Work with CommuniGate Pro Like Never Before

Presence works across all your sessions, buddy requests and display names, presence icons without avatars (includes 4.0.91–4.0.96)

• Live presence no longer dies after login. A second, bare signalBind from the always-mounted Feedback view replaced the real registration (readIM + presence), so contacts stayed offline and buddy requests never arrived live. The IM store now owns the one signal binding.
• Orange states (be right back, out for lunch, in a meeting …) no longer show as “online” to contacts when you are logged in on several devices. CommuniGate merges the presence of all sessions of an account and “online” wins; every drift session now takes its state from the account preferences and reports it itself — at login, and whenever another client changes it (same model as Samoware).
• Add contact works with a typed address and saves the display name you enter.
• Presence icon also when avatars are switched off (chat buddy list, contacts, own status in the sidebar).
• Restored the “unbind before re-bind” guard for chat re-initialisation.
• Shipped on Windows, macOS, and Linux — signed+notarized Mac dmg, deb/rpm/AppImage.

IMAP ↔ CGP switch is now instant — no 3-second body re-hydrate, no stale IMAP folder-tree refetch, no cryptic path flash in the header

• IMAP ↔ CGP switch no longer stalls ~3 s re-hydrating bodies that are already in RAM. Clicking back from an IMAP account to CGP INBOX fired exitImapMode() → loadEmails('INBOX') → STEP 1 wholesale-replaced cgpEmails.value with cold IndexedDB rows (headers only — bodies live in bodies.db). hydrateCgpBodiesFromCache then round-tripped ~6000 bodies back from disk, confirmed in log as [cgp-hydrate] INBOX merged 5964 / 5968 bodies from bodies.db → cgpEmails. Fix: tag cgpEmails with the folder it belongs to on every setter write; on same-folder re-entry, merge htmlBody/textBody/attachments/syncRequest/iCalendarRequest/smime from the existing in-memory rows into the fresh IDB rows before the setter runs. Hydrate’s needsHydration.length === 0 early-return now fires — ~3 s → ~100 ms. Folder-safe: a true folder switch (INBOX → Sent → IMAP → back) can’t cross-contaminate bodies between folders that happen to share UID values.
• IMAP folder-tree sidebar click renders instantly from the disk snapshot. Log [BOOT-TIMING] getMailboxes network=2432ms items=41 → total=4488ms tree=17 — every sidebar click did await bridge.getMailboxes(accountId), a full IMAP LIST (2–4 s blocking, folder tree empty until it returned). The disk snapshot was already there (loadMailboxTreesFromDisk runs on init, logs [IMAP] restored mailbox trees for 1 account(s) from disk), but selectAccount ignored it in online mode. Fix: show cached mailboxes immediately, set loading=false, fire selectMailbox(inbox.path); run bridge.getMailboxes in the background and swap only when the path-set actually changed (sig(fresh) !== sig(cached)) — unchanged trees don’t fire reactive re-renders. Mirrors the CGP folder-tree snapshot pattern from 3.6.65. First-ever account select still blocks on fetch because there’s nothing to show.
• IMAP → CGP header no longer briefly shows the cryptic __imap__/<guid>/INBOX path before updating to “INBOX”. MainLayout.vue:621 renders the folder-name header as mail.currentMailbox?.name || mail.currentFolder. On IMAP→CGP, exitImapMode() flipped isImapMode=false and fired loadEmails('INBOX') without pre-assigning currentFolder (deliberately, to avoid the top-level short-circuit at mail.ts:1417). loadEmails ran synchronously up to await mailApi.closeFolder(targetFolder) at mail.ts:1458, which yielded back to the event loop. Vue flushed DOM at that point with isImapMode=false AND currentFolder still __imap__/<accountId>/INBOX — mail.currentMailbox?.name returned undefined because no CGP mailbox has that path, so the header rendered the raw IMAP path for 100–500 ms until closeFolder’s XIMSS round-trip resolved. Fix: moved currentFolder.value = targetFolder and markMailboxKnown(targetFolder) to BEFORE the await closeFolder. isFolderSwitch was captured earlier at mail.ts:1400 with the old value, so the switch-detection logic is unaffected.
• Shipped on Windows, macOS, and Linux — signed+notarized Mac dmg, deb/rpm/AppImage via WSL. First Mac build in this session since 4.0.72; previously-pending macOS builds for 4.0.39/4.0.44/4.0.47/4.0.50/4.0.51 are superseded by 4.0.90.

Signed-mail green frame now renders in preview, full-screen viewer, and the drift-bar webskin

• Samoware-style green frame around signed-mail bodies. Signed S/MIME messages now render inside the mail iframe with a 5px solid dark-green border (#070, dark-mode #0a0) hugging the content. Scrollbars live on <html> outside the frame — same layout the stock Samoware webmail uses (mail.samoware.css: .signed-part { border: 5px #070 solid }).
• Fourth-and-final iteration — the first three ate overlay shadows. 4.0.68 ring-2 ring-inset: iframe compositing paved over the inset shadow. 4.0.69 outer-wrapper bg-green-500 p-[3px]: wrapped the iframe and its scrollbars. 4.0.70 body { border } inside the srcdoc: never shipped because samoware-tauri/overlay-patch has a wholly separate SandboxedEmailContent implementation (uses doc.open()/write() + allow-scripts + a WebView2 remote-image proxy) that build step 3 copies on top of master. The 4.0.72 fix lands the signed-part prop and CSS in both master and the overlay-patch copy, plus wires :signed="email.smime?.signed" through drift-all overlay EmailViewer so webskin picks it up.
• No new performance cost for normal mail. Signed mails stay on the slower existing path (XIMSS folderRead + x509 cert fetch — CGP verifies the signature server-side); normal mails continue the parallel-safe raw-MIME fast path. The signed-part wrapper is one extra div with CSS inside the sandboxed iframe — no runtime cost.
• Shipped on Windows, macOS, and Linux + the drift-bar webskin — signed Mac dmg, deb/rpm/AppImage, and the WASM-protected browser build all up to date.

Prefetch newest-first + tier-1 RAM hydration — freshest INBOX mails ready to open first

• Prefetch fills the newest mails first. After the 4.0.46 per-user cache split, every drift install re-downloads bodies into the fresh user-scoped bodies.db on first launch. The old priority formula enqueued folder-by-folder in insertion order — the laptop log showed 50+ consecutive Gesendete Elemente (Sent) fetches before the INBOX got any attention. New formula: 100 (base) + max(0, 500 − daysOld) + (pinned ? 100 : 0) + (INBOX ? 300 : 0) so an INBOX mail from today ranks 900, a Sent mail from today ranks 600, and a 2-year-old Trash mail ranks 100. The scheduler’s existing priority-insert queue drains them in that order.
• Tier-1 (RAM) hydration from prefetch. The body-runner now dispatches a drift:body-cached CustomEvent right after each successful bodyPut, carrying {folder, uid, html, text, attachments, headers}. The mail store listens, filters on currentFolder.value, and runs updateEmailInStore so the freshly-cached body lands in cgpEmails/searchResultContent without waiting for hydrateCgpBodiesFromCache on next folder-open. Pairs with the newest-first priority: by the time the user clicks their newest INBOX mail, both the bodies.db row AND the RAM entry are populated — no round-trip. Scope-limited to the current folder so this doesn’t pin thousands of out-of-folder mails into RAM.
• Shipped on Windows + Linux + the drift-bar webskin. Mac deferred again — driftmac SSH is flaky this week.

Mail now arrives automatically after sleep-wake / long disconnect (no re-enter needed)

• Fix: mail delivered automatically after sleep-wake. When the laptop was asleep for hours, drift came back up but new mail that arrived at CGP during sleep didn’t appear in the INBOX until the user manually re-entered the folder. (Short wifi-off/on cycles already worked fine — CGP keeps the push subscription alive across brief disconnects.) Root cause: CGP reaps per-folder push subscriptions after long idle while the XIMSS urlID itself stays alive. The existing doRecover chain already does the right dance (clearFolderCache + folderOpen + mailboxSync) but is gated behind terminal signals (<bye/> / 404 / 550 / errorText). Between 2026-09-23 (circuit breaker) and 2026-09-28 (single-poll-owner generation guard) that terminal path got hardened enough that sleep-wake now routes through the non-terminal watchdog-kick path — which fires drift-ximss-network-recovered but never reached the folder-reopen logic.
• The fix. stores/mail.ts now listens for drift-ximss-network-recovered and runs syncSingleFolder() on each folder in cgpAlwaysSync (= INBOX today) plus the currently-focused CGP folder. syncSingleFolder under the hood calls openFolderWithMeta (= folderOpen, which re-arms the push subscription if CGP reaped it; no-op otherwise) followed by mailboxSync against the stored syncID (= catch-up delta of accumulated UIDs). Idempotent + debounced via the existing RECENT_SYNC_MS guard inside syncSingleFolder, so a 24-error wifi-off/on burst collapses to one re-arm per folder rather than a thundering herd.
• Scope limited to always-sync + current folder, not every cached folder. Thunder-herd protection: the watchdog can fire every 10 min for a perfectly idle session with no new mail; iterating all 50 cached folders each time would spam CGP and could trip the 5-protocol-errors-in-2-min auto-ban limit. IMAP folders (__imap__/{accountId}/…) are skipped — the Rust-side IMAP IDLE loop recovers independently.
• Shipped on Windows, Linux and Mac (signed+notarized+stapled DMG) plus the drift-bar webskin. No gateway helper change this round.

Collapsible per-slot poll results page + Copy button in the Feedback dashboard

• Collapsible per-slot layout for the results page (gateway 0.6.14). Replaced the earlier two-panel “aggregate cards + separate grid” with a single list of <details> slot rows. Each slot shows the ★/✓/✗ tally in its summary line; click to expand into three columns — Preferred, Available, Unavailable — each listing voter names with their email on a second line. Winner slots and the picked slot auto-expand on first load so the important ones are visible by default.
• Master “Show email addresses” toggle (gateway 0.6.14). One checkbox in the top toolbar flips email visibility across every expanded slot. State persists per-device via localStorage so the organiser doesn’t re-toggle on every page load.
• Cloudflare email-protection bypass (gateway 0.6.15). mail2.cgatepro.net sits behind Cloudflare, whose edge “email obfuscation” was rewriting every bare email into [email protected] anchors — defeating the Show-emails toggle entirely. Wrapped each rendered email in the documented <!--email_off--> opt-out marker so emails pass through verbatim. Internal/local addresses (e.g. postmaster@laptop-…) that didn’t match Cloudflare’s rewrite heuristic came through clean the whole time — which is how we spotted it.
• “Copy results link” button in the Feedback dashboard (drift 4.0.49). Each poll row in Lists → Feedback now shows the same shareable results URL as the Calendar poll modal, with a green Copy button and an “Open” link that opens the view-only page in a new tab. Three paths to the same URL now: Calendar sidebar → poll row → modal → Copy, Feedback panel → poll row → Copy, Feedback panel → poll row → Open.
• Shipped on Windows, Linux and Mac (signed+notarized+stapled DMG) plus the drift-bar webskin. Gateway helper hot-swapped in place; CGP skin cache cleared.

Shareable view-only poll results URL — aggregate tally + per-participant grid

• New shareable "results" URL for every poll. Organizer copies one link, pastes it to anyone — invitees, team, PM — they see where the poll stands. No vote form, no email field, no way to join. Gated by the poll's accessPwd like the per-voter links, but doesn't require allowSelfInvite since nothing can be written through the endpoint. URL shape: /sys/driftgw.wcgp/poll-results/~{organizer}/{pollId}/pwd/{pwd}/.
• Two sections rendered. Top: aggregate cards per slot, with ★/✓/✗ bars and automatic best-slot highlighting (slots where no one is unavailable, ranked by preferred-count then available-count). Already-resolved polls get a PICKED badge on the chosen slot. Bottom (0.6.13 follow-up): a dense per-participant grid — slots down, voters across, each cell showing the actual ★/✓/✗/· icon with a hover-title. Gateway-synthetic emails (emailSynthetic: true guests who joined without a real address) are hidden from the grid since they aren't meaningful contact info.
• Drift UI exposes the link via a new "Share results (view-only)" card in PollResponseView for the organizer, with a one-click Copy button. Always visible — no toggle, since it's safe to share by construction.
• Mac deferred: driftmac SSH timed out mid-session, so 4.0.48 ships on Windows, Linux and the webskin for now. The Mac download link above still points at 4.0.47; the actual results URL works for Mac users too, since the rendering is server-side.
• Hot-swap note: gateway bumped 0.6.11 → 0.6.12 → 0.6.13 in one session (initial endpoint, then per-voter grid). The URL is unchanged across both bumps — same link, richer rendering, no client update required.

Poll votes no longer silently dropped — two stacked bugs fixed in drift + gateway

• Diagnosed via a lost real-world vote. Three vote-notification emails arrived for an open poll but the poll's participants[] on disk showed only the organizer. Two bugs stacked: drift's savePoll overwrote gateway writes, and the gateway's submit_vote silently discarded votes for emails not already in the array (while still sending the organizer "voted on" email, which is how the organizer thought the vote landed).
• drift savePoll is now read-merge-write (samoware-vue/src/lib/ximss/polls.ts). Before: the local poll object got written as-is — any gateway writes between our last loadPoll and this save (self-invited joins, recorded votes) were overwritten by our stale snapshot. Any save path that fired between join-time and vote-time clobbered the gateway writes — including PollResponseView:72, which auto-saves on mount when the organizer opens the poll and the UI fills their own default votes. After: loadPoll runs first, non-organizer participants' votes + responded come from the fresh on-disk copy (gateway-authoritative), metadata and the organizer's own participant row come from local, fresh participants we haven't seen are appended. Falls through to a plain write if the fresh read fails (new poll, transient XIMSS error) rather than drop the save.
• Gateway submit_vote recover-inserts missing participants (drift-gateway-helper 0.6.11). The vote URL already proves email ownership via the accessPwd gate, so when no participants[] row matches req.email, we insert a new one with the submitted votes rather than let them vanish. The inserted row carries recoverInserted: true so the drift UI can show "recovered — organizer should check name/type". No spoofing surface: everything above the array scan still requires the per-poll password.
• Rescue: the one real-world poll where this happened ("Russmedia", three missing voters) was manually patched to restore the three participants with their vote data parsed from the organizer-notification emails. Future joins/votes land correctly on their own via the two code fixes above.
• Shipped as drift-offline 4.0.47 (desktop) + drift-gateway-helper 0.6.11 (CGP helper). Local gateway helper hot-swapped in place — CGP's EXTAPPHELPER wrapper respawned it against the new binary. Webskin rebuilt and CGP skin cache cleared.

Per-user native cache — fixes cross-account body/attachment poisoning

• Cross-account cache contamination is fixed. Before this build, the native cache (bodies.db + outbox.db) lived at one shared offline/ root and was keyed by a hard-coded __cgp__ synthetic account id. Switch CGP logins (A → B) and B's EmailViewer would hit A's cached body + attachment metadata at any colliding UID — handing A's filename + partId list to the Collabora opener, which then 404'd against B's live XIMSS session (Failed to fetch attachment: HTTP 404 on the Session/MIME URL in the console).
• Native cache is now per user. bodies.db and outbox.db live under offline/users/<username>/. The Rust side holds a current-user slot (Mutex<Option<(username, Arc<Mutex<Connection>>)>>), new tauri commands offline_set_current_user / offline_clear_current_user wire the JS login/logout path to the slot. bodies_conn() transparently reopens against the new user's DB on first call after a switch; in-flight queries on the old Arc complete safely because the handle lives until last-ref-drop.
• Blobs stay shared. offline/blobs/aa/bb/<sha256> is content-addressed by SHA-256, so dedup across users still saves disk; no leak, because the row that points at the blob (filename, partId, which user owns it) is in the per-user bodies.db.
• JS login/logout wiring: samoware-vue/src/lib/ximss/client.ts invokes offline_set_current_user({ username }) right after session.userName lands (both fresh-login and resume paths); logout() invokes offline_clear_current_user. Both guarded by isTauriRuntime() so the webskin build no-ops cleanly.
• Compatibility note: old offline/bodies.db + offline/outbox.db at the shared root are orphaned on upgrade (not read, not written). They age out via retention cleanup or can be deleted manually from the drift-offline app-data directory. Cache repopulates on first use under the new per-user path — expected after a fresh login.
• Shipped as drift-offline 4.0.46 only — the webskin doesn't use the native cache (its mail-body storage is IndexedDB, already keyed by username), so no CGP skin redeploy is needed for the fix.

Bulk "Move to…" / "Copy to…" dialog + multi-item drag-drop in Files

• "Move to…" and "Copy to…" dialog with a folder picker. New Vue dialog mounted twice in FilesView.vue — once per operation. The picker reuses the existing recursive FileTree (same tree the sidebar uses), ESC cancels, Enter confirms. Confirm button stays disabled until a valid target is picked: refuses the source's own parent (no-op), refuses the source itself, refuses any descendant of a source (into-itself cycle). The picked path is shown as /foo/bar in a code chip above the buttons.
• Multi-item drag-and-drop in Files. handleDragStart now carries the whole selection when the dragged item is part of a selection > 1 (Finder / Explorer convention). Shift+click / Ctrl+click to build the selection, grab any of them, drop on a folder — all N items move at once. Previously a drag only ever carried the single item under the cursor and the other N-1 selected items stayed put.
• Pure XIMSS loop, no server-side helper. _moveBatch / _copyBatch iterate the batch and call fileRename / fileCopy once per item. Errors are collected and shown as a single bulk-count alert (failedMoveBulk / failedCopyBulk) rather than aborting at the first failure. Same architecture as the 4.0.43 realignment: file operations are standard CGP XIMSS and must work against a naked CGP without any skin-specific .wcgp dispatcher.
• Ribbon buttons — Tauri (drift-all overlay) grows mv (FolderInput icon) and cp (Copy icon) between Rename and Delete, with bulk-count titles. The webskin master ribbon is a stub (no onClick handlers), so master gets only the drag-drop + dialog machinery, not the ribbon buttons.
• i18n keys added: moveTo, copyTo, moveToN, copyToN, moveToTitle, copyToTitle, moveHere, copyHere, target, pickFolderHint, failedMoveBulk, failedCopyBulk — both en.ts and de.ts.
• Shipped as both drift-offline 4.0.45 and the drift-bar webskin.

Nice Vue dialog for Files delete — no more native WebView prompt

• Files delete confirms now use the in-app Vue dialog. drift's shared AppConfirmDialog (already used by mail + settings) with the variant: 'danger' style — red trash icon, "Permanent delete" heading, red "Delete" primary button. Replaces window.confirm() which rendered as the ugly native WebView2 window prompt on Tauri Windows and silently fails entirely on Tauri macOS WKWebView.
• Four sites switched: single-file delete (ribbon + context menu), bulk delete via context menu, bulk delete via the ribbon's "Delete (N)", and the shared-folder unsubscribe confirm. Both the webskin's master FilesView.vue and the drift-all overlay copy.
• No new infrastructure — AppConfirmDialog is already mounted globally in App.vue; just imported appConfirm() from composables/useAppConfirm in both FilesView.vue files.
• Shipped as both drift-offline 4.0.44 and the drift-bar webskin.

Bulk file ops realigned to Samoware's native XIMSS pattern — works against a naked CGP

• Removed: the driftbatchfiles.wcgp server-side batch handler introduced in 4.0.39, along with its batchFileOps.ts client wrapper and the file deployed to WebSkins/drift-bar/. CGP skin cache cleared.
• Why: Samoware (CGP's modern JS webapp) doesn't use any .wcgp dispatcher for file operations — main.production.js calls pure XIMSS commands (request("fileRemove", {fileName: s}, …)) in a loop. The copymove.wcgp + HTML-form POST pattern belongs to Crystalq, a different (pre-JS, server-rendered) CGP skin that happens to live in the same WebSkins/ folder. drift's 4.0.39 implementation was a Crystalq-pattern mimic mis-labelled as "Samoware's pattern". It worked in webskin by accident (session skin-binding lined up with the deployment location) and failed in Tauri because the session there binds to the server default skin.
• Bulk delete now: fileRemove / fileDirRemove XIMSS commands in a loop, exactly like Samoware. Works against any CGP install, no skin deployment, no CORS gymnastics, no HTTP-session SID juggling. Multi-select UI (Ctrl/Cmd+click, Shift+click range, "Delete (N)" ribbon) is unchanged — those are purely client-side.
• Memory updated (wcgp-wssp-use-http-sid-not-xmss.md) with the full rule set: file ops → XIMSS; .wssp → HTTP SID + Basic skin + proxy_fetch; /sys/driftgw.wcgp/* → gateway helper; never ship a custom .wcgp into a skin folder.
• Shipped as both drift-offline 4.0.43 and the drift-bar webskin.

Bulk delete actually deletes now — wrong CGP session type

• Root cause: .wcgp URLs need the WebUser HTTP session SID, not the XIMSS urlID. CGP's two session types are hard-disjoint by design: XIMSS sessions (/ximsslogin/) serve XIMSS XML at /Session/<sid>/sync; WebUser HTTP sessions (POST /) serve .wcgp / .wssp handlers at /Session/<sid>/*.wcgp. .wcgp URLs hit with an XIMSS SID return an empty <XIMSS/> envelope. 4.0.39–4.0.41's batchFileOps.ts wired the XIMSS urlID into the URL, so the handler never ran: the parse of <XIMSS/> as JSON failed, the error was swallowed, and the code reported "0 errors" without deleting anything. Webskin worked by accident — same-origin cookie authenticated independently.
• Fix: route through client.getHttpSessionId(). drift already bootstraps the parallel WebUser HTTP session at login via client.ts::bootstrapHttpSession (originally added for Mailing Lists admin, which has the same .wssp session constraint). batchFileOps.ts now uses that SID, matching the exact pattern in mailingLists/client.ts::sessionURL().
• Three stale-session guards: empty body → fallback to XIMSS loop; HTML body (handler missing on active skin) → fallback; CGP's drift login-redirect stub (location.replace('/sys/entry.wcgp')) → fallback with warning. All three decisions logged.
• Diagnostic logging added across the whole flow ([batch] POST …, [batch] proxy_fetch returned N bytes, [Files] bulk-delete start/done/errors) so any future regression is traceable without guesswork.
• Memory saved as wcgp-wssp-use-http-sid-not-xmss.md — any future .wcgp/.wssp feature will see this rule.
• Shipped as both drift-offline 4.0.42 and the drift-bar webskin.

Bulk delete now works on Tauri (routes through proxy_fetch)

• Bulk delete on the Tauri desktop build now actually deletes. 4.0.39's new driftbatchfiles.wcgp POST used a direct browser fetch(..., { credentials: 'include' }) which worked in the webskin (same origin as CGP) but silently failed in Tauri: the XIMSS session cookie is scoped to the CGP origin not tauri.localhost, and CGP doesn't send Access-Control-Allow-Origin: tauri.localhost, so the response was CORS-blocked. 4.0.41 routes the POST through the Rust-side proxy_fetch invoke — same pattern used by notifyHttp, login and the async long-poll — which carries the session cookie in its own jar and bypasses the cross-origin block.
• Known cosmetic gap: the confirm dialog on Tauri still comes up as the OS-native WebView2 window prompt rather than a Vue-rendered modal. Deferred to a UX polish pass since replacing confirm() globally touches every module. Deletion itself works correctly.
• Shipped as both drift-offline 4.0.41 and the drift-bar webskin (webskin re-shipped for parity).

Regression fix: Files module no longer blanks on 4.0.39 Tauri build

• Files module renders again on the Tauri desktop build. The 4.0.39 bulk-select landing introduced a temporal-dead-zone bug in the drift-all overlay FilesView.vue: the new selectedPaths ref was declared below the ribbon's computed, and useRouteRibbon's watch({ immediate: true }) triggered the computed body synchronously during setup — before selectedPaths was initialised — raising a ReferenceError that aborted the whole mount. The view came up blank. 4.0.40 hoists the state refs above the ribbon declaration. Webskin wasn't affected (master ribbon doesn't reference the new refs).
• No functional change beyond the fix. All 4.0.39 bulk-ops behaviour — Ctrl/Cmd + click toggle, Shift + click range, "Delete (N)" ribbon button, driftbatchfiles.wcgp server-batch endpoint with XIMSS fallback — is unchanged.
• Shipped as both drift-offline 4.0.40 and the drift-bar webskin (webskin re-shipped for parity even though it didn't carry the regression).

Bulk file ops — one HTTP round-trip for N items, Samoware-style

• Multi-select in the Files module. Ctrl / Cmd + click toggles items in and out of the selection; Shift + click selects a contiguous range from the last anchor to the clicked item (in current list or search-result order). Plain click still single-selects as before.
• Bulk delete routes through a single server-side CGPL handler — driftbatchfiles.wcgp, ported from Samoware/Crystalq's copymove.wcgp and extended with context=remove. One POST per batch (application/x-www-form-urlencoded with repeating file= / folder= pairs), server loops RemoveStorageFile / RemoveStorageDirectory, returns a JSON errors array. Replaces N × XIMSS round-trips with 1 HTTP round-trip for any N.
• Automatic fallback for CGP servers without the handler. On first 404 the client latches _handlerAvailable=false for the session and silently falls back to the per-item XIMSS loop. Users on CGP installs that haven't deployed the drift-bar skin still get bulk delete; drift-bar / drift-offline servers get the fast path.
• Ribbon Delete button shows the count when bulk — "Delete (N)" when more than one item is selected. Right-click Delete on any selected item deletes the whole selection.
• Shipped as both drift-offline 4.0.39 and the drift-bar webskin. Handler auto-deployed to WebSkins/drift-bar/ via build-webskin.sh's existing webskin-src loop; CGP skin cache cleared on deploy. Bulk move + bulk copy use the same handler and ship in a follow-up with their path-picker UI.

Zero-lag open for every brand-new push arrival

• Every brand-new mail opens instantly on first click. Before: a mail that arrived via CGP's folderReport push had only its header in cgpEmails (tier-1); its body wasn't in bodies.db (tier-2) either, so the first click paid the full ~250 ms raw-MIME fetch + render round-trip — the one lingering open-lag after 4.0.34 landed body hydration from tier-2.
• Fix: hydrate both tiers immediately on push arrival. In stores/mail.ts at both folderReport mode='added' branches (direct-add + added-via-updated), fire loadEmailContent(folder, uid) as fire-and-forget right after cgpEmails.unshift. loadEmailContent already does the dual write-through — updateEmailInStore populates cgpEmails.htmlBody/textBody (tier-1), and bodies.bodyPut inside mailApi.getEmail persists to bodies.db (tier-2) — so one call hydrates both.
• Net result: arrival → ~250 ms background hydration → user clicks → EmailViewer watch: content already loaded — no fetch, no lag. Completes the body-hydration architecture started in 4.0.34.
• Shipped as both drift-offline 4.0.38 and the drift-bar webskin.

Ban-fix round 2: cache every XIMSS discovery call, no retry except on network errors

• Full XIMSS surface audit against the "cache + sequence, no retry except on network" principle. 4.0.36 removed 27 protocol errors per reconnect; this round removes a further ~14–30, bringing the per-reconnect error count effectively to zero. Five independent fixes landed across master + drift-all overlay + WASM webskin overlay.
• Fix #1 — inline setSessionOption deleted from client.ts. 4.0.36 Fix A neutered the external setSkinFromPrefs() wrapper but missed two inline setSessionOption calls inside postLoginInit() (reportMailboxChanges=yes is CGP's default; skin=<x> is redundant to URL routing). Removes 2 errors per login.
• Fix #2 — mailboxList + mailboxSubList session memoise with layout-change invalidation. New cached wrappers in mailboxes.ts; calendar.ts, sharing.ts, mail.ts, notes.ts, tasks.ts, stores/contacts/folders.ts, sqliteContactsIndex.ts all routed through them. 17 raw call sites eliminated. Cache invalidates on mailboxCreate/Remove/Rename/SubUpdate + on drift-ximss-session-unrecoverable event. Removes 8–15 errors per reconnect.
• Fix #3 — fileDirCreate() per-user cache (same pattern as 4.0.36 Fix B). Wrapper now remembers a successful create per-user in localStorage; ContactHubPanel.vue + TasksView.vue migrated from raw client.request to the wrapper. fileDirRemove invalidates. Removes 2–2N errors per reconnect.
• Fix #4 — favorites prefsRead session cache. loadFavorites() now caches the first response for the session; saveFavorites() invalidates. Removes 1–3 errors per reconnect.
• Fix #5 — signalBind unbind-first guard in stores/im.ts. Module-level _everBound flag survives reset(); on a subsequent initialize() we issue signalUnbind before signalBind to avoid CGP's "already bound" errorText. Removes 1–2 errors per reconnect.
• Retry policy audit result: client.ts was already clean — no silent retry on 550/404/XIMSS errorText anywhere; circuit-breaker (3 strikes) working as designed. The ban was purely a caching gap, not a retry gap.
• Shipped as both drift-offline 4.0.37 and the drift-bar webskin.

Reconnect no longer trips CGP's IP auto-blocker

• Reconnects no longer get the client's IP temporarily banned by CGP. On every fresh login, drift was firing ~27 benign-but-counted protocol errors in under 5 seconds: 2 × setSessionOption for a skin that's already resolved by URL routing, 20 × fileDirCreate for drift's own working directories which already exist (polls, feedback, planevents, photos, drafts), and 5 × fileAttrRead on virtual paths that have no attributes. CGP's ProtocolErrorsLimit=5 / Period=2m counter does not care that the errors are harmless — it adds the client's peer IP to a 15-minute temp-block. This hit IPv6 loopback ([::1]) and real LAN clients alike on every reconnect-storm.
• Fix A — setSkinFromPrefs is now a no-op. The active skin is already picked by the SkinFiles/<account>/<skin>/ URL path CGP routes against. Trying to set it again via setSessionOption only ever produced "unknown option" errors on strict builds. Removes 2 errors per reconnect.
• Fix B — ensureDir remembers it already created the directory. Both feedback.ts and polls.ts now cache their fileDirCreate result per-user in localStorage plus a module-level Set. Removes 20 errors per reconnect; fresh installs still pay a one-time 5 errors on first login.
• Fix C — fetchItemAttributes skips virtual paths after one error. files.ts now holds a session-scoped attrErroredPaths set — a path that returned 500 on fileAttrRead once is treated as attribute-less for the rest of the session instead of being re-asked on every refresh. Removes 5 errors per reconnect.
• Shipped as both drift-offline 4.0.36 and the drift-bar webskin. Server-side skin cache cleared on deploy. CGP's GETTEMPBLACKLISTEDIPS stays empty across reconnect cycles.

Instant-open everywhere: in-memory body hydration + mark-read/mark-unread stability pass

• Every mail opens instantly from the second visit onward. On every folder visit, drift-offline now pre-pumps every cached mail body from the on-disk bodies.db store into the in-memory view store, newest-first. First-click opens of previously-cached mails are now tier-1 fast (~0 ms) instead of paying the ~30–100 ms SQLite + decompress + IPC round-trip. Up to ~1–3 s of background work per folder switch, non-blocking.
• Cache now covers every mail in every folder. The background prefetch planner used to skip folders where the WASM header cache happened to have any UIDs, which meant new mail that hadn't been browsed yet never got its body enqueued for prefetch. The planner now does a direct lightweight mailboxSync against CGP for every mail folder on every re-plan tick, so bodies.db catches up to the live inbox within minutes of launch.
• Mark-as-unread stays unread. Six interrelated bugs in the mark-read / mark-unread flow fixed over 4.0.29–4.0.35: ribbon-bulk mark-unread of 5 mails no longer re-marks any of them read on first click; the viewer-pane Mark unread button no longer races a stale 1 s auto-mark-read timer; the ribbon "Unread here" tile and the ribbon-toolbar bulk mark-unread share one canonical cancel point; first click back onto a just-unread mail now honours the real 1 s auto-mark delay instead of firing immediately.
• Auto-mark-read actually waits 1 s on cached mails. A stale default (MarkAsReadTimeout: '0') caused auto-mark-read to fire with zero delay for every click. This was invisible before body hydration made clicks instant — load time masked it — and became glaring once first-click opens landed in zero RAM time. The default is now empty (no CGP opinion), so the viewer falls through to drift's own 1 s delay. Users who deliberately configured MarkAsReadTimeout keep their value.
• Six rollback-labeled previous builds preserved in drift-offline-<ver>-prev.exe covering 4.0.29 through 4.0.34, if the new build misbehaves. One-command restore from the previous.

Composer blocks • Feedback dashboard • Live feedback push

• Composer blocks: Poll, RSVP, Rate, Approve, File share, Photo album, Callout / Quote / Code. Drag any of these into a reply or compose — the recipient fills them in and the organiser's live calendar / Feedback dashboard updates with no refresh. The album block includes a folder-browser dialog over the user's CGP file storage.
• Feedback dashboard at the top level of the navigation. Per-module sections (Polls, RSVPs, Ratings, Approvals, Photo albums) each sorted newest-first; per-contact workspace drill-in with per-contact chat, notes and file-send history.
• Live feedback push from the notification helper. When a recipient votes / RSVPs / rates / approves, the organiser's dashboard and the calendar poll overview both update in real time — no reload. Requires drift-gateway-helper ≥ 0.6.10.
• IMAP batch delete / move speed-ups. Bulk delete / move / mark-read / mark-unread operations now go through a single IMAP connection with uid_mv where the server supports it, instead of one connection per message. Previously, deleting 500 mails took > 90 s; it now completes in < 5 s.
• Settings: hide the ribbon. New Settings toggle collapses the entire ribbon including the gear icon, for users who prefer a stripped-down view. The toggle itself is reachable from the Settings page's always-visible Save header.

Rolling cleanup series

• Mailing-list helper + Rule Execute [RCPT] wiring. Per-recipient list unsubscribe footers injected on delivery via a CGP Rule action; the helper writes one .sub file per subscriber and the gateway CLI removes on unsubscribe click.
• CGP→IMAP move fix. Attachment-URL path discovery (-MM-1 segment + -P.txt suffix) was dropped, breaking cross-account move. Both are now applied via cgpRaw.ts.
• Attachment content search. Full-text extraction over PDF, DOCX, XLSX, PPTX, ODF, EPUB, RTF, HTML and plain text, indexed into bodies.db's FTS5 table so search returns matches on body + attachment contents.
• Label picker alignment. Active-state in the label picker now mirrors the ribbon labels menu — same highlighted-chip behaviour across both.
• Sticky search button in SearchPanel — the primary action row sits above the folder picker and stays visible while the folder list scrolls (originally 4.0.1).

Pre-rendered app shell, instant module switching, live counters, mmindex-helper Linux port

• Instant module switching. All eight modules (Mail, Calendar, Files, Contacts, Chat, Notes, Tasks, Settings, Mailing Lists) are pre-rendered on login and just toggled on view — no remount, no store re-hydration. Session setup, IDLE bootstrap and cache preload now run exactly once per app lifetime.
• Ribbon stays coherent with the visible module. New route-guarded ribbon composable so the toolbar always reflects the module you're looking at, even under the always-mounted view world; Files ribbon spans full width regardless of Mail's splitter positions.
• Live counters everywhere. Trash and source folder counters update immediately on delete; ribbon actions work on a single-selected row; mark-unread stays unread; auto-mark-read no longer fires for push mail arriving while you're on another module.
• Sync guards. loadEmails, syncSingleFolder, exitImapMode and syncFolder each short-circuit on redundant calls — module bounces stop firing XIMSS round-trips.
• Reconnect indicator clears on recovery. XIMSS session recovery now dispatches an event; the status chip clears the orange dot as soon as the session is back.
• mmindex-helper Linux port. Working Linux ELF built from the WSL CGP toolchain: binary, bundled SQLite, run.sh, annotated config template, install runbook. Verified end-to-end under CGP 6.5.4 — clean INTF handshake, no retCode=13.

Session-recovery hardening, attachment content search, offline-first folder tree, faster contact management

• Session-recovery circuit-breaker. After three consecutive failed reconnects the client stops POSTing to the dead session and shows a clean "You have been signed out" prompt with a Sign in button — instead of the previous behaviour that could keep hammering the server until Cloudflare's brute-force auto-ban tripped. Wrong-credential replies also short-circuit immediately.
• Attachment content search. Full-text index for PDF, DOCX, XLSX, PPTX, ODF, EPUB, RTF, HTML and plain-text attachments — the Search panel now finds words inside files, not just in filenames. Extractors run in a background worker so indexing never blocks the UI.
• Folder tree hydrates from cache on cold-start. Sidebar appears in <100 ms on any launch after the first. The authoritative mailboxList still runs in the background and swaps in when it arrives.
• 10× faster recent-address delete. Selective delete of dozens of addresses now runs 10-way parallel; a bulk "clear all recents" wipe path is exposed too.
• Recent-address deletes actually stick. Fixed a long-standing bug where deleted recents came back on next login — the client now calls the correct datasetDelete against the CGP dataset instead of an ignored messageRemove.
• Per-recipient mailing-list unsubscribe. Every outbound list message now carries a signed unsubscribe URL; one click unsubscribes exactly the recipient without touching anyone else. Auto-injected footer, HMAC-signed, allowlisted per domain.
• Composer editor upgrades. Indent works with pt/px/cm/em/decimal values; FontSize extension is wired; a Word-HTML normalizer strips Office cruft on paste; blockquote break-out for inline reply comments; TipTap target=_blank stripped so recipient mailto: links stop opening blank tabs.
• Locales. Full-app translations added for Spanish, French, Italian, Thai, Sinhala and Arabic (with RTL layout).
• Import / Export & cleanup. New CleanupPeriod control, one-shot Import / Export for offline caches, and per-folder sync traffic-light in the offline settings pane.

Ribbon toolbar with fully customizable buttons and hide-able inline toolbars

• New ribbon toolbar across every module. Mail, Calendar, Files, Notes and Tasks now share a Microsoft-Office-style ribbon at the top of the window. Groups line up over the panel they act on — Ordner (folder) sits above the mailbox tree, Nachricht (message) sits above the reading pane, and the columns follow the splitters as you drag them.
• Customize which ribbon buttons appear. Click the gear on the ribbon to open the layout chooser and hide any button you don't use. Preferences travel with your account (stored via CGP prefsStore) so the same layout follows you to every device you sign in from.
• Hide the inline toolbars below the ribbon. The chooser includes five toggles that remove redundant inline toolbars once the ribbon carries the same actions: the Ordner-panel header buttons (New Folder, Subscribe), the mail list's top / bulk / filter bars, and the reading-pane action bar.
• New "Mit Anhang" filter chip. A paperclip filter joined the existing Starred / Unread / Labels chips on both the ribbon and the folder-view panel — client-side filter so it works instantly regardless of provider.
• Compose "From" address now survives minimize/restore. In IMAP mode, the selected From account is persisted per composer and restored automatically when you re-open a minimized draft.
• IMAP folder shows its friendly name in the ribbon. External IMAP inboxes now display as "AccountName — INBOX" — the internal __imap__/{account-id}/… path no longer appears in the UI.
• Sort menu and label picker in the ribbon. The Sortieren button opens a dropdown to sort by Folder, From, Subject, Size or Date; the Nachricht group includes a label picker that assigns or removes any account label from the open message in one click.

Search fixes and cleaner viewer for mail with many recipients

• Attachment search respects folder selection. Picking one or more folders in the search panel previously had no effect on attachment mode — results always came from every folder. Now the folder chips are honored (same fix applies to text, labels, flags, and date searches routed through the cache).
• Search submit button always reachable. The search form now scrolls internally when it grows tall (attachment mode with many file-type chips, date range, and folder selector) — the "Search" button no longer falls off the bottom of the viewport.
• Sort search results by folder. When a search returns results from more than one folder, a new "Folder" sort chip appears in the list header — click it to group by mailbox (A→Z), with newest-first inside each folder.
• Long recipient lists no longer bloat the message header. Mail with many To / Cc / Bcc addresses auto-collapses to a compact "To: <first> +N" chip with a toggle to show or hide the full list. Expanded, the list is capped in height and scrolls, so the full-screen switch and other header controls stay visible.

Mailing list management for list owners — settings, digest & archive, subscribers

• New — Mailing Lists module. A dedicated sidebar icon appears when your account owns at least one mailing list. Manage every list you own without leaving drift.
• List Settings tab — edit description, subscription policy (who can join, default delivery mode, confirmation letters), posting policy (who can post, moderation-per-subscriber, allowed formats, size limits), bounce handling (cool-off periods, unsubscribe thresholds, fatal-bounce weight), feed format (subject prefix, reply routing, header & trailer text), and welcome / goodbye letters. Save applies immediately.
• Digest & Archive tab — toggle archiving, set size & message limits, control who can browse the archive, tune digest generation (period, size, message count, time-of-day) and digest formatting.
• Subscribers tab — filter by email, add one at a time with an optional welcome letter, run bulk actions on selected members (change delivery mode, set moderation counter, mark as bounce-failed, unsubscribe). Export the full subscriber list.
• The icon appears only when there are lists to manage — users without owned lists don't see it.
• Uses CGP's native web mechanism under the hood, so behavior matches the classic web UI exactly and no server-side install is needed.

Cleaning Jobs (auto-move rules for IMAP) • folder operations & nested mailbox tree • cross-account attachment copy & paste • IMAP reply-all & Cc fixes

• New — Cleaning Jobs (IMAP): define rules per external account — pick source folders, any combination of fields (Subject / From / To / Cc / Body / age / unread / has-attachment), keywords, and a target folder. Runs live on new mail and on demand for the last N days (preview before applying). Server-side mail rules aren't available on most IMAP hosts, so cleaning runs while drift-all is open. Settings → Cleaning Jobs.
• New — IMAP folder operations: create, rename, and delete IMAP folders directly from the mailbox tree (right-click for the menu, header + for a root folder). Recursive delete asks for confirmation and lists the affected subfolders; system folders (Inbox / Sent / Drafts / Trash / Junk / Archive) are protected.
• New — nested mailbox tree: subfolders display indented under their parent with a chevron to expand/collapse, matching how CGP mailboxes render. Selecting a deep folder auto-opens the path to it; siblings sort alphabetically.
• Fixed: German / Unicode IMAP folder names (Entwürfe, Gelöscht, …) now render correctly in the tree — previously some servers' raw wire form leaked through as Entw&APw-rfe.
• External account icon in the sidebar opens that account's mail with a single click (the previous expand panel with dead-end Calendar / Contacts buttons is gone — CalDAV / CardDAV from external accounts already shows up inside the global Calendar & Contacts views).
• Copying an attachment (or a whole email) now captures its contents at copy time, so it can be pasted into a message on any account — CGP or external IMAP — and sent correctly (previously it failed with "mailbox does not exist")
• Preview (eye) and right-click "copy again" work on pasted attachments; copied data is cached temporarily and cleared on quit
• Fixed: reply-all on an IMAP account no longer adds your own address to Cc, and no longer splits one recipient into two chips
• Fixed: Cc recipients now display for IMAP mail — including messages opened from search
• Fixed: malformed sender display names (e.g. an address used as the name) no longer render doubled as Name <addr> <addr>
• Search results show the real folder name (INBOX, Sent, …) instead of the internal path; full path on hover
• Message header reworked: date / size / folder sit in their own compact box so the address list flows full-width beside and below it

Bulk-delete safety • Trash detection • Multi-folder live sync • Settings prefs rebuilt • Vacation / forwarding rule fix

• Bulk delete (2 or more messages) now asks for confirmation before anything leaves the folder — no more accidental "Select All" wipeouts
• Deletes are sent to the server's Trash folder, not permanently expunged. The dialog names the destination ("They will be moved to Gelöscht")
• Per-account Trash auto-detection — uses the IMAP \Trash attribute, with multilingual fallbacks (Trash, Papierkorb, Gelöscht, Mülleimer, Deleted Items)
• If your account has no Trash folder, or you're already deleting from inside it, the dialog escalates to "Permanently delete — this cannot be undone"
• Live IDLE watcher now runs on every folder, not just INBOX — deletions made on your phone reach the desktop within seconds in any folder
• Folder names with German umlauts (Gelöscht, Mülleimer, Spamverdacht) display correctly in dialogs and the sidebar
• macOS: confirm dialogs now render reliably (replaces the native browser prompt that silently dropped on WKWebView)
• Fixed: Vacation auto-reply & mail forwarding actually take effect on save now — previously the Settings UI wrote the preference but never created the server-side rule, so toggling them did nothing
• Fixed: Sent folder no longer mis-labelled as "Outbox" (a stale name-override was triggered by the wrong folder type)
• Fixed: Clicking a time slot in week / day calendar view creates the event at that time, not the next free slot
• Settings → Mail rebuilt with working toggles: hide remote images (per-message override), auto-select first message, show folder counts, mark-as-read delay, custom reply header, notification scope (any folder vs INBOX only), default sort field & direction (applies across all folders)
• Settings → Calendar rebuilt: default view, week start, work hours & work days, time-slot granularity (5m / 10m / 15m / 30m / 1h), default reminders
• Settings → Tasks: show or hide completed tasks in the "All" filter
• External IMAP accounts in the sidebar now show a coloured initial badge instead of a generic globe icon — distinguishable at a glance when you have multiple accounts, even with the sidebar collapsed
• Settings changes apply immediately in the running session (no logout / re-login round-trip needed)
• Cleanup: removed ~30 dead preference toggles whose values nothing actually read; renamed legacy Tims* preferences to Drift* with automatic migration of existing data

Calendar invite attachments • Maximizable event details • Files folder fixes

• Calendar invites: attach files from your computer or your online storage
• Event details: maximize button opens a centered popup view
• Event details: smaller, icon-only Accept / Tentative / Decline buttons
• Files: shared folders now display correctly; folder creation and right-click sharing restored

Search overhaul • Reliable delete in non-INBOX folders • Optimistic search-result delete

• Search now defaults to the active folder — no more accidental cross-folder result floods
• Search panel auto-collapses on Search so the result list takes the full pane
• Local-cache search now scopes to the selected folder (single-folder fast path + multi-folder client-side filter)
• Desktop external mailbox search reads the local SQLite cache for subject, from, to, cc, body, and all-fields — instant, partial-word, accent-insensitive
• Deleting or moving messages from search results updates the result list immediately
• Fix: delete in non-INBOX folders silently failed for some accounts — STORE / EXPUNGE response streams are now properly drained, and the local cache is updated synchronously after a successful expunge

Folder hierarchy • Contact sync • S/MIME end-to-end

• Notes & Tasks: nested subfolder tree with expand/collapse chevrons (collapsed by default)
• Notes & Tasks: "New Subfolder" in right-click context menu — creates child under selected folder
• Fix: deleting a folder after viewing it no longer fails with "mailbox is in use" — handle closed first
• Fix: opening a note inside a subfolder (FORMAT URL now correctly encodes handles with slashes)
• Live contact sync — newly added contacts are no longer falsely wiped on the next helper sync
• S/MIME: end-to-end certificate saving from signed emails (opt-in banner, correct folder handle)
• Fix: IMAP delete in slow folders no longer leaves ghost rows you can click into a "UID not found" error — rows are removed from the UI before EXPUNGE is awaited

Event Polls — Collaborative Scheduling

• Plan Event with Poll — create scheduling polls with multiple time slots
• Calendar overlay in slot picker — click free cells to add slots
• Mandatory/optional participants — internal + external voting
• Organizer can star preferred slots before sending; votes pre-filled on publish
• External voting page via gateway helper (branded, with live results)
• Vote locking after submit; organizer remains editable
• Best-slot auto-calculation — one-click resolve to real calendar event
• Cancel Poll with optional reason — notifies all participants
• Vote notification emails with readable dates (not slot IDs)
• Autocomplete & address book in event planner participant input
• Fix: missing calendar i18n translations showing raw placeholders
• Fix: WOPI credentials restored on session resume — Collabora works after refresh

File Sharing, Viewer & WASM Engine 0.9.2

• File sharing URLs fixed — correct private/public path format matching original Samoware
• Viewer landing page for shared files — open in Collabora, preview, or download
• Collabora external access — edit shared documents in browser with Save As (.docx / PDF)
• Server-side PDF conversion via Collabora convert-to API
• Gateway helper: /view, /edit, /convert endpoints for external file access
• Upload toggle for folders — external attendees can drop files via gateway helper
• Calendar event composer — attach upload link for external email clients
• WASM Engine 0.9.2 — URL generation (getPublicUrl, getViewerUrl, getUploadUrl) moved to WASM
• Fixed: accessPwd extraction, directory detection, ACL parsing, fileDirInfo fields in WASM
• Tauri desktop: CGP hostname fix (no more tauri.localhost in share URLs)
• macOS: native clipboard support via arboard, green checkmark copy feedback
• German & English localization for all new sharing features

Contacts & S/MIME hardening

• S/MIME Take-Certificate: atomic contact replace — no more duplicate contacts on save
• Preserves all existing vCard fields (phone, address, notes) when adding a certificate
• Cert dialog 3-tier lookup: SQLite index → contacts store → autocomplete — always finds existing contact
• Local contacts SQLite index primed on login; auto-builds client-side when mmindex-helper unavailable
• Real-time contact sync via folderReport + mailboxModified safety net
• S/MIME shield badge rendered from index — appears without clicking, survives folder reload
• Fix: contact display name no longer jumps when clicking a card
• “Rebuild contacts cache” button in Settings → Offline Cache
• Hardened build: console logging stripped, XIMSS command strings hex-escaped, sourcemaps disabled
• mmindex-helper 1.2.0 — contacts.db schema v2 (hasCertificate + certificate columns); Contacts folders exempt from ignoremailboxlist

• UI overhaul: icons-only toolbars, compact layout, consistent modules
• Contacts: S/MIME certificate indicator, batch selection (shift+click)
• Fix: S/MIME certificates no longer create duplicate contacts
• Full email address shown in viewer (anti-phishing)
• Fix: Email formatting preserved (line spacing, empty lines)
• Drag-and-drop restored for emails, contacts, files

• Cross-platform: Windows, Linux (.deb, .AppImage), macOS (.dmg)
• Batch IMAP operations: fast mass delete, move, mark read/unread
• Attach emails and files from any source to IMAP messages
• Attached .eml emails rendered inline with full content
• Encrypted mailbox creation (.embox) with S/MIME unlock
• Composer From address preserved across minimize/restore

• IMAP server-side search: text, flags (unread/flagged), date range
• Multi-folder search across all IMAP mailboxes
• Search field filtering: subject, from, to, body, all fields
• Search results panel with auto-collapse and email preview
• Fix: Folders shown as files in Files module
• Fix: Notes showing invalid dates in desktop app

• Multi-account IMAP/SMTP support — connect any IMAP server
• Rust Tauri desktop app — single 13 MB binary, no separate bridge process
• IMAP IDLE: real-time email notifications via persistent server connection
• Attachment viewing, downloading, forwarding (batch fetch)
• Drag-and-drop email move between IMAP folders
• Batch delete, flag toggle, mark read/unread for IMAP
• Per-account S/MIME signing settings
• From dropdown: compose from CGP or any external IMAP account
• Parallel CGP + IMAP: both accounts receive live updates independently

• Fix: Folders shown as files in Files module
• Fix: Labels and flags not persisting across folder navigation
• Fix: Notes showing invalid dates in desktop app

• macOS desktop app (.dmg) — native Apple Silicon support
• Linux: email link clicks open in system browser
• Fix: browser reload preserves all cached emails

• Email viewer: mark as unread, show source, redirect to
• S/MIME: send unsigned/unencrypted option when key is locked

• Graceful handling when access-rights-helper is not installed
• Settings shows notice when sharing features are unavailable

• Recurring calendar events: daily, weekly, monthly, yearly recurrence
• Edit/delete single instance or entire recurring series
• Birthday events: quick-create from recurrence dropdown or contacts
• Fix: desktop search index not working
• Fix: cache sync error on desktop app

• Composer: fix draft editing placing body in forwarded-message panel
• Composer: compact footer with inline option toggles (receipts, S/MIME, priority, signature)
• Composer: toggle formatting toolbar, line spacing control
• Composer: color-coded signature (green) and quoted message (blue) panels
• Composer: tight paragraph spacing matching email signature rendering
• Fix: S/MIME draft save error (no active private key)

• TOTP 2FA: setup with QR code, verify before activating, clear TOTP
• TOTP enforcement toggle: require TOTP at every login
• Recovery email: set fallback email for password recovery
• Forgot password: password recovery from login page
• Auto-login after account signup

• Fix: Files module not refreshing after create/upload/rename
• Fix: Non-ASCII filenames (umlauts) causing 404 in file viewer
• Fix: Right-click context menus no longer cut off at screen edges
• Fix: Session cleanup on re-login prevents stale domain routing
• Rebuilt CGP helpers with parameter parsing and UTF-7 decode fixes

• S/MIME: certificate view, import/delete, session unlock in Settings
• S/MIME: signed/encrypted badges and verification banner on received emails
• S/MIME: automatic certificate extraction from signed messages
• Settings: Services page now probes actual server helper availability

• Sidebar: "Create New" dropdown (Email, Document, Spreadsheet, Presentation, Zoom Call)
• Settings: protocol status display for Email Index, File Index, Sharing DB, Collabora, Zoom
• Collabora/Zoom options hidden when not configured on server

• Fix: file deletion now updates UI immediately

• Attachment search: combined filters (type + from + date + content)

Beta 1.14

• Print button: formatted email view in new window
• PDF export via Collabora server-side conversion

Beta 1.13

• Complete i18n: all remaining hardcoded strings now translate
• Composer titles, reply/forward buttons, address labels translated
• Attachment context menu, search panel, contacts/calendar translated

Beta 1.11

• Composer full-screen: merged header into To: row for more space
• Bold labels on From, To, Cc, Bcc, Subject fields
• Improved Subject field spacing

Beta 1.10

• Conversation view

Beta 1.09

• Fix: Sending emails with long lines failing (RFC 2822 line wrapping)
• Fix: Cache file BOM causing stale sync state
• Improved WASM cache error diagnostics

Beta 1.08

• Fix: Files module not showing newly created/uploaded files until manual refresh
• Fix: Files index sync not reaching server helper
• Fix: HTTP/HTTPS protocol switching loop in desktop mode
• Fix: Calendar/task/note publish failing in desktop engine

Beta 1.07

• Fix: Flag/label update notifications lost during folder sync and bulk operations

Beta 1.06

• Full internationalization (i18n) support with English and German
• Language auto-detection from browser / server prefs
• Language switcher in Settings

Beta 1.05

• Credential caching with auto-relogin on session expiry
• Password storage: session-only or persistent (DPAPI encrypted)
• Pre-fill server URL and username on login
• Auto HTTP/HTTPS mode switch based on stored server URL

Beta 1.04

• Fix: Drag-and-drop of addresses between To, Cc, Bcc fields
• Fix: Reply-All now includes original CC recipients
• Removed: Email drag-drop onto composer (caused conflicts)

Beta 1.03

• Fix: Reply-All address splitting for names with commas

Beta 1.02

• Fix: Attachment search showing wrong file types

Beta 1.01

• Initial beta release