Every release, and what was in it

• Fixed — ten findings of the batch’s code review (d84c739)
• Fixed · api — a held message stays held through a retry, and re-arming records who (1b68973)
• Fixed · api — a revoke holds a Send later in flight, and a held message being sent stays claimed (20a1433)
• Fixed · api — a revoke holds scheduled sends, and a sent one keeps nothing (30210d9)
• Fixed · web — the forgotten-password page promises no administrator reset (0f7d093)
• Fixed · web — three layout defects the website’s screenshots found (1ec0be6)
• New — inbox categories, tagged at delivery, as tabs over the Inbox (3dad935)
• New — send later, held on the server and sent with the browser closed (8ed5f14)
• New · api — filters compile for the mailbox, proven in the smoke (2ba21fb)
• New · core — the Sieve compiler’s new conditions, tests and actions (34eeebf)
• New · web — a message list worth scanning, and j/k past the drawn rows (d8bc9b5)
• New · web — a profile picture, seen by every mailbox on the server (537ff0b)
• New · web — desktop notifications for mail that arrives in the background (a03c3af)
• New · web — every mail action says what it did, with Undo (c2d1b9d)
• New · web — filter messages like this, from an open message (401bd96)
• New · web — filters as a list of sentences, an editor with live Sieve, and Try it (32c113c)
• New · web — folders as a tree, with rename, delete, drop and Empty (0e8dd5c)
• New · web — important and pinned; the label cap drops to 15 (dd7a0ec)
• New · web — inbox categories learn from the person’s own moves (0220fe1)
• New · web — rebuild the composer as a window that holds several drafts (8c1e9f5)
• New · web — recipient chips, an invalid address refused before Send (05f2559)
• New · web — resizable panes, the reading pane’s place and density (6ce143a)
• New · web — run a filter on existing mail, never forwarding, replying or refusing (00d4f69)
• New · web — settings regrouped into six sections (8caac08)
• New · web — the composer’s toolbar, parallel uploads and the AI panel (02e2e50)
• New · web — the conversation reader (09b61b5)
• New · web — the header, and search across every folder (b62999c)
• New · web — the phone mail view, and the open message at its own URL (874fd7d)

• Fixed · api — account password and session routes hold under a race and a retry (1598eab)
• Fixed · api — the setup status says only that setup is complete (a4b7ab0)
• Fixed · api — what the review of the redesign batch found (29ce543)
• Fixed · ci — the upstream gate’s review findings: dates, targets, renewals, owners (005630b)
• Fixed · db — a mailbox set to unlimited is unlimited to Dovecot at once (358cc10)
• Fixed · web — a failed Copilot reject says why, and no English left in Spanish (7f046ae)
• Fixed · web — defects the close-out review found in the redesign (676599c)
• Fixed · web — the setup wizard opens the domain’s DNS & routing section (05806e9)
• Fixed · web — the wizard does not bounce between setup and sign-in (f6c8bf6)
• New · api — an account’s own password and sessions, and sign-out that signs out (61362b9)
• New · engine — the console’s HSTS lasts six months (59f44b1)
• New · web — a dashboard worth opening (0f2325a)
• New · web — migrations as a stepper, and creating one a page (a6624ba)
• New · web — server settings in sections, each applied on its own (e4c6fcb)
• New · web — the admin’s nav in groups, with a server chip (dab1009)
• New · web — the API tokens in two tabs, server automation and applications (188693e)
• New · web — the audit log gets filters and links (f468cc1)
• New · web — the domain page in sections, each at its own URL (e75c09f)
• New · web — the mailbox page in sections, and a password mismatch said (1cc018d)
• New · web — the shared app shell and primitives, and the admin in it (b271464)

• Fixed · api — a cancel leaves a copying mailbox’s quota until its copy stops (c574648)
• Fixed · api — a message’s recipients are the addresses the caller named (353392d)
• Fixed · api — a migrated mailbox takes its quota when the migration ends (2199e86)
• Fixed · api — a parked quota applies once no live migration maps its mailbox (97958d0)
• Fixed · api — a parked quota survives a display-name save and a re-map (d7177e8)
• Fixed · api — a password-reset link passes the licence’s send stop (cdaf44c)
• Fixed · api — a remote-routed domain gets no autoconfig or autodiscover (f5df9a8)
• Fixed · api — an expansion says nothing but its status (5bc1bcd)
• Fixed · api — the close-out audit’s corrections to the release batch (6234098)
• Fixed · api — the daily AI limit keeps its setting and calls a zero by name (8d77688)
• Fixed · api — the enforcement point’s comment describes the staged schedule (429cfbf)
• Fixed · api — the epic’s review of the licence schedule and its send stop (389f23c)
• Fixed · api — the epic’s review of the send-stop exemption and the warnings (edae57f)
• Fixed · ci — hand the unsigned SBOMs to sign as job artifacts (d297e0c)
• Fixed · cli — a fingerprint mismatch names everything degraded refuses (b97e983)
• Fixed · compose — the edge resumes the config the api last pushed (acc2576)
• Fixed · compose — the edge runs the release-built web image’s caddy (fadba3d)
• Fixed · docker — the worker only reads the maillog directory (b7f9ac7)
• Fixed · docs — a public document’s summary is at most 160 characters (820a452)
• Fixed · engine-postfix-dovecot — a full mailbox defers mail instead of bouncing it (f596c0b)
• Fixed · engine-postfix-dovecot — sign neither Date nor Message-ID through a relay (57a2dda)
• Fixed · web — raise caddy’s golang.org/x/net to v0.60.0 (aebaa81)
• Fixed · web — the licence and pending-quota hints say what the code does (40ad68d)
• New · api — a daily AI limit per mailbox, 200 by default (43a29ae)
• New · api — a degraded licence turns AI off and refuses migrations and sending tokens (db5df0d)
• New · api — a restricted licence makes administration read-only (35e4f81)
• New · api — the api runs as uid 2525, not root (df607c3)
• New · api — the installed licence key is sealed at rest (55d5f4f)
• New · api — the server emails its owners as a licence lapse moves on (eed2974)
• New · docker — the worker runs as uid 2525 with no capabilities (cdd4edc)
• New · engine-postfix-dovecot — a billing lapse past 90 days stops outbound mail at submission (4d23d1a)
• New · engine-postfix-dovecot — the console sends HSTS for a day (e33b47f)
• New · license — the licence schedule escalates in stages (2266679)

0.12.0 was tagged but never published: its release scan refused the web image, whose Caddy was built with a Go carrying two fixable high CVEs, and pushed nothing. 0.12.1 is the first release with everything listed under 0.12.0.

• New · ci — publish a signed CycloneDX SBOM for every image (b31e62d)
• New · worker — alert on the dashboard when the volumes’ disk runs low (2bf7a10)
• New · worker — migration jobs share the copy slots (f16683c)
• New · worker — prune AI call records, copilot tool calls and proposals (e09880c)
• Fixed · web — rebuild Caddy with a patched Go (bb38ad3)
• Fixed · api — a fresh verdict per event, and the client’s swap tracked (d7876d0)
• Fixed · api — a password change, reset or suspension ends the account’s sessions (b60efde)
• Fixed · api — address the review of the event stream re-authorisation (96a84bb)
• Fixed · api — audit the owner’s own filter and autoresponder changes (f78a0d8)
• Fixed · api — no MTA-STS policy or certificate for a remote-routed domain (64f0b52)
• Fixed · api — re-authorise the webmail event stream while it stays open (b11092c)
• Fixed · api — resolving an alert honours the AI switch; domain names are normalised (09a7ae5)
• Fixed · api — the audit log redacts every name a secret goes by (dd9980a)
• Fixed · api — the copilot finds a domain by name whatever its case (a963096)
• Fixed · api — the copilot sends nothing about a domain with AI switched off (cb746f2)
• Fixed · api — the copilot’s proposals honour the AI switch and reach server-wide alerts (d127b75)
• Fixed · api — the webmail password change refuses another origin (4769d9c)
• Fixed · ci — write the SBOM before the push and sign it before publishing (1bceeff)
• Fixed · cli — doctor measures the disk the volumes are on (86f9824)
• Fixed · cli — mailctl backup leaves nothing readable but by its owner (a78d647)
• Fixed · compose — every container’s log is capped (d1234ca)
• Fixed · compose — the mail daemons drop every capability they do not use (c09b784)
• Fixed · core — a merged SPF is judged as receivers read it (e2898fa)
• Fixed · core — a remote-routed domain’s merged SPF verifies (3de4d41)
• Fixed · core — a trusted network too broad to trust is refused on save (92d736d)
• Fixed · deps — source-map-js 1.2.2, past GHSA-68fv-2mgg-jv7q (e302f7d)
• Fixed · web — a borrowed session saves no theme, and an open form writes none back (0b7954d)
• Fixed · web — the plain-text warning reads as one sentence (d3bdaf2)
• Fixed · web — the theme is the mailbox’s, applied and saved by every control (da50544)
• Fixed · worker — a rotated log’s last line is a line, and a run reads at most 8 MiB (2bd6f7a)
• Fixed · worker — a share replaced mid-copy keeps its copies watched (2148865)
• Fixed · worker — a skipped over-long log line is not recorded (f09f183)
• Fixed · worker — containment leaves deferrals out, whatever their reply says (669f17d)
• Fixed · worker — label the disk alert in GiB and test the real measurement (e93a372)
• Fixed · worker — prune AI records per tenant, in batches, keeping linked proposals (1fa92be)
• Fixed · worker — the delivery log’s cursor counts bytes, not characters (6cb51c7)

• Fixed · api — a containment push whose apply failed is retried (3a283f5)
• Fixed · api — close-out 2026-10-04 — export audited on spend; routing guarded; docs follow the code (5754939)
• Fixed · cli — install preflight checks every published port (260a450)
• Fixed · cli — license transfer checks the token is an owner’s before restarting (cdf3f6f)
• Fixed · compose — three secrets no longer default to a public value (69f4137)
• Fixed · core — the custom-header pattern survives the OpenAPI export (4708adc)
• Fixed · db — a marker migration so an upgrade that sealed secrets is never rolled back past (bca4a70)
• Fixed · docker — the IPv6 bridge gateway is out of the master allow_nets and rspamd’s local_addrs (bc5404e)
• Fixed · docker — the master password is accepted only from the stack’s own subnet (8317eb5)
• Fixed · web — the migration job says skipped, not already here (74817dc)
• Fixed · web — the migration Test labels its two checks (6cebbdb)
• New · api — every response carries an x-request-id of the server’s own (5fe7e5e)
• New · api — export a mailbox’s mail before deleting it (ce9cedf)
• New · api — password reset by email for admin-console accounts (e7e9472)
• New · api — per-domain activity from the delivery log (d94df61)
• New · api — recovery codes for admin-console two-factor (974c4bd)
• New · api — seal DKIM private keys at rest (79e4108)
• New · api — server branding for the console and webmail (934334a)
• New · api — the relay password is write-only and sealed at rest (e952fdb)
• New · db — route a domain to another server (c9a598f)
• New · worker — blocklist and rDNS checks for the IPv6 address (c277255)

• Fixed · ai — the copilot and the API describe every kind they return (b58f146)
• Fixed · api — the cookie routes refuse another origin (c9f13c6)
• Fixed · api — the job page, the API and the M365 import say what the job does (a4b05c0)
• Fixed · ci — the publish-bind guard skips a user: line (7bdaa62)
• Fixed · ci — the release scan reads the image from an archive, not a docker socket (adc1802)
• Fixed · cli — restore keeps the database password a pre-0.9 backup ran on (ded3190)
• Fixed · compose — the Postgres superuser password has no public default (db8d8c0)
• Fixed · deps — no high or critical advisory in shipped dependencies (5a5e684)
• Fixed · deps — pin nodemailer 10.0.13 and drop the release-age exclusion (4f1fa44)
• Fixed · docker — each release run re-fetches security updates (b04a74b)
• Fixed · rspamd — rate limits count authenticated mail only (accb64c)
• New · compose — containers run with the privileges they need and no more (fa78669)
• New · docker — patched images, and a release that scans them before pushing (cb76033)
• New · web — security headers and a content security policy on both applications (68fbdd5)

• Fixed · api — a reply draft keeps what it replies to, so its later send threads (6220037)
• Fixed · api — a reply whose original is gone still threads, and autosave reads headers only (961e5c0)
• Fixed · api — recovery-code review fixes for races, whitespace and stale codes (7c2b0c2)
• Fixed · api — store mailbox recovery codes as a keyed hash (f6425ca)
• Fixed · core — a settings update keeps the settings it does not name (b8a636b)
• Fixed · web — a failed contacts refetch that kept its list does not say suggestions are unavailable (33f4fab)
• Fixed · web — a refused label delete says so, and an invalid ?label= is ignored (77c32dc)
• Fixed · web — compose opened before the account loads waits for it, so the signature is drafted (6b4a838)
• Fixed · web — palette commands keep the focus they set, and keys under it stay put (02fe165)
• Fixed · web — rich compose review — plain drafts keep their lines, quotes load no images (718f712)
• Fixed · web — say when the account or contacts fail to load (d2948d8)
• Fixed · web — type the sanitised quote’s DOM as the body element DOMPurify returns (edecbbf)
• Fixed · worker — name the app password by a hash prefix, with no migration (14481db)
• Fixed · worker — stamp an app password’s last use from Dovecot’s login line (00d404a)
• New · api — html signatures are sanitised on save (ab36e9f)
• New · api — single-use recovery codes for mailbox two-factor sign-in (879e417)
• New · web — a calendar date-range picker; autoresponder dates stop shifting by time zone (e731951)
• New · web — a command palette for every action and its shortcut (f20f34b)
• New · web — compose in rich text, keeping the quoted original out of the editor (73117bc)
• New · web — html signatures edited in tiptap, sent as multipart/alternative (ebbf9a6)
• New · web — labels as IMAP keywords, in the sidebar, on rows and as a filter (ae60e9f)
• New · web — labels in the command palette (a387d76)
• New · web — recovery codes on the security screen and the webmail sign-in (c673a7b)
• New · web — webmail settings in sections, each at its own url (caadd50)

• Fixed · ipv6 — close-out audit — the ipv6 bind counts for plaintext auth, and more (51dde13)
• New · core — outbound ipv6 as an opt-in, refused without a forward-confirmed ptr (e98c13e)
• New · core — the host’s ipv6 address in dns, the drift job and doctor (1636c03)
• New · network — ipv6 as an opt-in compose override, forwarded by dnat (00589fb)

• Fixed · auth — ban() stores only a real ban key — an address or an ipv6 /64 (46287a4)
• Fixed · core — refuse an invalid trusted network on write, not on every read (ffe0503)
• Fixed · server-config — refuse switching tls.mode to none on a public bind after setup (ebfe6f6)
• New · auth — an ipv6 ban covers its /64, keyed alike by the api, the worker and dovecot (3386aa5)
• New · core — ipv6 address handling — one spelling, byte-wise cidrs, nibble-format dnsbls (58a7afd)

• Fixed · doctor — the pop3 row reads the +OK greeting, because Docker’s proxy accepts a dead port (a37157c)
• Fixed · setup — refuse tls.mode none on a public bind, and make doctor see plaintext auth (8a7cc09)
• New · server — pop3 can be turned off — protocols.pop3, the wizard/server page switch, a doctor row (92ee863)

• Fixed · api — a body over the route limit answers 413 message_too_large; audit fixes (bf31637)
• New · admin — create a sending token from the API tokens page (4a0878e)
• New · api — the messages resource, for sending from an application (56a4435)
• New · api — tokens carry permissions and sender restrictions (6425f46)

• Fixed · admin — open sign-in on HTTPS after setup when TLS is on (74df05c)
• Fixed · db — tolerate a concurrent creator of the mail_daemon role (a50e875)
• Fixed · engine — make BYO mode order no ACME certificate for the service hosts (c8b37dc)
• Fixed · engine — redirect plain HTTP to HTTPS instead of serving the apps on :80 (a68dfa3)

• Fixed · cert-sync — install the mail hostname’s certificate, not the newest (45978e9)
• Fixed · cli — license transfer gets credentials before it changes the host (6a4243f)

• Fixed · licensing — the host fingerprint ignores Docker’s virtual interfaces (e10f414)

• Fixed · cli — let a host whose fingerprint changed transfer its licence and upgrade (96d1311)
• Fixed · compose — stop postfix claiming the mail hostname inside the stack (943cefc)
• Fixed · migration — let the IMAP connection test work without a master user (774ad01)
• Fixed · webmail — hide New message on the Settings page (6853064)

• Fixed · licensing — one machine fingerprint per host, computed by mailctl (91839f5)

• Fixed · auth — a way back for an admin whose TOTP seed cannot be read (d5ca7a0)
• Fixed · dns — the mail host A row can verify inside Compose (24d268c)
• Fixed · docs — a public page must not link to a non-public one, checked on the PR (8103041)
• Fixed · dovecot — rotate dovecot.log and bound what one ban sweep reads (9f1a665)
• Fixed · licensing — say when another server has claimed a portable key (5d39a3f)
• Fixed · licensing — send the licence key, which claims an unbound licence (0b47a8e)
• Fixed · licensing — the only way out of a claimed portable key is support (8a6646a)
• Fixed · migration — refuse an over-limit cPanel filter instead of cutting it (e4e7953)
• Fixed · migration — report filters imported with a loss, not only refused ones (53be414)
• New · webmail — an AI features switch in Settings, where the panel says (76a75d7)

• Fixed · api — a send never leaves without its attachments; the composer re-attaches what was lost (391003f)
• Fixed · api — an account’s own mailbox is not borrowed, and a borrowed hour does not renew (e25c492)
• Fixed · api — classify webmail IMAP errors on what dovecot actually said (fa9ee8e)
• Fixed · api — include Eta’s version in the build id (6e76447)
• Fixed · api — never ban a stack-internal address from the API path either (5c65f9d)
• Fixed · api — one alert of an unknown kind no longer fails the whole alerts list (8e1eebb)
• Fixed · api — re-render after an upgrade that keeps the image tag (360d43a)
• Fixed · api — the not-found fallback matched an apostrophe dovecot does not send (d4ffe9f)
• Fixed · api — webmail’s own hops upgrade with STARTTLS whenever the daemon offers it (1fba5ae)
• Fixed · caddy — hand /mail to the mail client on every name the admin panel answers on (5b34c3e)
• Fixed · ci — install cosign in the sign job instead of cosign-installer (f2fafe5)
• Fixed · ci — record the tagged commit, not GITHUB_SHA, as the release revision (30faf60)
• Fixed · ci — the lockstep guard no longer needs the gh CLI, and runs everywhere (6b5c5c0)
• Fixed · cli — doctor only probes IPv6 when the stack is actually up (fac0921)
• Fixed · cli — name the unsigned releases accurately when no signed manifest exists (2b241dc)
• Fixed · cli — print an http:// Setup Wizard URL while setup is pending (71959fe)
• Fixed · cli — the ipv6 exposure warning renders as a warning, not a tick (982140e)
• Fixed · compose — no public default for JWT_SECRET or the two sealing keys (30581a7)
• Fixed · compose — publish every port on an explicit IPv4 bind address (2906ce7), closes moby/libnetwork#2607
• Fixed · compose — the mail queue outlives its container (f5aadbf)
• Fixed · containment — a restore now holds against evidence that predates it (ce36959)
• Fixed · core — a stack-internal address is 172.16.0.0/12, not all of 172.0.0.0/8 (7d9cae8)
• Fixed · core — refuse a stack CIDR without a prefix; qualify the master passdb’s reach (89a14b4)
• Fixed · db — commit the 0030 snapshot and fail CI when a migration lacks one (8183a69)
• Fixed · deliverability — classify rate-limit refusals as throttled, not reputation (b4f532a)
• Fixed · dns — a configured relay contributes its declared SPF term (0de0cf5)
• Fixed · dovecot — accept the master user only from the stack’s own networks (9b0733b)
• Fixed · migration — a delete with a label or a move files into Trash only (74d45c7)
• Fixed · migration — a Gmail filter with several addresses and a size test is refused (98b62a4)
• Fixed · migration — a timed-out copy names its 12-hour ceiling, not undefinedms (a457d28)
• Fixed · migration — classify imapflow errors on what the source actually said (c8db4ce)
• Fixed · migration — hold the filter import to the 100-rule cap the editors save with (e14fa6f)
• Fixed · migration — import Gmail’s “Delete it” as a move to Trash, not discard (45a7a3f)
• Fixed · migration — refuse Gmail and M365 rules that cannot fit, and unknown M365 conditions (f62ae01)
• Fixed · postfix — relay only for the Compose subnet, not every private range (a89b77c)
• Fixed · web — a language switch must not render the language it is leaving (1fd33c7)
• Fixed · web — a quota is not a noun you can drop into a sentence (dd969a3)
• Fixed · web — a reopened draft keeps its attachments, and a failed restore keeps the saved draft (f9cc726)
• Fixed · web — a restore that outlives the composer cannot reopen it; four docs corrected (4c3ffbf)
• Fixed · web — an account with no mailbox is told so, and a folder list that fails says why (60f09e8)
• Fixed · web — the admin account menu offered Webmail twice (0270a2d)
• Fixed · web — the composer says to save again after a refused Save draft; reopened drafts documented (0bd318d)
• Fixed · web — the connection-rate field says per hour, the unit Postfix counts it in (d175f40)
• Fixed · web — the reading pane fetches attachments and inline images with the session (d03fb49)
• Fixed · webmail — show the no-mailbox explanation at once, not after a retry (5461dbd)
• Fixed · worker — count Dovecot auth failures over the window, including SMTP AUTH, and audit bans (60d58a5)
• Fixed · worker — count master guesses under a ban; a lapsed ban re-earned starts afresh (bd767dd)
• Fixed · worker — never count what a ban refuses; match bans on scope; count master-user AUTH (4921227)
• Fixed · worker — recognise IMAP and POP3 master-password guesses by the master user’s name (5f1e136)
• New · api — a mail queue viewer, over a second file-handshake agent (30ecaac)
• New · auth — app passwords and two-factor authentication for mailboxes (6d375a2)
• New · auth — rate-limit authentication and lock out brute force (a050108)
• New · auth — seal TOTP secrets, and fail closed when one cannot be read (ce2ef35)
• New · cli — mailctl install verifies the release before it writes anything (420e71f)
• New · cli — verify a release against its signed manifest before pulling (aa80a4b)
• New · deliverability — parse TLS-RPT reports and alert on failures (38a5791)
• New · rate-limits — per-mailbox and per-domain overrides, and burst alerts (4912b06)
• New · setup — the wizard’s optional AI-provider step (c11aed0)
• New · spam — per-domain and per-mailbox thresholds and sender lists (65164d1)
• New · web — a translation runtime, and the webmail shell speaking through it (f5a2778)
• New · web — the admin panel and the webmail get their own hosts (d1edb39)
• New · web — the mail client is one host, not one per hosted domain (d7527cb)
• New · web — the product wears the brand (71c28a9)
• New · web — translate the admin shell, dashboard, licence and account pages (2d239b1)
• New · web — translate the AI, copilot, queue and delivery-log screens (db3fc90)
• New · web — translate the domain and server-settings screens (5de9d19)
• New · web — translate the domains, users, tokens, mailbox and spam screens (fe086b5)
• New · web — translate the migration screens (e210bdc)
• New · web — translate the rest of webmail — compose, reading pane, AI, filters (d337cba)
• New · web — translate the setup wizard, and document the whole thing (131621d)
• New · webmail — an owner or admin opens any mailbox, by single-use hand-off (4944ae9)
• Faster · web — load admin and webmail screens on demand (aaf0d66)

• Fixed · api — re-apply configuration when the running build did not render it (51f0e69)
• Fixed · engine — set smtp_tls_security_level once so doctor stops crying wolf (24c7872)

• New · api — serve the client at webmail. (fcd49ef)
• New · deliverability — capture SMTP-time rejections in the delivery log (703635e)
• Fixed · engine — service-host routes never matched a real domain (714cc54)
• Fixed · install — stop /etc/os-release clobbering the bootstrap’s own VERSION (8cdd782)
• Fixed · postfix — install libsasl2-modules so relay auth can negotiate (18533ad)
• Fixed · worker — dns drift deleted the conditional records’ verification status (ecfa0f1)

• Fixed · cli — ship a compose file that can actually install (457d97a)

• New · api — export the OpenAPI document without a database (71ea025)
• New · web — admin UI shell, Setup Wizard and generated API client (64d2ef0)
• New · mailboxes — quota usage from Dovecot quota_clone with API endpoints and admin UI (2be160c)
• New · filters — mailbox Sieve filters and autoresponders via ManageSieve (1a19a0e)
• Fixed · cli — mailctl upgrade back-fills .env keys introduced by newer releases (51a4c9d)
• New · api — DKIM signing per domain and live DNS verification (0241fcd)
• New · worker — deliverability monitoring, DMARC ingestion, rate limits, MTA-STS and SRS (7994e95)
• New · api — client autoconfig/autodiscover endpoints and DNS zone export with provider notes (bc16775)
• New · worker — searchable delivery log with bounce classification from the Postfix log (f9ac885)
• New · api — IP warm-up schedule as a growing rspamd outbound cap (8c715da)
• New · api — webmail IMAP bridge, mailbox sign-in and account settings (ADR 0010) (ab4b0ee)
• New · web — webmail client — folders, virtualised list, reading pane, compose and settings (ddb80ed)
• Fixed · worker — detect log rotation when the inode is reused or kept (5e9346d)
• New · ci — tag-triggered image build and push to ECR (813d475)
• New · cli — make @mailserver/cli publishable (c521751)
• Fixed · ci — make the mailctl pack check work on the runner (c2bec9b)
• New · cli — rename the published package to @maildock/mailctl (55b8911)
• New · web — conversation threading and bulk actions in the webmail list (cdd9f58)
• Fixed · api — flush pending IMAP updates before reading the mailbox view (60840bc)
• New · docker — index mail for full-text search with fts_flatcurve (c9dabee)
• New · web — autocomplete recipients from sent history (0bf4caa)
• New · web — install as an app and read mail offline (d0dd17c)
• New · api — verify and enforce a licence offline (e8cd1a5)
• New · cli — authenticate to the registry and heartbeat the licence (f3f2884)
• Fixed · cli — never treat a workspace package as external when bundling (c3115ed)
• New · engine — seal forwarded mail with ARC and contain compromised mailboxes (257990d)
• Fixed · core — ship compromised-mailbox containment disarmed by default (63206d4)
• New · migration — migration schema, credential sealing and the imapsync wrapper (7422021)
• New · worker — migration queue, sweep and imapsync in the worker image (e0bba26)
• New · ai — provider abstraction with Anthropic, OpenAI-compatible and Ollama adapters (07eaea9)
• New · api — migration job routes, repository and credential lifecycle (7748545)
• New · ai — per-tenant provider configuration with the key encrypted at rest (d06644b)
• New · web — migration wizard, monitoring, cutover checklist and docs (e867002)
• New · ai — privacy controls enforced at a single chokepoint (4d241ab)
• New · ai — versioned prompt library with injection defence and evaluation fixtures (9521e48)
• New · migration — cPanel/WHM connector, discovery and filter translation (b546ba7)
• New · api — cPanel discovery, mailbox pre-create and forwarder/filter import (ddb6fe0)
• New · web — cPanel source in the wizard, and a panel for what the source holds (9112621)
• Fixed · migration — a zero cPanel quota is unlimited, and two misleading UI labels (dbe1a82)
• Fixed · ai — correct three defects found by the first live run (cea754b)
• New · ai — report the pulled model’s real capabilities for Ollama (acb23c4)
• Fixed · ai — harden mail prompts and recover unparseable replies, after evaluating on a local model (640f354)
• New · migration — the Plesk connector, over the XML API that actually has mail (2075bf5)
• New · api — wire the Plesk source through the migration routes (3fa2136)
• New · web — add Plesk to the migration wizard (172770a)
• Fixed · migration — a Plesk job scoped to one domain must not absorb another’s (9aa575a)
• New · web — admin settings screen for AI (5405f05)
• New · migration — the Google Workspace connector, and the OAuth plumbing both hosted sources need (973aee0)
• New · worker — keep an expiring source token alive under a running copy (a8b4bad)
• New · web — add Google Workspace to the migration wizard (37a77f8)
• Fixed · web — confirm before deleting the AI key, and reset the form when the config changes (5b361d0)
• New · migration — the Microsoft 365 connector, over Graph and Exchange Online (f2a016f)
• New · web — add Microsoft 365 to the migration wizard (d468e46)
• New · ai — thread summary, and the streaming rail every inbox feature will use (578c580)
• New · ai — explain-this-email and smart replies (061450e)
• New · ai — compose assist — draft, rewrite, translate, fix grammar (94a4708)
• Fixed · docker — the API image was missing @mailserver/migration (2ba26f2)
• New · ai — the admin copilot, with write tools that propose rather than act (563fe00)
• Fixed · web — label a copilot turn that answered without reading anything (c619e7b)
• Fixed · api — coerce copilot tool arguments, which Ollama sends as strings (858f509)
• New · ai — getMailbox, and Anthropic verified against every feature (a658043)
• Fixed · ai — check the abort signal on every stream iteration, not once at the end (ee092eb)
• Fixed · migration — three defects the live cPanel gate found (#32) (f49f615)
• New · license — admin licence page, degrade banners and mailctl license (d065359)
• New · cli — roll mailctl upgrade back when the health check never passes (74595d1)
• Fixed · cli — the published mailctl could not find its own compose bundle (25a74f1)
• Fixed · cli — don’t let the upgrade tests depend on a generated build artefact (279d0e2)
• Fixed · db — set the mail_daemon password so the daemons can authenticate (7a0c29f)
• Fixed · cli — generate install secrets with a CSPRNG, not Math.random (7603b3c)
• Fixed · compose — deliver LICENSE_PUBLIC_KEY to installs, and say so when it is missing (9f8dc34)
• Fixed · docker — ship the api and worker as bundles, not as source (7086f0a)
• New · license — ship the production licence public key in the compose bundle (b4562b2)
• New · license — make a transfer self-service, end to end (f8cb529)
• Fixed · cli — point new installs at licence.maildock.app, a domain we own (317380d)
• New · ai — cache the copilot’s stable prefix (b073328)
• New · docker — stamp internet mail with X-Spamd-Result (9ffbac1)
• Fixed · docker — a recreated rspamd container can read its DKIM keys (a48222a)

• New · api — control plane with setup, auth, CRUD and server config 4401e71
• New · cli — mailctl install/doctor/backup/restore/upgrade 9cd5c2a
• New · core — shared Zod schemas for the control plane 78e5124
• New · db — control-plane tables and reusable migrations 1cd757d
• New · db — tenant-aware schema, Postfix/Dovecot lookup views, argon2id passwords, migrate/seed/smoke 3cafbd2
• New · docker — config watcher, cert-sync, Caddy and API image 9f9112d
• New · docker — Postfix, Dovecot and Rspamd images with DB-backed virtual users; compose dev stack d53b103
• New · engine — engine interface and Postfix/Dovecot adapter 892fff6