fs-mail 2.3.0: validation, stress, and recovery report
===================================================

RESULT

The delivered source passed 622 tests, with 0 failures and 0 skipped tests.

    python3 -m unittest discover -s tests -q

Recorded runtime: 36.786 seconds on Linux with Python 3.12.14.
The installed executable contains the same 28 implementation modules, full
manual, IALA license, and provenance file, verified byte for byte.
All 70 Python files parse using Python 3.9 grammar.

All test accounts, credentials, mail, and server responses were synthetic.
Wire tests used temporary TLS servers bound only to 127.0.0.1. No external
mail account was contacted and no real email was sent.

NEW COVERAGE IN 2.3.0

The release adds 92 regression tests to the previous 530-test suite:

    CLI, help, and executable documentation       17
    Behavior configuration controls               15
    Split configuration and migration             18
    Download policy and deferred retries          16
    Verified archive fallback for replies         12
    Configurable views and synchronization        14

The tests exercise the actual parsers, renderer, filesystem publication,
SQLite state, reconciliation, and CLI. Scripted transports replace the
provider connection for the new synchronization tests.

1. Configuration and migration recovery

   Migration preserves an exact config.ini.pre-split backup and account
   identity. Fault injection covers interruptions after backup publication,
   after accounts.ini publication, and before committing the new behavior
   file. Retrying either completes the interrupted work or refuses unrelated
   files. It does not overwrite a collision or silently combine definitions.

   Other cases cover private files, concurrent source edits detected before
   replacement, named and legacy account identity, distinct account roots,
   relative credentials beside the accounts file, missing behavior config,
   unknown keys, invalid encodings, selected-account overrides, watch reloads,
   and redacted JSON inspection that does not run credential commands.

2. Bandwidth controls and restart behavior

   Tests verify folder filtering against remote mailbox names, including
   modified UTF-7 and reserved local directory names. Exclusions win; normal
   discovery still maps nonblocked folders before message processing.

   The same raw-message byte budget is used across folders and failed body
   attempts. Tests reopen SQLite to verify that deferred messages remain
   pending after scan cursors advance. Oversized messages do not prevent
   smaller messages from fitting within the remaining budget. Zero preserves
   unlimited behavior. The transport's temporary literal bound is restored.

   Changing filters preserves existing readable mail, raw originals, and
   attachments. A previously interrupted adoption may finish through read-only
   metadata access outside the current download scope; new BODY requests stay
   within the selected scope. No remote mutations occur in receive-only tests.

3. Configurable views and flag state

   Default rendering remains byte-compatible with the previous renderer.
   Selected headers retain To, Subject, Local-ID, and Account-ID. An interrupted
   publication keeps the layout saved for that message even when the user
   changes configuration before retrying.

   Hidden Flags are tested through remote flag updates, local renames, folder
   moves, deletion, remote deletion, and restoration after a delete/modify
   conflict. Omission does not mean clearing server flags. Adding an explicit
   field becomes tracked visible state; its later disappearance is a conflict.

   A repeated-run regression performs 32 real CLI account passes with changing
   server flags. Every pass reopens the database. The local text bytes and
   inode remain unchanged, flags remain absent from the view, private state
   matches the server, no mutation is sent, and the body is downloaded once.

   First insertion of a visible Flags field respects the configured order
   across UTF-8, UTF-16, UTF-32, and Windows-1252, while preserving body text
   and CRLF line endings. Legacy unbaselined views retain historical defaults.

4. Replies when display headers are omitted

   Missing fields may come from the selected account's verified raw archive.
   Tests reject arbitrary Raw-Message paths and foreign account provenance,
   require journal/account binding, and preserve explicit visible values,
   including empty values. Edited local body text remains the quoted text.

   Raw header reading is bounded at 256 KiB; ordinary headers need only a
   4 KiB read even when the message body is 8 MiB. The helper uses an existing
   shared lock and read-only SQLite state. It creates no mail state and makes
   no network connection.

5. Installed and standalone behavior

   The packaging test removes its temporary source tree before running the
   standalone executable's help and manual. It verifies exact license and
   provenance bytes in the executable archive.

   Separate release checks install into an isolated prefix and verify private
   split initialization, account listing, offline configuration inspection,
   per-invocation overrides, receive-policy previews without mail roots,
   backed-up legacy migration, and idempotent migration retry. The installed
   manual renders through groff with no warnings. The installed license files
   match the source and the executable archive.

FIXES FOUND DURING THIS RELEASE

Missing visible Flags in offline inspection
    Removing a tracked Flags field could previously appear clean in --status
    or --dry-run because the content comparison intentionally excludes flags.
    The inspection now reports the same missing-header conflict as sync.

Newly explicit Flags with an unchanged value
    Adding Flags to a hidden view did not always record that it had become
    visible when its value already matched the server. Successful sync now
    records that transition and protects against later accidental removal.

Legacy adoption and new display settings
    A completed older download with no saved layout now uses the historical
    layout when first adopted. A new configuration cannot silently redefine
    the meaning of its previously absent Flags field.

Receive-only adoption after interruption
    Read-only adoption was attempted only when a run downloaded a new message.
    It now also completes previously published, unbaselined messages when no
    new bodies arrive. It does not perform remote mutation or refetch the body.

Non-text encoding configuration
    A binary codec such as zlib_codec could raise an uncaught decoder-specific
    exception during validation. It now produces an ordinary MailError.

Packaging test fixture
    The isolated-build fixture was updated to include the newly required
    LICENSE and PROVENANCE.txt and to verify their archive contents. The final
    full suite was rerun after that correction and passed.

LONGER WORKLOADS AND THEIR SCOPE

The complete 2.3.0 suite includes the existing default synchronization, outbox,
watch, attachment, and credential longevity regressions. The new 32-pass test
specifically covers hidden flag state introduced in this release.

The larger workloads from 2.2.1 are preserved, unchanged, in
docs/STRESS-REPORT-2.2.1.txt. They include 1,000-cycle IMAP synchronization and
recovery, 512-cycle outgoing submission recovery, 180 simulated days of watch
scheduling, and 4,096 MIME renders. They were not repeated as extended soaks
for 2.3.0; their exact versions, measurements, and limits remain in that report.
They must not be described as months of real provider uptime.

CURRENT DOWNLOAD LIMITS

Folder inclusion/exclusion and complete raw-message payload budgets are now
implemented. The default includes every selectable folder with no total byte
cap; users can set a narrower scope and budget in config.ini, accounts.ini,
or --set. Protocol metadata and TLS overhead are outside the payload budget.

Selected messages are still fetched whole, including attachment bytes.
Hiding Attachments changes presentation and does not save bandwidth.
--download-attachments, --download-folder, --folder-download, and
--download-message remain proposals, not implemented command options.
See docs/DOWNLOAD-DESIGN.txt for the distinction and proposed future contract.

OTHER PRACTICAL LIMITS

Raw mail, extracted attachments, accepted submissions, and recovery history
are retained. Real activity grows disk usage. Logs are not automatically
rotated. Historical outgoing identities remain conservative until a held job
is resolved; no unsafe alias-history compaction was introduced.

Tests ran on Linux. No physical Chromebook, native OpenBSD machine, live
provider account, physical power loss, or months of continuous real network
operation were tested. Portable replacement paths and terminal behavior are
covered on Linux. Ordinary SMTP cannot guarantee exactly-once delivery after
a lost final acknowledgement; uncertain submissions remain held for review.

The source, tests, documentation, and measurements are supplied for review
and repeatable validation on the intended target installation.
