fs-mail 2.3.0 validation
======================

Environment: Linux, Python 3.12.14.
Target minimum: Python 3.9; delivered Python files parse with its grammar.

Final full suite: 622 tests passed, 0 failed, 0 skipped.
Command: python3 -m unittest discover -s tests -q
Recorded runtime: 36.786 seconds.

Extended stress workloads and fixes: see docs/STRESS-REPORT.txt.
Historical 2.2.1 extended workloads: see docs/STRESS-REPORT-2.2.1.txt.
Implemented download controls and proposed selective fetching interface:
docs/DOWNLOAD-DESIGN.txt. Selective MIME-part commands remain unimplemented.

Coverage includes:

- Grouped -h/--help, offline built-in --manual, configuration reference,
  syntax checks, redacted effective JSON, short aliases, option composition,
  closed output pipes, and selected-account overrides retained in watch mode.
- Split config.ini/accounts.ini, combined-format compatibility, strict keys,
  per-account overrides, relative credential paths, exact migration backups,
  collision refusal, interruptions at publication/commit, and idempotent retry.
- Folder inclusion/exclusion using remote names, quoted patterns, modified
  UTF-7 names, all-folder discovery, complete-body byte budgets shared across
  folders and failed attempts, durable deferral, and preserved local archives.
- Configurable received headers, default byte compatibility, mandatory local
  identity, saved layouts after interrupted publication, and legacy adoption.
- Hidden Flags through remote changes, local rename/move/delete, conflict
  restoration, remote deletion, and 32 repeated runs without text rewrites.
  Adding explicit Flags records visibility; later removal is a conflict in
  both offline inspection and reconciliation. Remote flags are not cleared.
- Verified account-local reply fallback when From, Reply-To, or threading
  headers are hidden; explicit empty fields override fallback. Raw headers
  are read with a bound, under an existing shared lock and read-only journal.
- Read-only adoption recovery even when no new messages are downloaded.
- Configuration, credentials, account binding, permissions, locks, and limits.
- Optional hidden credential prompts, explicit-source overrides, unattended
  refusal, separate endpoint caches, watch reuse, and credential-source refresh.
- Missing saved-secret fallback, including deletion during a read; restored
  files override typed credentials, and account/root/config identities separate
  prompt caches. Invalid existing sources still fail without a fallback.
- Named accounts with explicit distinct roots, shared setting overrides, root
  alias checks, selectors, per-account intervals, independent runtime failures,
  and safe legacy configuration conversion. Local drafts also prevent rebinding
  an already initialized root to another IMAP account.
- Date/sender/numeric-ID filenames, custom templates and timezones, collision
  handling, bounded safe basenames, and preserved existing or pending paths.
- Account-ID and legacy Raw-Message provenance checks prevent foreign same-UID
  files from matching another account's baseline. Bounded peer-root scans hold
  identifiable cross-account moves, including unselected configured accounts.
- Foreign received sources submitted through another account retain public
  provenance when their originals cannot be verified. Existing peer locks
  coordinate cleanup; accepted submissions are never resent during recovery.
- Initial SMTP greetings on an IMAP endpoint produce actionable protocol errors
  before any IMAP commands or authentication; failed runs are marked incomplete.
- Required first-line To and nonempty Subject; optional/reordered Cc, Bcc and
  Attachments; absolute quoted attachment paths; strict header/body separation.
- UTF-8/16/32, BOM and supported BOM-less detection, CR/LF/CRLF, strict reported
  legacy fallback, and explicit outgoing encodings without corrupting received
  UTF-8 working files or reply inputs.
- MIME/HTML conversion, encoded headers, safe attachment extraction, malformed
  input, terminal controls, raw preservation, and bounded parsing.
- IMAP identities, UIDVALIDITY changes, folders, interrupted downloads,
  old-inbox migration, retry fairness, and readonly baseline adoption.
- A three-way synchronization baseline: local renames, moves, flags, deletions,
  remote changes, conflicts, explicit preferences, and local-only annotations.
- Conditional STORE, MODIFIED handling despite tagged OK, exact UID EXPUNGE,
  MOVE/COPYUID verification, new folder creation, and capability refusal.
- Durable remote-operation journals, lost replies, known/unknown move recovery,
  explicit abandonment, fair budgets, and priority for dirty local messages.
- Local undo after staged Deleted, guarded conditional clearing of that exact
  flag, lost corrective replies, preexisting Deleted, concurrent changes, and
  retention of locally restored text when a UID has already been expunged.
- Incomplete scans, symlinks, FIFOs, duplicate IDs, changed IDs, hidden/non-.txt
  renames, and received messages moved into local-only or attachments areas.
- Linux atomic exchange retaining concurrent editor changes. A portable
  journal/rename/link replacement path is forced in tests. A real child exits
  immediately after the live pathname is removed; the next scan restores it,
  retains versions, and holds it instead of requesting remote deletion.
- SMTP recipient refusal, accepted cleanup, uncertain delivery, concurrent
  edits, rename/copy holds, Bcc omission, explicit retries, and stable retries.
- A durable cross-protocol guard prevents accepted SMTP cleanup of a moved
  received file from becoming an inferred IMAP deletion, including process
  death and a later send-only-to-sync transition. Ordinary copied replies clear
  their guards when their originals survive uniquely in a mailbox directory.
- Reply-To/From selection, required reply subjects, threading, quoting, editor
  precedence/arguments, retained drafts after failures, and no automatic send.
- Timestamped private errors.log, stderr, quiet mode, and offline CLI behavior.
- Explicit legacy outbox migration with retained originals and crash recovery.

Eleven real wire tests use Python IMAP/SMTP clients against temporary TLS servers
bound only to 127.0.0.1. They cover implicit TLS and STARTTLS, untrusted-certificate
rejection, encoding/attachments, conditional flags, MOVE mapping, and targeted
expunge preserving another Deleted message. Full CLI integration tests exercise
actual local state, download/render/adoption, queue preparation and cleanup,
configurable views, and reconciliation using a scripted account and SMTP
transport.

Nine terminal integration tests run the real CLI inside a private Unix PTY.
They verify disabled echo, absence of typed secrets from output and files,
controlling-terminal input with redirected stdin/stdout, echo restoration after
Ctrl-C, EOF, or SIGTERM, foreground-only prompting, and detached operation that
fails without reading piped stdin. Synchronization is replaced by a test-only
credential sink; these terminal tests make no network connections.

Two-account CLI integration uses separate scripted IMAP/SMTP endpoints with
identical UID values. It verifies independent downloads, selected flags/deletes,
correct From/credential routing, errors in the proper root, account scheduling,
and moved-versus-copied foreign sources sent before their origin account runs.

No external mail server was contacted, no real credentials were used, no real
email was delivered, and no personal editor was launched during validation.

Release checks also cover zipapp build and installation to an isolated prefix,
byte-for-byte agreement between all 28 packaged modules and source, installed
CLI help/version/manual, private split initialization, configuration checks
and dry-run policy inspection without creating mail roots, and backed-up
legacy migration. The full suite also covers account routing and controlled
reply editors. The installed manpage renders through groff without warnings.
All 70 Python files parse with Python 3.9 grammar. Source, both manual formats,
the quick start, split examples, and a combined multi-account example are
included. The unmodified IALA LICENSE and PROVENANCE.txt are included in the
source, executable archive, and isolated installation; their bytes match.

Practical limits of this validation:

- No physical Chromebook or native OpenBSD machine was available. The portable
  replacement path and editor selection were exercised on Linux.
- No particular provider's authentication, permissions, folder namespace,
  deletion policy, or IMAP extensions were tested with a live account.
- The tests establish these behaviors, not a claim of zero possible defects or
  atomic transactions spanning a local filesystem and an IMAP/SMTP server.
- Ordinary SMTP cannot guarantee exactly-once delivery after a lost final
  acknowledgement. Uncertain submissions are held for explicit resolution.

The complete test suite is included for running on the target installation.
