RustBox/RELEASE-VALIDATION.txt

RustBox 0.2.25 - final source validation

0.2.25 scope:
- filters: apply now on existing messages (`POST /api/filters/match`, IMAP UID SEARCH bounds + cache), exceptions, new conditions and actions, templates, missing-folder creation, "always move from this sender"
- message context menu with submenus that fit the window
- fixes: editing a predefined style no longer mixes two styles; "Soft" contrast keeps borders

0.2.24 scope:
- "Style gradients" now applies at every style depth through `59-skin-gradients.css`, to every predefined style except RustBox
- adds Windows XP, Mac OS X Aqua, iOS 6, Windows 7 Aero, Frutiger Aero and BeOS inspired styles (43 styles in total)
- time-of-day theme, per-account colour and second calendar reminder with defaults (V054), grouped style selector with short names, custom-colour contrast warning, message-list skeleton, theme cross-fade
- fixes: light-theme selection colour, subject truncation, flagged marker, reader-toolbar overflow

0.2.23 scope:
- adds Appearance "Style depth" (`skin_depth`, V053): colors only / standard (default) / immersive
- adds a separate "Style gradients" switch (`skin_gradients`, V053, default off); every stylesheet gradient is gated by it
- interface-style standard: every predefined style ships light+dark palettes, a fixed layout profile and structural design tokens; 23 existing styles adapted, 14 new styles added (Dracula, Catppuccin, Solarized, Gruvbox, Tokyo Night, Rosé Pine, Everforest, Synthwave, Paper, Terminal, Aqua Glass, Linear, Material You, Retro 95)
- V051/V052 consolidated into the fresh schemas; compatibility baseline V052
- fresh MySQL schema: `message_loading_mode` uses an expression default

0.2.22 scope:
- adds message snooze (`snoozed_messages`, V052): hides a message client-side from its current folder view until a chosen wake time; purely client-side hiding, no server-side pagination/count SQL changes, no IMAP side effects
- adds an in-memory "Undo Send" window (`undo_send_window_secs`, default 8s, max 120s): a submitted message is staged and only dispatched to SMTP once the window elapses unless cancelled first; not persisted, so a restart during the window drops the staged send
- new endpoints: `GET/DELETE /messages/send/{pending_send_id}`, `POST/DELETE /messages/{folder}/{uid}/snooze`, `GET /messages/snoozed`, `GET /folders/{name}/snoozed-uids`

0.2.21 scope:
- adds configurable login brute-force protection (`[login_rate_limit]`): per-IP token bucket plus per-mailbox and per-IP failed-attempt lockouts with exponential back-off; locked attempts return 429 + Retry-After before any IMAP connection
- the public `/api/auth/policy` GET no longer consumes the per-IP login budget
- adds `cookie_secure = auto | always | never`; `auto` sets the cookie `Secure` attribute only for requests that really arrived over HTTPS, so plain-HTTP installs keep working
- adds attachment memory guards: attachment sets that cannot fit `max_message_size_mb` once MIME-encoded are rejected with 413 from stored sizes before any file is loaded (send, IMAP draft snapshot, attach-message, streaming upload), and `max_concurrent_message_builds` / `message_build_wait_secs` bound how many requests hold attachments in RAM at once
- adds gmail-style message row opening: Ctrl/Cmd+click opens a message in a new tab, Shift+click opens it in a popup window, both deep-linked (outside selection mode; existing shift/ctrl selection behavior while selecting is unchanged)
- fixes the Axum route visibility mismatch for `AttachMessageSourceRequest`, allowing the forward-as-attachment handler to compile from `routes::mod`
- falls back to IMAP `INTERNALDATE` for messages with a missing/invalid message `Date` and repairs cached missing dates when opening a folder
- forwards a message as a real server-created `message/rfc822` `.eml` draft attachment
- HTML message reader iframe height follows the actual remaining reader viewport rather than a fixed 68vh, with resize/fullscreen recalculation
- multi-account sessions expose a top-bar quick switcher, per-browser combined notification selection, per-account notification preferences and the administrator `multi_account_enabled` feature gate
- plain-text and HTML signature controls have aligned heights; raw HTML can be pasted into a modal, previewed/edited visually and extended with inline images
- synchronization spinner covers mailbox pagination, progressive/full-folder loading and message/draft body retrieval
- Shift-click selects a contiguous visible-message range; pagination includes first/last page jumps
- signature HTML formatting preserves selected text across toolbar clicks, including formatting removal, while collapsed-caret clicks cannot enable sticky bold/italic/underline typing modes
- the HTML signature editor is no longer wrapped in a label, preventing whitespace/outside clicks from implicitly activating the Bold toolbar button
- new messages with visible signatures provide an editable body area above a more subtle, better-spaced separator
- wide message panes use compact one-line rows by default, with a persisted Mailbox preference to disable them
- signatures support per-identity silent append-on-send (default) or visible/editable composer insertion
- durable blob deletion outbox covers filesystem/shared POSIX/NFS and S3, pairing metadata deletion with cleanup enqueue in one SQL transaction and retrying storage failures without permanent dead-lettering
- failed finalized uploads and failed storage-migration destination objects are queued for cleanup
- saving/updating a draft stays silent in realtime: Drafts still refreshes, but no “new message” toast/system notification is emitted
- composer `Delete draft` removes the current verified IMAP draft and cascades local draft attachment metadata/blob cleanup
- explicit Save draft action before Cancel forces a real IMAP Drafts snapshot while background autosave behavior remains unchanged
- manual IMAP save reports APPEND/snapshot failures instead of showing false success
- draft recovery restores attachment metadata and the attachment strip keeps inline plus regular files visible together
- new uploads merge against the full server-side draft attachment list so adding another file cannot replace an existing visible entry
- composer UX regression fixed: image actions are contextual/floating instead of a dedicated layout row
- multiple inline images/attachments append independently and do not replace the active selection
- same-name/same-size files are no longer silently de-duplicated
- recipient list collapsing, mailbox pagination, progressive loading, full-folder loading, and reader Details label
- composer fields can collapse to maximize the message editor, and invalid recipient input expands them again
- inline attachment embedding/re-embedding, clipboard/file drop insertion, image drag repositioning, and pointer resize handles
- message-body links without an explicit target open outside the sandboxed preview in a new tab/window, while explicit targets are preserved
- page refresh/session restoration does not emit a false “Successfully logged in” toast
- real login still emits the success toast
- message preview documents explicitly use UTF-8 and RFC 2047 headers support UTF-8, ISO-8859-2 and Windows-1250 decoding
- PDF attachment preview uses the authenticated inline URL for Safari/iPhone compatibility
- Composing shows only compact attachment/message size-limit values on one line
- 0.2.9 realtime notification gating, browser shortcut preservation and 300-message defaults remain intact
- V047-V052 are consolidated into compatibility baseline V052; V053 adds `skin_depth` and `skin_gradients`; V054 adds the theme schedule and account colour; V055 is next
- version metadata identifies 0.2.25

Completed in this environment:
- offline release validator: scripts/validate-release-static.py (455/455 checks passed)
- browser JavaScript assembled in manifest order passes `node --check`
- all JSON files parse successfully
- Python helper scripts compile successfully
- shell scripts pass `bash -n`
- release metadata consistently identifies 0.2.25
- V052 baseline consolidation plus the V053 skin-depth migration are validated offline
- 0.2.25 filter UI (apply now, run now, always move from sender), context submenus and preset editing exercised in Playwright against a mocked API; the 0.2.24 styles rendered at standard and immersive depth with gradients on and off; earlier: all 37 interface styles rendered in light and dark at the immersive depth against a mocked API (Playwright), with no page errors


Not executable in this packaging environment:
- cargo fmt/test/clippy/build with Rust 1.99.1, because Rust/Cargo is not installed
- live PostgreSQL/MySQL/S3/NFS/OpenSearch/IMAP integration tests

The final release gate on a Rust host is:
  bash scripts/build-release.sh

This file intentionally does not claim blocked runtime/integration checks as passed.