v0.2.9

RELEASE-MANIFEST.txt

@@ -1,21 +1,12 @@
-RustBox 0.2.8 release manifest
-
-0.2.8 feature/configuration changes:
-- fixes folder unread counts by treating IMAP STATUS UNSEEN as authoritative and never using SELECT/EXAMINE UNSEEN as a count
-- falls back to UID SEARCH UNSEEN when STATUS is unavailable for the selected mailbox
-- reconciles MESSAGES/UNSEEN even when HIGHESTMODSEQ is unchanged and rejects out-of-order stale counter writes with compare-and-set/retry
-- updates individual message rows and folder counters optimistically/live for read/unread/flag events instead of rebuilding the message list, then reconciles them to authoritative IMAP state
-- shows wide folder badges as total / unread, hides the unread suffix at zero, and switches to compact counters in narrow sidebars
-- exposes IMAP header-cache and deep-index backlog through the activity indicator and tooltip
-- keeps counter STATUS separate from the CONDSTORE cursor, falls back to full UID/FLAGS reconciliation when needed, and refuses to apply partial IMAP streams
-- keeps security_headers_enabled opt-in, centralizes the RustBox-added browser security profile behind that switch, and applies the full document-only profile only to HTML/XHTML
-- uses external same-origin JavaScript with `script-src 'self'`, disables inline script attributes, restricts stylesheets to `style-src 'self'`, and permits only dynamic style attributes via `style-src-attr 'unsafe-inline'`
-- applies no-store, nosniff, same-origin CORP and an anti-framing `frame-ancestors 'none'`/X-Frame-Options policy to private API responses; the full document CSP plus Permissions-Policy/COOP remain HTML-only, and assets receive same-origin CORP where applicable
-- leaves HSTS to the HTTPS/TLS-terminating deployment layer
-- minimizes the public auth policy to rememberMeEnabled and moves optional feature availability behind authenticated /api/auth/session-policy
-- adds/extends regression coverage and offline release checks for the changed behavior
-- adds runtime migration V048 on SQLite/MySQL/PostgreSQL for monotonic folder-counter generations; V049 remains next
+RustBox 0.2.9 release manifest
 
+0.2.9 feature/configuration changes:
+- suppresses startup new-mail toasts and arms realtime mail notifications only after authenticated startup is complete and the WebSocket has been open for a short grace period
+- suppresses self-generated destination-folder NewMessages notifications during bulk move/copy/archive/junk/delete operations while retaining the bulk summary toast
+- shows a success toast after authenticated startup/login
+- preserves browser/system Ctrl/Cmd shortcuts by limiting RustBox single-key shortcuts to unmodified keys; compose remains available on C
+- defaults mailbox pages/preferences to 300 messages and raises the supported per-page API/preference limit to 300
+- requires no runtime schema migration; V049 remains next
 Architecture:
 - database_backend = sqlite | mysql | pgsql selects authoritative SQL only
 - blob storage and search are independent from the SQL engine
@@ -51,14 +42,14 @@ Docker examples:
 - docker/compose-mysql-nfs-opensearch.yml (MySQL + real NFS volume + OpenSearch)
 
 Operations/docs:
-- README.md documents 0.2.8 configuration
+- README.md documents 0.2.9 configuration
 - docker/README.md documents Compose variants
 - docs/STORAGE_SEARCH_OPERATIONS.md documents failure modes, shared-storage requirements and migration behavior
 - TODO.md leaves live SILO/MinIO/AWS/Ceph and real multi-node acceptance validation explicitly pending
 
 Build/release metadata:
 - `scripts/package-release.sh` runs the full Rust release gate before creating ZIP/SHA256 artifacts
-- Cargo.toml version = 0.2.8
+- Cargo.toml version = 0.2.9
 - rust-toolchain.toml pins Rust 1.99.1
 - Cargo.lock is retained for reproducible application builds; the release gate generates it only when missing
 - CI and scripts/build-release.sh use the retained Cargo.lock (generating it only if missing), then run locked tests/Clippy/release build