v0.2.8

RELEASE-MANIFEST.txt

@@ -1,15 +1,20 @@
-RustBox 0.2.6 release manifest
+RustBox 0.2.8 release manifest
 
-0.2.6 feature/configuration changes:
-- fixes iPhone/iOS Safari reader action menus by rendering open Details / Move / copy popovers outside the scrolling toolbar
-- refreshes unread counters with server-reported unread counts and avoids frequent IMAP folder-list refreshes
-- watches the currently viewed folder with IMAP IDLE and synchronizes remaining folders on a 30-second fallback cadence
-- stores new message headers before realtime events, allowing newly arrived messages to appear live in the active list
-- shows an in-app toast for new mail in any folder and deduplicates browser notifications per message
-- shows an animated indexing indicator beside Contacts while deep indexing is active
-- excludes Trash/Junk/Spam from the deep-index selection query
-- manual refresh forces current-folder message/count refresh while folder counters refresh in parallel
-- no schema migration; V047 remains current and V048 remains next
+0.2.8 feature/configuration changes:
+- fixes folder unread counts by treating IMAP STATUS UNSEEN as authoritative and never using SELECT/EXAMINE UNSEEN as a count
+- falls back to UID SEARCH UNSEEN when STATUS is unavailable for the selected mailbox
+- reconciles MESSAGES/UNSEEN even when HIGHESTMODSEQ is unchanged and rejects out-of-order stale counter writes with compare-and-set/retry
+- updates individual message rows and folder counters optimistically/live for read/unread/flag events instead of rebuilding the message list, then reconciles them to authoritative IMAP state
+- shows wide folder badges as total / unread, hides the unread suffix at zero, and switches to compact counters in narrow sidebars
+- exposes IMAP header-cache and deep-index backlog through the activity indicator and tooltip
+- keeps counter STATUS separate from the CONDSTORE cursor, falls back to full UID/FLAGS reconciliation when needed, and refuses to apply partial IMAP streams
+- keeps security_headers_enabled opt-in, centralizes the RustBox-added browser security profile behind that switch, and applies the full document-only profile only to HTML/XHTML
+- uses external same-origin JavaScript with `script-src 'self'`, disables inline script attributes, restricts stylesheets to `style-src 'self'`, and permits only dynamic style attributes via `style-src-attr 'unsafe-inline'`
+- applies no-store, nosniff, same-origin CORP and an anti-framing `frame-ancestors 'none'`/X-Frame-Options policy to private API responses; the full document CSP plus Permissions-Policy/COOP remain HTML-only, and assets receive same-origin CORP where applicable
+- leaves HSTS to the HTTPS/TLS-terminating deployment layer
+- minimizes the public auth policy to rememberMeEnabled and moves optional feature availability behind authenticated /api/auth/session-policy
+- adds/extends regression coverage and offline release checks for the changed behavior
+- adds runtime migration V048 on SQLite/MySQL/PostgreSQL for monotonic folder-counter generations; V049 remains next
 
 Architecture:
 - database_backend = sqlite | mysql | pgsql selects authoritative SQL only
@@ -36,31 +41,8 @@ Database/schema:
 - migrations/{sqlite,mysql,pgsql}/schema.sql contain the current fresh schema
 - compatibility baseline remains V046
 - runtime migration V047 adds attachment checksum metadata and search_outbox
-- next migration number: V048
-
-PostgreSQL message mutation fix (0.2.2):
-- header_sync_generation UPSERT qualifies the current tenant user_meta.value on the UPDATE RHS
-- this prevents PostgreSQL from treating `value` as ambiguous during ON CONFLICT DO UPDATE
-- SQLite/MySQL equivalents were reviewed and require no matching SQL change
-- no schema migration is required
-
-PostgreSQL startup compile fix (0.2.2):
-- multi-statement global schema DDL uses `sqlx::Executor::execute()` on the transaction connection
-- avoids SQLx raw_sql mutable-connection lifetime inference failures (`Executor is not general enough`)
-- retains the startup transaction and `SET LOCAL client_min_messages TO WARNING`
-- no schema migration is required
-
-Database/session startup (0.2.2):
-- db::pool::configure() is the single owner of global schema initialization
-- database-backed session persistence does not execute schema.sql a second time
-- the fix applies uniformly to SQLite, MySQL and PostgreSQL
-- PostgreSQL expected IF NOT EXISTS notices are suppressed only inside the startup DDL transaction
-- no SQL migration is required; runtime schema remains V047
-
-SQLite test isolation (0.2.2):
-- test builds initialize each requested SQLite database but do not publish a TempDir-backed path into the process-wide database OnceLock
-- account/database tests therefore remain isolated when Rust runs them in parallel
-- a regression test covers deleting the first TempDir before opening a second test database
+- runtime migration V048 adds `folders.counter_generation` for race-safe authoritative IMAP counter writes
+- next migration number: V049
 
 Docker examples:
 - docker/compose-single-sqlite.yml
@@ -69,14 +51,14 @@ Docker examples:
 - docker/compose-mysql-nfs-opensearch.yml (MySQL + real NFS volume + OpenSearch)
 
 Operations/docs:
-- README.md documents 0.2.6 storage/search configuration
+- README.md documents 0.2.8 configuration
 - docker/README.md documents Compose variants
 - docs/STORAGE_SEARCH_OPERATIONS.md documents failure modes, shared-storage requirements and migration behavior
 - TODO.md leaves live SILO/MinIO/AWS/Ceph and real multi-node acceptance validation explicitly pending
 
 Build/release metadata:
 - `scripts/package-release.sh` runs the full Rust release gate before creating ZIP/SHA256 artifacts
-- Cargo.toml version = 0.2.6
+- Cargo.toml version = 0.2.8
 - rust-toolchain.toml pins Rust 1.99.1
 - Cargo.lock is retained for reproducible application builds; the release gate generates it only when missing
 - CI and scripts/build-release.sh use the retained Cargo.lock (generating it only if missing), then run locked tests/Clippy/release build