v0.2.13

docs/IMPLEMENTATION_STATUS.md

@@ -1,9 +1,9 @@
-# RustBox 0.2.12 - implementation status
+# RustBox 0.2.13 - implementation status
 
 - Draft saves are realtime-silent: Drafts folder/list updates continue, but saving a draft does not surface as a new-mail notification.
-This file tracks the `0.2.12` source snapshot. Storage/search scope and outstanding acceptance work are tracked in `TODO.md`. A feature is only listed as implemented when working code exists in this source tree; partial items are called out explicitly.
+This file tracks the `0.2.13` source snapshot. Storage/search scope and outstanding acceptance work are tracked in `TODO.md`. A feature is only listed as implemented when working code exists in this source tree; partial items are called out explicitly.
 
-## 0.2.12 browser mail UX
+## 0.2.13 browser mail UX
 
 - Large To/Cc lists collapse to a compact recipient summary and expand on demand.
 - Message pagination exposes both `Load more` and `Load all`; both actions stretch evenly across the full list width, and the reader menu label is shortened to `Details`.
@@ -23,7 +23,8 @@ This file tracks the `0.2.12` source snapshot. Storage/search scope and outstand
 - Composing displays attachment/message size limits as one compact line without configuration/MIME implementation details.
 - Initial synchronization remains silent for new-mail notifications; bulk operations retain one summary toast; browser/system modifier shortcuts remain preserved.
 - Mailbox pages default to 300 messages and the API/preferences accept values up to 300.
-- No runtime schema migration is added; V049 remains next.
+- Blob deletion uses a durable SQL outbox for filesystem/shared POSIX/NFS and S3 backends; attachment/draft metadata deletion is transactionally paired with cleanup enqueue and failed deletes retry in the background.
+- Runtime migration V049 adds `blob_delete_outbox` on SQLite, MySQL and PostgreSQL; V050 is next.
 
 ## 0.2.8 browser security headers
 
@@ -43,7 +44,7 @@ This file tracks the `0.2.12` source snapshot. Storage/search scope and outstand
 - Draft attachment upload/read/delete/snapshot/send paths use the `BlobStorage` abstraction and logical object keys instead of assuming node-local paths.
 - OpenSearch is available as the cluster-capable indexer. Local Tantivy remains single-node only; search may also be disabled.
 - Search mutations use a durable SQL outbox with claim/lease, retry/backoff and dead-letter state; the index remains rebuildable derived state.
-- V047 adds attachment checksum metadata and the search outbox across SQLite, MySQL and PostgreSQL. V048 adds monotonic folder-counter generations used by compare-and-set reconciliation of authoritative IMAP counts; V049 is reserved as the next migration number.
+- V047 adds attachment checksum metadata and the search outbox across SQLite, MySQL and PostgreSQL. V048 adds monotonic folder-counter generations used by compare-and-set reconciliation of authoritative IMAP counts. V049 adds the durable blob deletion outbox; V050 is reserved as the next migration number.
 - SQL global-schema initialization is centralized in `db::pool::configure()`; database-backed sessions do not repeat startup DDL for SQLite, MySQL or PostgreSQL.
 - Docker Compose examples cover standalone SQLite, PostgreSQL + SILO (S3-compatible) + OpenSearch, and MySQL + NFS + OpenSearch.
 - Live SILO/MinIO/AWS S3/Ceph RGW, live NFS multi-host, live OpenSearch and full multi-node failover acceptance remain release-environment validation items and are not represented as completed here.

docs/RELEASING.md

@@ -26,7 +26,7 @@ RUSTBOX_CONFIG=./config.dev.toml ./target/release/rustbox --check-config
 
 Browser JavaScript source lives in functional modules under `src/web/js/`, ordered by `src/web/js/manifest.txt`. `build.rs` concatenates those modules into the embedded `rustbox-ui.js` asset during every Cargo build. The repository has no duplicate `ui/` snapshot; `src/web/` is the only browser UI source.
 
-## Updating an existing checkout to 0.2.12
+## Updating an existing checkout to 0.2.13
 
 Do not overlay the release with `cp *` or another command that skips dotfiles. That can retain stale `.github`, `.env.example`, or `Cargo.lock` files.
 

docs/STORAGE_SEARCH_OPERATIONS.md

@@ -1,6 +1,6 @@
-# RustBox 0.2.12 storage/search operations
+# RustBox 0.2.13 storage/search operations
 
-RustBox 0.2.12 treats SQL, blob storage and search as independent capabilities. The database engine does not decide whether `data_dir` is allowed.
+RustBox 0.2.13 treats SQL, blob storage and search as independent capabilities. The database engine does not decide whether `data_dir` is allowed.
 
 ## Deployment matrix
 
@@ -28,6 +28,12 @@ For NFS/CephFS/GlusterFS:
 
 Attachment SQL rows store logical object keys. This keeps SQL independent from a node-specific filesystem path.
 
+## Durable blob deletion
+
+Attachment deletion is not best-effort. RustBox writes a `blob_delete_outbox` entry in the same SQL transaction that removes the attachment row or draft row, then attempts the physical delete immediately. A background worker retries failures with claim leases and exponential backoff until the object is gone; object-store `NotFound` is treated as success. The same path is used for local filesystem, shared POSIX/NFS and S3-compatible backends. Failed finalized uploads and failed migration destination objects are also queued for cleanup.
+
+This avoids orphan accumulation when storage is temporarily unavailable while also avoiding the inverse failure mode where a blob is deleted first and the SQL transaction later fails.
+
 ## Search and outbox
 
 OpenSearch is the cluster-capable indexer. Every indexed document is scoped by `user_hash`; queries add a server-side tenant filter and deterministic document IDs are routed by tenant.