-987
job/davactive-983
job/savefix-985
job/tabicons-607
wip/davactive-983
wip/tabicons-607
wip/notetask-986
wip/savefix-985
job/dirid-627
job/buildspeed-1007
wip/dirid-627
job/agenda-decks
job/perfguards-impl
job/undo-a11y
wip/undo-a11y
job/mailperf
job/wal-824
wip/settings-50
job/settings-50
job/notesfilter-606
wip/notesfilter-606
job/surfaces-p2
wip/wal-824
job/maillayouts
wip/mailperf
wip/maillayouts
job/taskmeta-659
job/money-ident
wip/money-ident
wip/taskmeta-659
job/errstates
wip/perfguards-impl
job/headings-881
wip/headings-881
wip/errstates
job/voice-619
job/gaps-827
job/notesperf
wip/notesperf
wip/voice-619
job/hddsql-549
job/perf-stream-668
wip/perf-stream-668
wip/deeplinks-fix
job/deeplinks-fix
job/authfix
job/docsfix-rust
wip/docsfix-rust
job/webperf
job/docsfix-web
job/datafix2
job/webdav-lock-476
job/copyfix
wip/copyfix
wip/webperf
job/focus-658
wip/protofix
job/mediafix
job/protofix
wip/mediafix
job/agentfix
job/hhmm-724
wip/agentfix
job/undo-722
job/reuse
wip/webdav-lock-476
wip/reuse
job/scopefix
job/datafix
wip/hhmm-724
wip/undo-722
job/surfaces-p1
wip/hddsql-549
job/voicememos-618
wip/datafix2
wip/surfaces-p1
job/fix-940
wip/fix-940
job/blaze-surfaces
wip/datafix
wip/blaze-surfaces
job/taskday-655
job/linknav-639
wip/linknav-639
wip/gaps-827
job/isolation-707
job/audiophotos-720
wip/audiophotos-720
job/advfind-664
wip/voicememos-618
wip/taskday-655
wip/isolation-707
wip/advfind-664
wip/scopefix
wip/focus-658
job/testgaps
wip/testgaps
job/overscroll-718
wip/authfix
job/deps
wip/overscroll-718
job/rev2-agentfix
job/rev2-money-ident
job/rev2-mailperf
wip/deps
job/hardening-728
wip/hardening-728
job/searchgen-832
wip/searchgen-832
job/photopw-849
job/mailsql-825
wip/photopw-849
job/sharefix
wip/sharefix
job/rev2-mailhtml-726
job/rev2-perfguards
job/copyval-723
job/lightglass-r2
wip/lightglass-r2
wip/docsfix-web
job/copy-audit
job/macinterop-staging-r2
job/design-sync
job/rev2-taskmeta-659
job/rev2-webperf
job/docs-audit
job/rev2-advfind-664
job/rev2-mailproxy-486
job/states-audit
job/rev2-datafix
job/design-drift
job/test-gaps
job/rev2-voicememos-618
job/rev2-mediafix
job/rev2-deps
job/rev2-datafix2
job/licence-audit
job/issue-hygiene
job/rev2-protofix
job/rev2-voice-619
job/rev2-isolation-707
job/rev2-surfaces-p1
job/deeplink-audit2
job/rev2-audiophotos-720
wip/test-gaps
job/rev2-overscroll-718
job/rev2-undo-722
wip/states-audit
job/rev2-dropmd-719
job/rev2-linknav-639
job/merge-7b-plan
wip/merge-7b-plan
job/rev2-taskday-655
wip/mailsql-825
job/rev2-webdav-lock-476
job/rev2-browserfix
wip/design-drift
job/rev2-hddsql-549
wip/deeplink-audit2
job/rev2-scopefix
job/rev2-authfix
job/rev2-hardening-728
job/rev2-wal-824
job/rev2-sharefix
job/calsidebar-638
job/chrome-audit
job/ioperf
wip/ioperf
wip/chrome-audit
wip/calsidebar-638
job/dropmd-719
wip/dropmd-719
job/ocr-build
wip/ocr-build
job/blaze-settings
wip/copyval-723
job/toastring-721
wip/toastring-721
job/deployfix-732
wip/deployfix-732
wip/blaze-settings
job/money-import-recheck
job/rev-a11y
job/perf-arch-db
job/rev-7b-data
wip/textthumb-652
wip/perf-arch-db
job/sec-protocols
job/sidehdr-660
job/rev-7b-security
job/research-surfaces
job/rev-design-gaps
job/rev-mcp-api
wip/sidehdr-660
job/perf-arch-memory
wip/sec-protocols
job/perf-arch-bundle
job/snapedge-714
wip/rev-mcp-api
job/sec-supplychain
wip/research-surfaces
job/perf-arch-sync
job/rev-consistency
job/perf-arch-server
wip/perf-arch-server
wip/perf-arch-memory
job/perf-arch-io
job/perf-arch-client
job/sec-fs
job/sec-mcp-scopes
job/sec-sharing
job/perf-guards
job/sec-browser
job/sec-admin-deploy
job/sec-auth
wip/snapedge-714
job/bgpicker-717
wip/perf-arch-bundle
wip/money-import-recheck
job/advsetup-654
wip/bgpicker-717
wip/advsetup-654
job/burst-709
job/kbdcaps-710
job/app-pw-chooser
wip/burst-709
wip/app-pw-chooser
job/imaptest-625
wip/kbdcaps-710
job/fix-499
wip/fix-499
job/perf-mut-667
job/calimg-589
job/perf-snap-666
wip/calimg-589
wip/perf-snap-666
wip/perf-mut-667
job/perf-cache-665
wip/perf-cache-665
job/voicefiles-620
wip/voicefiles-620
job/admin-burst-705
wip/admin-burst-705
job/voicememos-review
wip/voicememos-review
wip/ryw-653
job/ryw-653
job/writeonopen-661
job/instant-663
wip/writeonopen-661
job/money-import-review
wip/money-import-review
wip/importjs-610
review/integrations-407-round6
wip/integrations-review
job/dragghost-612
wip/dragghost-612
job/integrations
wip/integrations
job/decider-656
job/merge-round-6
job/perf-rerun
wip/merge-round-6
job/integrations-review-round5
job/selalign-576
wip/selalign-576
job/mcp-events-491
job/files-631
job/cal-e2e-569
wip/cal-e2e-569
job/reload-423
wip/reload-423
wip/mcp-events-491
wip/files-631
job/notesbridge-644
wip/notesbridge-644
job/editor-series
job/calcard-series
wip/calcard-series
job/mcp-events-review-491
wip/mcp-events-review
wip/editor-series
job/quirks-546
job/integrations-recheck
job/tocrail-636
wip/tocrail-636
wip/quirks-546
wip/reminders-643
job/reminders-643
wip/davscale-573
job/davscale-573
job/integrations-review
wip/ocr-eval-584
job/ocr-eval-584
job/esc-537
wip/esc-537
job/toastname-586
wip/toastname-586
job/submenu-579
wip/submenu-579
job/tasks-mode
wip/tasks-mode
job/agentdocs-630
job/dupwrite-634
wip/agentdocs-630
wip/dupwrite-634
job/lightglass-588
wip/lightglass-588
job/tabswitch-549
job/ghosttask-623
wip/ghosttask-623
job/toaststack-616
job/weekstate-609
job/mailsync-613
wip/mailsync-613
wip/weekstate-609
job/maildup-626
wip/tabswitch-549
wip/maildup-626
wip/toaststack-616
job/motion-611
wip/motion-611
job/tlstest-601
wip/tlstest-601
job/perf-495
job/floating-sheet
wip/floating-sheet
job/remdup-585
wip/remdup-585
job/fix-502
wip/fix-502
job/attachplay-622
job/perf-batch
wip/perf-batch-563
wip/perf-495
hotfix/mail-sync-diag
job/mail-m3
wip/mail-m3
job/attach-poof-603
job/calhover-608
job/editorbar-604
job/mentions-605
job/merge-round-4
job/allday-514
wip/merge-round-4
wip/allday-514
job/merge-round-4a
wip/merge-round-4a
job/sharestack-580
job/fix-501
wip/sharestack-580
wip/fix-501
job/perf-batch-563
job/apw-cache-review
wip/apw-cache-review
job/probe-520
wip/probe-520
job/mac-393
wip/mac-393
job/header-571
job/flake-513
wip/flake-513
job/docs-thumb-547
wip/header-571
job/webcal-572
wip/webcal-572
wip/shortcuts-542
job/shortcuts-542
wip/docs-thumb-547
job/caldav-stress
wip/caldav-stress
wip/sweep-478
job/apw-cache-512
wip/apw-cache-512
job/money-empty-540
wip/restart-505
wip/money-empty-540
wip/fix-510
job/restart-505
job/fix-503
job/perf-496
wip/perf-496
job/fix-498
wip/fix-498
job/info-inspector-465
wip/info-inspector-465
job/fix-510
job/fix-507
wip/fix-507
wip/fix-503
job/fix-493
job/money-kinds
wip/money-kinds
job/hygiene-548
job/merge-round-3
wip/fix-493
job/drag-snap-536
wip/merge-round-3
wip/merge-round-0930
wip/drag-snap-536
job/align-538
wip/align-538
job/bg-flash
wip/bg-flash
job/money-import
job/search-count-544
wip/search-count-544
wip/money-import
job/settings-key-541
wip/settings-key-541
job/toast-539
job/preview-421
wip/preview-421
wip/toast-539
job/tasks-500-531
job/title-plain-526
wip/title-plain-526
wip/tasks-500-531
job/notes-bridge
wip/parity-484
job/parity-484
job/files-slow
job/crash-525
wip/notes-bridge
wip/files-slow
wip/crash-525
job/kbd-motion-527
wip/bg-422
job/analytics-504
wip/analytics-504
wip/kbd-motion-527
job/upload-pill-523
wip/upload-pill-523
wip/tray-order
job/tray-order
wip/overflow-mid
wip/merge-round-2
job/perf-494
wip/perf-494
wip/mcp-fast-492
wip/motion-477
wip/asr-ab-489
wip/theme-variants-506
wip/overflow-511
wip/week-header-508
wip/attach-427
job/dav-delete-471
job/iso-435
wip/iso-435
wip/files-sel-keys
wip/dav-delete-471
job/align-253
job/siwc-490
wip/siwc-490
job/money-kinds-review
wip/align-253
wip/money-kinds-review
job/small-bugs-3
wip/overlay-title-487
wip/multiget-500
wip/hidden-420
wip/webcal-ui
wip/webcal-431
job/perf-367
job/location
wip/small-bugs-3
wip/location
wip/perf-367
wip/admin-deny-483
job/tag-unicode-473
wip/tag-unicode-473
job/blur-436
wip/photos-470
wip/blur-436
wip/small-bugs-4
wip/hunt-20260930
wip/settings-hdr-482
wip/chips-416
job/dedup-375
wip/dedup-375
job/doc-stack
wip/doc-stack
job/tokens-literals
wip/tokens-literals
job/jobs-leftovers
wip/send-fast
wip/paste-467
wip/money-numbers
job/money-plugin
wip/money-plugin
job/break-dav
wip/merge-batch
wip/crossday-469
wip/mac-verify
wip/mail-m2
wip/break-dav
wip/money-review2
job/money-md
job/modes-424
wip/money-md
wip/jobs-leftovers
job/agenda-413
wip/agenda-413
wip/modes-424
job/recog-417
wip/recog-417
wip/bounce-425
wip/ab-384-luna
job/webdav-perf
wip/webdav-perf
job/toast-ring
wip/toast-ring
job/money-review
wip/money-review
wip/micro-motion
wip/settings-card
wip/minical
job/notes-imap-428
job/least-priv
wip/ui-small-2
wip/flaky-426
wip/drag-end-418
job/jank
wip/jank
wip/least-priv
wip/docs-site
job/agenda
job/sec-batch
wip/sec-batch
wip/per-user-index
job/area-calendars
wip/area-calendars
job/parity
wip/parity
job/documents-research
wip/documents-research
job/test-infra
job/reminders-sync
wip/small-bugs-2
wip/reminders-sync
wip/gestures
job/google-oauth
wip/tags-merge
wip/tags
job/e2e-theme
wip/e2e-theme
job/icon-align
wip/test-infra
wip/select-align
wip/editor-385
job/voice
wip/webdav
job/webdav
job/app-pw-ui
job/editor-integrity
wip/editor-integrity
wip/voice
wip/quota
wip/cal-followups
wip/icon-align
job/composer-scale
wip/composer-scale
job/jobs-page
wip/jobs-page
job/hig-type
wip/hig-type
wip/app-pw-ui
job/motion-spring
job/mcp
wip/motion-spring
wip/mcp
job/small-bugs
wip/push-hosts
job/profile-sign
wip/touch-369
wip/profile-sign
job/mobile-focus
wip/mobile-focus
wip/ui-polish-354
wip/small-bugs
wip/dup-task
job/toast-polish
job/app-pw-scopes
wip/toast-polish
wip/app-pw-scopes
wip/cli-agent
wip/selection-pills
job/preview-attach
wip/preview-attach
job/dav-proppatch
wip/dav-proppatch
wip/cal-switcher
job/atomic-race
wip/atomic-race
job/photos-shared
wip/photos-shared
wip/cal-grid
wip/note-rewrite
wip/search-rebuild
job/mail-m1
job/paperless-import
wip/paperless-import
wip/mail-m1
wip/hidden-activity
wip/search-d
wip/pricing-research
wip/cursors
wip/auto-scheme
job/single-pills
wip/single-pills
wip/xuser-matrix
wip/money-format
wip/app-pw-setup
wip/purge-dos
wip/vault-health
wip/caldav-apple
wip/xuser-audit
wip/e2e-green
wip/tabbar
wip/adv-harness
wip/maple-mono
job/search-fix
wip/search-fix
wip/search-perf-c
job/adv-harness
wip/sidebar-headers
job/glass
wip/temp-index
job/polish
wip/polish
wip/file-protocols
wip/money-research
wip/glass
wip/voice-models
wip/collab-redo
job/voice-research
wip/hunt-20260928
wip/notes-actions-research
wip/search-pad
wip/search-perf
wip/search-sticky
wip/editor-undo
wip/chrome-rules
wip/motion
wip/appearance-research
wip/appearance
wip/audit-bugs
wip/cal-glass
wip/block-actions
wip/authz-order
wip/event-stripes
wip/chrome-sidebar
wip/auth-flaky
wip/robust-2
wip/gate-fix
wip/menu-blur
wip/import-calternaljs
wip/tray-fix
job/import-calternaljs
wip/index-order
wip/audit-fixes
wip/search-chevrons
research/mail
wip/phone-chrome
wip/dedup-break
wip/csp
wip/ui-audit
wip/select-toast
wip/perf
wip/flat-layout
wip/fonts
wip/event-tint
wip/sync-converge
wip/data-split
wip/glass-audit
wip/robustness
wip/sync-chaos
wip/search-thumbs
wip/fuzz
wip/menu-icons
wip/search-pill
wip/sync-changing
wip/heading-links
wip/date-formats
wip/a11y
wip/break-editor
wip/e2e-fix
wip/settings-sections
wip/sync-root-guard
wip/search-palette
wip/share-edit
job/toasts
wip/toasts
wip/cont-analytics
wip/authz-review
wip/popovers
wip/overlay-glass
wip/change-feed
wip/editor-modes
wip/composer-align
wip/cont-agenda
wip/agenda-merge
job/agent-conventions
wip/agent-conventions
wip/backend-misc
job/route-audit
wip/route-audit
wip/ui-batch
wip/heif-hardening
wip/grid-resize
wip/ask-page
wip/webmcp
job/deeplink-audit
wip/deeplinks
wip/shortcuts
wip/cont-tz-days
main
No results found.
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal#396
No description provided.