CI#158

Current runner version: '2.338.2'
▸ Runner Image Provisioner
Hosted Compute Agent
Version: 20261021.618
Commit: 21505ad2541d5be6135ed84fc33697146cf75b8e
Build Date: 2026-10-21T00:45:21Z
Worker ID: {6ec0d7ad-ad3d-48cc-bc12-5327c0c8ca92}
Region: eastus2
Cloud: Azure
▸ Operating System
Ubuntu
26.04.1
LTS
▸ Runner Image
Image: ubuntu-26.04
Version: 20261025.179.1
Included Software: https://github.com/actions/runner-images/blob/ubuntu26/20261025.179/images/ubuntu/Ubuntu2604-Readme.md
Image Release: https://github.com/actions/runner-images/releases/tag/ubuntu26%2F20261025.179
▸ GITHUB_TOKEN Permissions
Contents: read
Metadata: read
Secret source: Actions
Cache mode: write
Prepare workflow directory
Prepare all required actions
Getting action download info
Download action repository 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' (SHA:3d3c42e5aac5ba805825da76410c181273ba90b1)
Download action repository 'actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1' (SHA:949feb2413d6458794dcd2491c4babbbce0c15c1)
Complete job name: Test (GitHub)
▸ Run actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
  persist-credentials: false
  repository: collection-of-things/aggregate-mail
  token: ***
  ssh-strict: true
  ssh-user: git
  clean: true
  sparse-checkout-cone-mode: true
  fetch-depth: 1
  fetch-tags: false
  show-progress: true
  lfs: false
  submodules: false
  set-safe-directory: true
  allow-unsafe-pr-checkout: false
Syncing repository: collection-of-things/aggregate-mail
▸ Getting Git version info
Working directory is '/home/runner/work/aggregate-mail/aggregate-mail'
[command]/usr/bin/git version
git version 2.56.0
Temporarily overriding HOME='/home/runner/work/_temp/66c28dff-4b09-4f91-8f5a-c06deb07db5e' before making global git config changes
Adding repository directory to the temporary git global config as a safe directory
[command]/usr/bin/git config --global --add safe.directory /home/runner/work/aggregate-mail/aggregate-mail
Deleting the contents of '/home/runner/work/aggregate-mail/aggregate-mail'
▸ Determining repository object format
▸ Initializing the repository
[command]/usr/bin/git init /home/runner/work/aggregate-mail/aggregate-mail
hint: Using 'master' as the name for the initial branch. This default branch name
hint: will change to "main" in Git 3.0. To configure the initial branch name
hint: to use in all of your new repositories, which will suppress this warning,
hint: call:
hint:
hint: 	git config --global init.defaultBranch <name>
hint:
hint: Names commonly chosen instead of 'master' are 'main', 'trunk' and
hint: 'development'. The just-created branch can be renamed via this command:
hint:
hint: 	git branch -m <name>
hint:
hint: Disable this message with "git config set advice.defaultBranchName false"
Initialized empty Git repository in /home/runner/work/aggregate-mail/aggregate-mail/.git/
[command]/usr/bin/git remote add origin https://github.com/collection-of-things/aggregate-mail
▸ Disabling automatic garbage collection
[command]/usr/bin/git config --local gc.auto 0
▸ Setting up auth
Removing SSH command configuration
[command]/usr/bin/git config --local --name-only --get-regexp core\.sshCommand
[command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"
Removing HTTP extra header
[command]/usr/bin/git config --local --name-only --get-regexp http\.https\:\/\/github\.com\/\.extraheader
[command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'http\.https\:\/\/github\.com\/\.extraheader' && git config --local --unset-all 'http.https://github.com/.extraheader' || :"
Removing includeIf entries pointing to credentials config files
[command]/usr/bin/git config --local --name-only --get-regexp ^includeIf\.gitdir:
[command]/usr/bin/git submodule foreach --recursive git config --local --show-origin --name-only --get-regexp remote.origin.url
[command]/usr/bin/git config --file /home/runner/work/_temp/git-credentials-7f2b68e7-2bef-4410-b7ec-5e2505a1afb1.config http.https://github.com/.extraheader AUTHORIZATION: basic ***
[command]/usr/bin/git config --local includeIf.gitdir:/home/runner/work/aggregate-mail/aggregate-mail/.git.path /home/runner/work/_temp/git-credentials-7f2b68e7-2bef-4410-b7ec-5e2505a1afb1.config
[command]/usr/bin/git config --local includeIf.gitdir:/home/runner/work/aggregate-mail/aggregate-mail/.git/worktrees/*.path /home/runner/work/_temp/git-credentials-7f2b68e7-2bef-4410-b7ec-5e2505a1afb1.config
[command]/usr/bin/git config --local includeIf.gitdir:/github/workspace/.git.path /github/runner_temp/git-credentials-7f2b68e7-2bef-4410-b7ec-5e2505a1afb1.config
[command]/usr/bin/git config --local includeIf.gitdir:/github/workspace/.git/worktrees/*.path /github/runner_temp/git-credentials-7f2b68e7-2bef-4410-b7ec-5e2505a1afb1.config
▸ Fetching the repository
[command]/usr/bin/git -c protocol.version=2 fetch --no-tags --prune --no-recurse-submodules --depth=1 origin +ddac6a370b4678927d51fc1d50fabe8312630073:refs/remotes/pull/187/merge
From https://github.com/collection-of-things/aggregate-mail
 * [new ref]         ddac6a370b4678927d51fc1d50fabe8312630073 -> pull/187/merge
▸ Determining the checkout info
[command]/usr/bin/git sparse-checkout disable
[command]/usr/bin/git config --local --unset-all extensions.worktreeConfig
▸ Checking out the ref
[command]/usr/bin/git checkout --progress --force refs/remotes/pull/187/merge
Note: switching to 'refs/remotes/pull/187/merge'.

You are in 'detached HEAD' state. You can look around, make experimental
changes and commit them, and you can discard any commits you make in this
state without impacting any branches by switching back to a branch.

If you want to create a new branch to retain commits you create, you may
do so (now or later) by using -c with the switch command. Example:

  git switch -c <new-branch-name>

Or undo this operation with:

  git switch -

Turn off this advice by setting config variable advice.detachedHead to false

HEAD is now at ddac6a3 Merge 3ea2b5dc04fd503efc7b8c37cfc433ddd945f4ae into 7b5e787b1ea3675726f43788401ca1f88be90ed0
[command]/usr/bin/git log -1 --format=%H
ddac6a370b4678927d51fc1d50fabe8312630073
▸ Removing auth
Removing SSH command configuration
[command]/usr/bin/git config --local --name-only --get-regexp core\.sshCommand
[command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"
Removing HTTP extra header
[command]/usr/bin/git config --local --name-only --get-regexp http\.https\:\/\/github\.com\/\.extraheader
[command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'http\.https\:\/\/github\.com\/\.extraheader' && git config --local --unset-all 'http.https://github.com/.extraheader' || :"
Removing includeIf entries pointing to credentials config files
[command]/usr/bin/git config --local --name-only --get-regexp ^includeIf\.gitdir:
includeif.gitdir:/home/runner/work/aggregate-mail/aggregate-mail/.git.path
includeif.gitdir:/home/runner/work/aggregate-mail/aggregate-mail/.git/worktrees/*.path
includeif.gitdir:/github/workspace/.git.path
includeif.gitdir:/github/workspace/.git/worktrees/*.path
[command]/usr/bin/git config --local --get-all includeif.gitdir:/home/runner/work/aggregate-mail/aggregate-mail/.git.path
/home/runner/work/_temp/git-credentials-7f2b68e7-2bef-4410-b7ec-5e2505a1afb1.config
[command]/usr/bin/git config --local --unset includeif.gitdir:/home/runner/work/aggregate-mail/aggregate-mail/.git.path \/home\/runner\/work\/_temp\/git\-credentials\-7f2b68e7\-2bef\-4410\-b7ec\-5e2505a1afb1\.config
[command]/usr/bin/git config --local --get-all includeif.gitdir:/home/runner/work/aggregate-mail/aggregate-mail/.git/worktrees/*.path
/home/runner/work/_temp/git-credentials-7f2b68e7-2bef-4410-b7ec-5e2505a1afb1.config
[command]/usr/bin/git config --local --unset includeif.gitdir:/home/runner/work/aggregate-mail/aggregate-mail/.git/worktrees/*.path \/home\/runner\/work\/_temp\/git\-credentials\-7f2b68e7\-2bef\-4410\-b7ec\-5e2505a1afb1\.config
[command]/usr/bin/git config --local --get-all includeif.gitdir:/github/workspace/.git.path
/github/runner_temp/git-credentials-7f2b68e7-2bef-4410-b7ec-5e2505a1afb1.config
[command]/usr/bin/git config --local --unset includeif.gitdir:/github/workspace/.git.path \/github\/runner_temp\/git\-credentials\-7f2b68e7\-2bef\-4410\-b7ec\-5e2505a1afb1\.config
[command]/usr/bin/git config --local --get-all includeif.gitdir:/github/workspace/.git/worktrees/*.path
/github/runner_temp/git-credentials-7f2b68e7-2bef-4410-b7ec-5e2505a1afb1.config
[command]/usr/bin/git config --local --unset includeif.gitdir:/github/workspace/.git/worktrees/*.path \/github\/runner_temp\/git\-credentials\-7f2b68e7\-2bef\-4410\-b7ec\-5e2505a1afb1\.config
[command]/usr/bin/git submodule foreach --recursive git config --local --show-origin --name-only --get-regexp remote.origin.url
Removing credentials config '/home/runner/work/_temp/git-credentials-7f2b68e7-2bef-4410-b7ec-5e2505a1afb1.config'
▸ Run actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
with:
  node-version-file: .nvmrc
  cache: npm
  check-latest: false
  token: ***
  package-manager-cache: true
Node version file is not JSON file
Node version file is not TOML file
Resolved .nvmrc as 24.22.1
Found in cache @ /opt/hostedtoolcache/node/24.22.1/x64
▸ Environment details
node: v24.22.1
npm: 11.19.1
yarn: 1.22.22
[command]/opt/hostedtoolcache/node/24.22.1/x64/bin/npm config get cache
/home/runner/.npm
npm cache is not found
▸ Run npm ci --no-audit --no-fund
npm ci --no-audit --no-fund
shell: /usr/bin/bash -e {0}
npm warn deprecated lodash.isequal@4.5.0: This package is deprecated. Use require('node:util').isDeepStrictEqual instead.
npm warn deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm warn deprecated glob@7.2.3: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm warn deprecated rimraf@2.6.3: Rimraf versions prior to v4 are no longer supported
npm warn deprecated boolean@3.2.0: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.
npm warn deprecated glob@7.2.3: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm warn deprecated node-domexception@1.0.0: Use your platform's native DOMException instead
npm warn deprecated glob@10.5.0: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me

added 651 packages in 10s
npm warn install-scripts 2 packages have install scripts not yet covered by allowScripts:
npm warn install-scripts   electron-winstaller@5.4.0 (install: node ./script/select-7z-arch.js)
npm warn install-scripts   esbuild@0.28.2 (postinstall: node install.js)
npm warn install-scripts
npm warn install-scripts Run `npm install-scripts ls` to review, or `npm install-scripts approve <pkg>` to allow.
▸ Run npm test
npm test
shell: /usr/bin/bash -e {0}

> emc2@0.2.23 test
> tsx --test --test-concurrency=1 --test-timeout=120000 server/*.test.ts desktop/*.test.ts src/*.test.tsx scripts/*.test.mjs

✔ editing menus respect Chromium permissions and leave mail actions to the client (2.525835ms)
✔ strict bounded current record binds retained original bytes (16.563672ms)
✔ current record rejects version (0.600737ms)
✔ current record rejects name (0.646762ms)
✔ current record rejects missing (0.570551ms)
✔ current record rejects extra (0.596268ms)
✔ current record rejects digest (0.494148ms)
✔ current record rejects empty (0.551345ms)
✔ current record rejects noncanonical (0.520347ms)
✔ committed malformed fails closed rather than appearing absent (0.891928ms)
✔ committed oversized fails closed rather than appearing absent (0.79062ms)
✔ committed digest-mismatch fails closed rather than appearing absent (0.697737ms)
✔ committed missing-original fails closed rather than appearing absent (0.681867ms)
✔ committed directory fails closed rather than appearing absent (0.508666ms)
✔ committed symlink fails closed rather than appearing absent (0.561814ms)
✔ canonical key rejects 5-character invalid value (0.169885ms)
✔ canonical key rejects 45-character invalid value (0.099805ms)
✔ canonical key rejects 44-character invalid value (0.083916ms)
✔ canonical key rejects 44-character invalid value (0.079118ms)
✔ interrupted persistence at open preserves originals and never promotes a partial record (0.743562ms)
✔ interrupted persistence at write preserves originals and never promotes a partial record (0.614202ms)
✔ interrupted persistence at file-fsync preserves originals and never promotes a partial record (0.615814ms)
✔ interrupted persistence at close preserves originals and never promotes a partial record (1.243611ms)
✔ interrupted persistence at rename preserves originals and never promotes a partial record (1.290609ms)
✔ interrupted persistence at directory-fsync preserves originals and never promotes a partial record (1.119832ms)
✔ interrupted persistence at readback preserves originals and never promotes a partial record (1.212093ms)
✔ commit rechecks source digest and committed-record absence after file flush (2.312387ms)
✔ uncommitted temporary record is ignored on restart (0.465826ms)
✔ one frame succeeds only after complete payload and normal EOF (27.394144ms)
✔ private pipe rejects empty (0.738833ms)
✔ private pipe rejects header (0.446059ms)
✔ private pipe rejects premature (0.574778ms)
✔ private pipe rejects duplicate (0.286243ms)
✔ private pipe rejects trailing (0.16639ms)
✔ private pipe rejects zero (0.196394ms)
✔ private pipe rejects oversized (0.256346ms)
✔ private pipe rejects json (0.495782ms)
✔ private pipe rejects utf8 (0.433405ms)
✔ abrupt pipe close fails without normal EOF (0.346013ms)
✔ environment allowlist excludes key, provider and Node injection entries (0.214299ms)
✔ helper roundtrip must preserve the exact canonical key (0.759371ms)
✔ owned child success: authenticated EOF and observed exit gate the additive commit (107.900272ms)
✔ owned child nonce: authenticated EOF and observed exit gate the additive commit (86.346702ms)
✔ owned child mac: authenticated EOF and observed exit gate the additive commit (91.625242ms)
✔ owned child digest: authenticated EOF and observed exit gate the additive commit (95.682363ms)
✔ owned child version: authenticated EOF and observed exit gate the additive commit (95.099568ms)
✔ owned child premature: authenticated EOF and observed exit gate the additive commit (91.389592ms)
✔ owned child duplicate: authenticated EOF and observed exit gate the additive commit (96.393141ms)
✔ owned child trailing: authenticated EOF and observed exit gate the additive commit (84.994422ms)
✔ owned child nonzero: authenticated EOF and observed exit gate the additive commit (92.253998ms)
✔ owned child signal: authenticated EOF and observed exit gate the additive commit (88.029161ms)
✔ owned child hang: authenticated EOF and observed exit gate the additive commit (157.039569ms)
✔ owned child spawn-error: authenticated EOF and observed exit gate the additive commit (5.445291ms)
✔ owned child quit: authenticated EOF and observed exit gate the additive commit (35.355439ms)
✔ owned child fatal: authenticated EOF and observed exit gate the additive commit (122.238074ms)
✔ synchronous parent spawn exception is sanitized and temporary profile removed (1.389693ms)
✔ binary helper validates private sibling workspace, exact candidate, quarantine and parent (25.748769ms)
✔ helper binds the running bundle and rejects a target changed after its readiness check (18.366998ms)
✔ binary validation rejects unsupported Mach-O, wrong architecture, signature and quarantine without developer tools (13.379365ms)
✔ binary replacement retains backup and profile, rechecks promoted quarantine and uses normal LaunchServices (52.838435ms)
✔ known pre-dispatch failure rolls back, while dispatched failure keeps both apps and reveals recovery (53.173553ms)
✔ stage tamper, backup collision and symlink destinations never replace the installed app (25.957147ms)
✔ bundling the ordinary updater does not execute the replacement helper bootstrap (54.060916ms)
✔ rollback failure still reveals the retained original app (9.667684ms)
▶ receipt write failures cannot suppress recovery before or after dispatch
  ✔ before (13.598514ms)
  ✔ after (37.41315ms)
✔ receipt write failures cannot suppress recovery before or after dispatch (52.012012ms)
✔ published DMG and SHA256SUMS selection follows the running process architecture including Rosetta (2.743419ms)
✔ candidate preflight rejects malformed, foreign, missing and ambiguous releases and checksums (1.417915ms)
✔ DMG byte verification rejects tampering, truncation, symlinks and cancellation (17.637791ms)
✔ download prepares a verified app for automatic replacement without opening Finder (70.825728ms)
▶ a read-only running copy stages beside its identical writable Applications installation
  ✔ handoff (70.219348ms)
  ✔ changed-target (31.52914ms)
✔ a read-only running copy stages beside its identical writable Applications installation (102.825119ms)
▶ installed-target discovery rejects absent, changed, ambiguous and noncanonical counterparts
  ✔ missing (3.705287ms)
  ✔ changed (6.454797ms)
  ✔ ambiguous (7.065161ms)
  ✔ bundle-symlink (4.028147ms)
  ✔ parent-symlink (4.865914ms)
  ✔ cancelled (4.2126ms)
  ✔ wrong-runtime (3.109249ms)
✔ installed-target discovery rejects absent, changed, ambiguous and noncanonical counterparts (34.702026ms)
✔ Check can retry after a read-only fallback and failed download using the same installation configuration (23.769225ms)
✔ download failures, signature rejection and cancellation detach and clean without quitting (30.376203ms)
✔ stage, image and quarantine tampering stop handoff before quit (56.085624ms)
✔ only a successfully started exact running app and profile can retire its prior backup (success) (14.89375ms)
✔ only a successfully started exact running app and profile can retire its prior backup (uncertain) (6.032197ms)
✔ only a successfully started exact running app and profile can retire its prior backup (wrong-digest) (3.889198ms)
✔ only a successfully started exact running app and profile can retire its prior backup (wrong-profile) (7.409772ms)
✔ a quit exception waits for the armed helper to close before cleanup and restoration (46.944484ms)
✔ source selection pins only canonical stable higher tags to an immutable commit and process architecture (3.216899ms)
✔ legacy source pinning keeps tag reads and checkout repository together (0.357314ms)
✔ annotated tags are peeled through bounded canonical API reads (0.457089ms)
✔ disposable version stamping changes exactly the package and lock roots, preserving dependencies and identity (17.280246ms)
✔ tool environment excludes launch secrets and injection variables and knows Finder toolchain paths (0.613591ms)
✔ real npm preflight rejects shared config paths and accepts the isolated source environment (271.623691ms)
✔ bounded executor kills timeout, excessive output and cancellation and suppresses raw stderr (120.712043ms)
✔ workspace quota rejects oversized downloads and never follows dependency symlinks (3.601162ms)
✔ bundle verification rejects wrong signature, identity, version, architecture, escaped links and tampering (16.962265ms)
✔ bundle digest uses on-disk ASAR bytes and metadata in Electron and standalone Node (115.026562ms)
✔ only one effective absolute profile argument survives restart, without reading profile files (0.557937ms)
✔ source storage guards reject insufficient build and replacement space before mutation (28.290461ms)
✔ builder fetches exact canonical tag, stamps only checkout, builds process arch and stages before quiescence (19.968381ms)
✔ commit mismatch, build/signature failure, missing tools and cancellation never replace, quit or mutate profile (40.250929ms)
✔ missing helper readiness fails before quit and keeps installed bundle and profile (49.043782ms)
✔ quit happens only after helper ready and armed acknowledgements (46.584842ms)
✔ disposing during helper readiness waits for its exit and never quits or replaces (62.498416ms)
✔ disposing a cancelled ready update removes only its unhanded workspace (15.288886ms)
✔ disposal waits for an aborted build child to close before removing its workspace (107.479329ms)
✔ replacement waits for the original process exit and stops if the original remains alive (305.430506ms)
✔ helper accepts only a private sibling workspace, correct parent and bounded explicit profile (17.182587ms)
✔ failed launcher spawn rolls back before dispatch and retains stage and error receipt (15.163327ms)
✔ staging tamper, signature failure and backup collisions leave the installed app untouched (20.64475ms)
✔ LaunchServices receives the exact promoted bundle and explicit profile without claiming app readiness (33.625359ms)
✔ a failed dispatch retains replacement and backup without a schema-unsafe rollback (34.496605ms)
✔ activation during window destruction never calls a destroyed native window (60.902911ms)
✔ macOS keeps native menus and background activation without a status-bar tray (52.4537ms)
✔ Windows and Linux retain their tray image and background activation (101.52006ms)
✔ first upgrade restarts once, opens saved mail, and later launches without retry (196.722155ms)
✔ default legacy startup retry keeps generated switches before the first terminator (155.120819ms)
✔ already-migrated legacy profile retries with the same explicit profile (192.90708ms)
✔ current collision profile stays current despite a migration marker (102.133525ms)
✔ fresh explicit profile never imports default legacy or development data (102.602948ms)
✔ split, bare and empty profile arguments stop before accessing the saved default profile (476.539433ms)
✔ unavailable encryption stops without retry, metadata or byte changes (291.447597ms)
✔ fresh profile without encryption fails on macOS and Windows without writing a key (93.285871ms)
✔ fresh Linux profile without encryption uses a 0600 local key, warns, and reuses it (151.098846ms)
✔ Linux fallback never replaces a missing key for existing mail or accepts a damaged local key (95.563751ms)
✔ Linux and Windows decrypt failures name the problem instead of a safeStorage error (95.725055ms)
✔ unrecoverable ciphertext retries once and forwards child failure without persisting identity (96.008413ms)
✔ noncanonical and short decrypted keys never open the backend or persist identity (294.013145ms)
✔ missing protected key cannot replace an existing encrypted database key (49.129266ms)
✔ successful canonical key decryption cannot hide an unreadable saved database (143.617178ms)
✔ stale identity metadata cannot force current protected bytes onto legacy Keychain (51.324978ms)
✔ confirmed legacy identity fails closed if Keychain becomes unavailable or changes (49.414368ms)
✔ Windows keeps its current identity and never uses a legacy retry or metadata (102.024151ms)
✔ normal legacy startup relaunches without a supervisor or backend (48.778283ms)
✔ confirmed legacy startup commits current wrapping, preserves originals, and restarts as Emc² (146.961961ms)
✔ recovered default current record selects identity exactly once before ready (51.909768ms)
✔ failed singleton cannot inspect corrupt keys, recover default data or call safeStorage (46.579582ms)
✔ committed malformed stops connected startup without fallback, helper or replacement (51.344616ms)
✔ committed version stops connected startup without fallback, helper or replacement (49.336411ms)
✔ committed digest stops connected startup without fallback, helper or replacement (49.972862ms)
✔ committed wrapper stops connected startup without fallback, helper or replacement (48.551646ms)
✔ committed missing-original stops connected startup without fallback, helper or replacement (50.311972ms)
✔ committed wrong-key-length stops connected startup without fallback, helper or replacement (51.365034ms)
✔ committed noncanonical-key stops connected startup without fallback, helper or replacement (52.115077ms)
✔ legacy migration helperAvailable is sanitized before backend, stdout, stderr or dialog (179.873234ms)
✔ legacy migration helperThrow is sanitized before backend, stdout, stderr or dialog (185.743191ms)
✔ legacy migration helperSetupThrow is sanitized before backend, stdout, stderr or dialog (177.121449ms)
✔ legacy migration helperModuleThrow is sanitized before backend, stdout, stderr or dialog (169.509334ms)
✔ legacy migration rejectHelperReady is sanitized before backend, stdout, stderr or dialog (187.891095ms)
✔ legacy migration spawnFailure is sanitized before backend, stdout, stderr or dialog (100.986152ms)
✔ retained original wrapper and metadata still recover the same key for a legacy reader (98.573808ms)
✔ actual helper accepts one request followed by normal EOF and emits one drained frame (45.029341ms)
✔ direct helper rejects saved-profile before safeStorage, bootstrap or file mutation (40.015051ms)
✔ direct helper rejects symlink before safeStorage, bootstrap or file mutation (38.009286ms)
✔ direct helper rejects duplicate before safeStorage, bootstrap or file mutation (37.787488ms)
✔ direct helper rejects split before safeStorage, bootstrap or file mutation (39.112521ms)
✔ direct helper rejects relative before safeStorage, bootstrap or file mutation (38.45011ms)
✔ direct helper rejects ineffective before safeStorage, bootstrap or file mutation (38.029842ms)
✔ direct helper rejects parent-sibling before safeStorage, bootstrap or file mutation (40.855208ms)
✔ direct helper rejects profile-content before safeStorage, bootstrap or file mutation (39.001435ms)
✔ direct helper rejects permissions before safeStorage, bootstrap or file mutation (38.749379ms)
✔ direct helper rejects nonmac before safeStorage, bootstrap or file mutation (38.55235ms)
✔ actual helper rejects premature private request without output or safeStorage (39.739143ms)
✔ actual helper rejects trailing private request without output or safeStorage (40.598756ms)
✔ actual helper rejects duplicate private request without output or safeStorage (41.804537ms)
✔ actual helper rejects malformed private request without output or safeStorage (42.945909ms)
✔ actual helper rejects utf8 private request without output or safeStorage (40.630233ms)
✔ endpoint copy accepts only the trusted main frame on darwin (54.379319ms)
✔ endpoint copy accepts only the trusted main frame on win32 (50.643611ms)
✔ endpoint copy accepts only the trusted main frame on linux (50.346428ms)
✔ endpoint copy propagates an asynchronous native clipboard failure (50.992189ms)
✔ OpenCode config copy accepts only a valid grant credential from the trusted main frame on darwin (53.617456ms)
✔ OpenCode config copy accepts only a valid grant credential from the trusted main frame on win32 (50.078962ms)
✔ OpenCode config copy accepts only a valid grant credential from the trusted main frame on linux (50.724663ms)
✔ OpenCode config copy propagates an asynchronous native clipboard failure (51.581473ms)
✔ OpenCode setup writes only after a valid grant credential from the trusted main frame on darwin (52.789763ms)
✔ OpenCode setup writes only after a valid grant credential from the trusted main frame on win32 (54.606046ms)
✔ OpenCode setup writes only after a valid grant credential from the trusted main frame on linux (54.518485ms)
✔ caption-control recreation honors draft cancel and rejects untrusted IPC (52.442028ms)
✔ caption-control recreation honors draft accept and rejects untrusted IPC (50.064424ms)
✔ ordinary macOS quit resumes after native unwind and idle updater disposal (62.924436ms)
✔ ordinary macOS quit resumes after native unwind and pending updater disposal (90.852671ms)
✔ mail, update and activation callbacks ignore a destroyed window during async quit disposal (92.294322ms)
✔ Ctrl+Q uses normal quit and preserves draft plain on linux (48.91829ms)
✔ Ctrl+Q uses normal quit and preserves draft cancel on linux (51.182817ms)
✔ Ctrl+Q uses normal quit and preserves draft accept on linux (50.667986ms)
✔ Ctrl+Q uses normal quit and preserves draft plain on darwin (52.793645ms)
✔ Ctrl+Q uses normal quit and preserves draft cancel on darwin (49.462405ms)
✔ Ctrl+Q uses normal quit and preserves draft accept on darwin (50.825829ms)
✔ Ctrl+Q uses normal quit and preserves draft plain on win32 (49.829377ms)
✔ Ctrl+Q uses normal quit and preserves draft cancel on win32 (49.022198ms)
✔ Ctrl+Q uses normal quit and preserves draft accept on win32 (49.593098ms)
✔ ordinary quit holds pending outbox and respects cancel (85.711384ms)
✔ ordinary quit holds pending outbox and respects accept (62.696789ms)
✔ native suspend and resume hold scheduled mail before dispatch (54.776157ms)
✔ carries mail and settings into the renamed folder and leaves the old one behind (2.888441ms)
✔ runs once (1.664805ms)
✔ does not replace data the renamed folder already holds (0.984671ms)
✔ does nothing without a pre-rename folder (0.335194ms)
✔ does nothing when the folders are the same (0.370519ms)
✔ native horizontal swipes use history; vertical gestures retain scrolling (0.988628ms)
✔ desktop only navigates its own UI and hands safe links to the browser (0.43523ms)
✔ notification fields are opt-in, plain, bounded and generic in privacy mode (1.935378ms)
✔ native runtime starts private, revokes visible details, queues exact clicks until ready and preserves choices (2.32902ms)
✔ bounded native chooser persists bytes only, custom sound works before readiness and reset clears it (13.6506ms)
✔ cancelling the native chooser preserves saved audio and muted or system preferences (9.557901ms)
✔ notification IPC rejects wrong senders, frames, origins and renderer file paths (1.151971ms)
✔ large native batches preserve every target and privacy revokes every retained notice (2.165997ms)
✔ preview respects enabled delivery, detail and sound preferences (1.128428ms)
✔ creates a new private config with the exact shared fragment (4.542846ms)
✔ is idempotent and leaves no staged or backup files (2.625822ms)
✔ adds emc2 to an existing JSON config without touching other keys (3.477255ms)
✔ preserves comments and unrelated formatting in JSONC (2.544792ms)
✔ accepts JSONC trailing commas and preserves the existing entries (2.388732ms)
✔ treats an identical emc2 entry as saved without rewriting or confirming (0.658595ms)
✔ cancels a different existing emc2 entry without changing the file (0.682909ms)
✔ replaces a different emc2 entry after confirmation and keeps a private backup (2.328108ms)
✔ refuses malformed JSON without touching the file (0.800549ms)
✔ refuses an array root without touching the file (0.887951ms)
✔ refuses a scalar root without touching the file (0.601168ms)
✔ refuses a non-object mcp without touching the file (0.48916ms)
✔ refuses duplicate mcp keys without touching the file (0.551435ms)
✔ refuses duplicate emc2 keys without touching the file (0.554922ms)
✔ refuses an oversize file without touching the file (3.007381ms)
✔ refuses a symlinked config file (0.498397ms)
✔ refuses a symlinked config directory (0.399453ms)
✔ refuses two config files in the same directory (0.395225ms)
✔ refuses a symlinked config root instead of walking it (0.316368ms)
✔ refuses a directory swapped for a symlink during confirmation (0.714438ms)
✔ refuses a config root swapped for a symlink during confirmation (0.698349ms)
✔ refuses a same-bytes file replaced by a different inode during confirmation (0.650971ms)
✔ refuses a second config file that appears during confirmation (0.632286ms)
✔ defers to manual setup for a custom config path or content (0.225389ms)
✔ refuses a relative XDG_CONFIG_HOME without guessing another directory (0.207276ms)
✔ uses home/.config/opencode when XDG_CONFIG_HOME is unset (1.206813ms)
✔ refuses a file changed after confirmation and never clobbers it (0.957861ms)
✔ aborts without writing when trust revalidation fails (0.328781ms)
✔ refuses to replace a file created after inspection (0.558879ms)
✔ reports a write failure without changing the original (0.917406ms)
✔ rejects an invalid credential before any file work (0.225289ms)
✔ preload navigation bridge validates directions and removes its listener (7.618135ms)
✔ preload update bridge forwards only enum actions and correlates renderer drain without exposing IPC (2.958451ms)
✔ preload endpoint copy forwards no renderer-supplied text or generic clipboard access (3.282964ms)
✔ preload OpenCode copy forwards only the grant credential and no generic clipboard access (2.386578ms)
✔ isolated startup checks omit the updater bridge and perform no updater IPC (2.722892ms)
✔ preload exposes credential fallback mode only for the exact main-process flag (6.314732ms)
✔ notification preload correlates ready clicks and cleans replacement, stopped and ended custom audio (5.27076ms)
✔ preload backup bridge exposes only encrypted save and dialog open (2.179362ms)
✔ only canonical stable, strictly higher versions qualify, including installed CI versions (2.091679ms)
✔ release preflight rejects foreign URLs, CI filenames, missing metadata and wrong or ambiguous architectures (0.787935ms)
✔ releases from the transferred repository qualify, but one release cannot mix owners (2.501561ms)
✔ release filenames survive GitHub upload and match builder architecture names (0.291813ms)
✔ manifest identity, size, digest, source and unsupported metadata are checked before library download (3.674151ms)
✔ running app architecture wins, macOS source builds qualify, and development/non-AppImage installs stay disabled (0.317851ms)
✔ downloaded files must be nonsymlink regular files with matching size and a fresh digest (22.235041ms)
▶ actual downloadUpdate rejects oversized regular and symlink caches before reading installer bytes
  ✔ win32/oversized (145.232286ms)
  ✔ win32/symlink (94.256038ms)
  ✔ linux/oversized (93.097766ms)
  ✔ linux/symlink (89.5819ms)
✔ actual downloadUpdate rejects oversized regular and symlink caches before reading installer bytes (423.572762ms)
✔ actual downloadUpdate reuses verified cache and rehashes same-instance changes (97.363993ms)
✔ actual downloadUpdate ignores cached metadata paths even on a new instance (88.198492ms)
✔ actual downloadUpdate caps cache bytes even when the file grows after the size check (81.738002ms)
▶ actual downloadUpdate cache hashing stops on timeout, explicit cancellation and ordinary stop
  ✔ timeout (188.269179ms)
  ✔ cancel (95.879638ms)
  ✔ stop (89.497254ms)
✔ actual downloadUpdate cache hashing stops on timeout, explicit cancellation and ordinary stop (374.461146ms)
✔ the actual pinned library disables automatic/downgrade paths and checks without staging-ID or network IO (77.494211ms)
▶ actual AppImage replacement preserves both names and bytes before failure recovery, without retry or quit
  ✔ Emc.AppImage/move/collision=false (18.899646ms)
  ✔ Emc.AppImage/launch/collision=false (4.843762ms)
  ✔ Emc.AppImage/success/collision=false (4.016285ms)
  ✔ Emc2-0.1.7-linux-x86_64.AppImage/move/collision=false (3.854634ms)
  ✔ Emc2-0.1.7-linux-x86_64.AppImage/launch/collision=false (4.205473ms)
  ✔ Emc2-0.1.7-linux-x86_64.AppImage/success/collision=false (4.042277ms)
  ✔ Emc2-0.1.6-linux-x86_64.AppImage/move/collision=false (4.412311ms)
  ✔ Emc2-0.1.6-linux-x86_64.AppImage/move/collision=true (4.534503ms)
  ✔ Emc2-0.1.6-linux-x86_64.AppImage/launch/collision=false (4.386282ms)
  ✔ Emc2-0.1.6-linux-x86_64.AppImage/launch/collision=true (4.944182ms)
  ✔ Emc2-0.1.6-linux-x86_64.AppImage/success/collision=false (3.998001ms)
  ✔ Emc2-0.1.6-linux-x86_64.AppImage/success/collision=true (4.726295ms)
✔ actual AppImage replacement preserves both names and bytes before failure recovery, without retry or quit (140.665803ms)
▶ actual Electron download adapter bounds headerless streams before disk and keeps digest/progress checks
  ✔ headerless-oversize (21.074269ms)
  ✔ headerless-cross-boundary (2.80316ms)
  ✔ headerless-exact (2.005778ms)
  ✔ headerless-wrong-digest (2.01776ms)
  ✔ headerless-short (1.626593ms)
  ✔ with-content-length (2.139466ms)
✔ actual Electron download adapter bounds headerless streams before disk and keeps digest/progress checks (101.678197ms)
✔ actual Electron download adapter aborts once when cancelled before response headers (80.870775ms)
✔ checks prefer the collection-of-things repository and fall back to the original one (1.480411ms)
✔ preferred manifest read failure falls back to a fully validated original-source candidate (0.926753ms)
✔ preferred manifest malformed manifest falls back to a fully validated original-source candidate (0.89875ms)
✔ preferred manifest version mismatch falls back to a fully validated original-source candidate (0.507013ms)
✔ preferred manifest foreign source falls back to a fully validated original-source candidate (0.557847ms)
✔ preferred manifest size mismatch falls back to a fully validated original-source candidate (0.550292ms)
✔ preferred manifest invalid SHA512 falls back to a fully validated original-source candidate (0.566653ms)
✔ both sources' manifest read failure preserves the final failure state without creating an updater (0.440538ms)
✔ both sources' manifest malformed manifest preserves the final failure state without creating an updater (0.701774ms)
✔ both sources' manifest invalid manifest preserves the final failure state without creating an updater (0.418888ms)
✔ synthetic flow protects duplicate actions and reports progress, then drains and rehashes after accepted close (0.917826ms)
✔ draft/sendUnknown close cancellation resumes mail and does not invoke installer (0.531619ms)
✔ drain/renderer errors resume without closing, and a changed installer restores the closed window (1.742919ms)
✔ an installer launch rejection restores the window and resumes mail without a retry (0.579938ms)
✔ bounded download cancels once; unsupported builds and ordinary stop never install (6.222325ms)
✔ download size overruns cancel once and never expose a ready installer (0.87116ms)
✔ macOS binary download finishes before mail drain and preserves cancellation and restoration (1.905181ms)
✔ macOS binary selection does not fall back to an older repository or source build (0.243502ms)
✔ update IPC authenticates the main renderer frame and accepts only a command enum with no extra arguments (0.890445ms)
✔ macOS selects the published DMG and checksums without requesting source tags (0.418258ms)
✔ window controls default to the drawn lights and round-trip the system buttons (2.04314ms)
✔ caption colors and native menu items are checked before they reach Electron (1.187908ms)
✔ native mail menu positions accept only bounded integer window coordinates (0.273237ms)
✔ backup file bridge bounds reads, saves private files, and rejects foreign senders (131.486369ms)
✔ only the budgeted CI and release workflows remain (2.338646ms)
✔ manual release requires an existing stable tag at the immutable build commit (66.186288ms)
✔ every platform tests and packages with its existing architecture and runner (0.675015ms)
✔ failed workflow or tag checks fail the required Linux job before checkout (3.166155ms)
✔ release checks retain pinned actions, Node and checksum-verified actionlint (0.589426ms)
✔ installer steps preserve unpublished builds and updater integrity before upload (0.644598ms)
✔ publication needs all four successful builds and validates artifacts before publishing (0.474502ms)
✔ release notes come from CHANGELOG.md before tagging or publishing (0.347505ms)
✔ browser build identity is stable, embedded and changes with its asset references (15.038651ms)
✔ managed browser drains before closing and ignores repeated stop signals (1.808742ms)
✔ failed drain resumes admission without closing or exiting (0.432925ms)
✔ browser development server denies private files including /@fs access (120.588856ms)
✔ noreply authors, committers and co-authors pass (1.806367ms)
✔ personal and lookalike addresses in any role are reported (0.560922ms)
✔ release check validates windows-x64 output and rejects missing metadata and damaged bytes (560.079076ms)
✔ release check validates linux-x64 output and rejects missing metadata and damaged bytes (459.004652ms)
✔ help, validation and private input fail before connecting without echoing arguments (5.9078ms)
✔ linked package entrypoint runs help (217.269255ms)
✔ CLI uses the real authenticated MCP contract with isolated synthetic encrypted mail (2127.308646ms)
✔ feature detection, pending proposals, rejection, token redaction and uncertain action never retry (39.237827ms)
✔ redirects never reach the destination with bearer authentication (5.191288ms)
✔ work and draft validation rejects unsafe input before connecting and does not echo content (51.770321ms)
✔ feature-detected work commands preserve caller UUID, scoped reads, immediate saves and draft proposals (102.804242ms)
✔ explicit views and replies require a valid versioned contract; old commands keep working (307.704131ms)
✔ pairing client clears the fragment before its first request and sends it only in the POST body (120.070024ms)
✔ invalid invitations do not make requests or offer registration (12.963203ms)
✔ phone-initiated setup recovers an expired page and waits for host approval (17.022829ms)
✔ complete release set produces exact deterministic SHA256SUMS with six entries (21.220391ms)
✔ rejects missing Emc2-1.2.3-win-x64.exe before creating checksums (3.316381ms)
✔ rejects empty Emc2-1.2.3-win-x64.exe (4.274525ms)
✔ rejects directory named Emc2-1.2.3-win-x64.exe (3.358452ms)
✔ rejects missing Emc2-1.2.3-mac-arm64.dmg before creating checksums (2.671878ms)
✔ rejects empty Emc2-1.2.3-mac-arm64.dmg (2.544699ms)
✔ rejects directory named Emc2-1.2.3-mac-arm64.dmg (2.483506ms)
✔ rejects missing Emc2-1.2.3-mac-x64.dmg before creating checksums (2.197344ms)
✔ rejects empty Emc2-1.2.3-mac-x64.dmg (2.307789ms)
✔ rejects directory named Emc2-1.2.3-mac-x64.dmg (2.855457ms)
✔ rejects missing Emc2-1.2.3-linux-x86_64.AppImage before creating checksums (2.484117ms)
✔ rejects empty Emc2-1.2.3-linux-x86_64.AppImage (2.401673ms)
✔ rejects directory named Emc2-1.2.3-linux-x86_64.AppImage (2.41558ms)
✔ rejects missing latest.yml before creating checksums (2.139947ms)
✔ rejects empty latest.yml (2.810476ms)
✔ rejects directory named latest.yml (4.693112ms)
✔ rejects missing latest-linux.yml before creating checksums (1.988846ms)
✔ rejects empty latest-linux.yml (2.043979ms)
✔ rejects directory named latest-linux.yml (3.00224ms)
✔ rejects mismatched filename Emc2-1.2.4-win-x64.exe (1.84535ms)
✔ rejects mismatched filename Emc2-1.2.3-win-arm64.exe (1.708506ms)
✔ rejects mismatched filename Emc2-1.2.3-linux-x64.AppImage (1.715579ms)
✔ rejects mismatched filename Emc2-1.2.3-mac-universal.dmg (2.09804ms)
✔ rejects unexpected asset extra.exe (2.142512ms)
✔ rejects unexpected asset Emc2-1.2.3-mac-arm64.zip (2.047866ms)
✔ rejects unexpected asset latest-mac.yml (2.274057ms)
✔ rejects unexpected asset .hidden (3.151177ms)
✔ rejects symbolic links without following or overwriting their targets (6.803785ms)
✔ retry replaces stale checksums and remains byte-for-byte deterministic (16.561281ms)
✔ failed retry preserves the existing checksums (2.23787ms)
✔ accepts only exact stable versions (0.470485ms)
✔ CLI accepts directory and version and fails closed on invalid inputs (242.199535ms)
✔ release notes use the exact CHANGELOG version section (1.475332ms)
✔ manual releases require their section; push releases may use Unreleased (2.015596ms)
✔ every dated CHANGELOG section produces release notes (35.117906ms)
✔ automatic full-run retry reuses its lightweight tag at the source commit (313.633686ms)
✔ automatic full-run retry reuses its annotated tag at the source commit (303.737789ms)
✔ automatic build-job retry reuses its lightweight tag at the source commit (224.742168ms)
✔ automatic build-job retry reuses its annotated tag at the source commit (218.964137ms)
✔ automatic stamping rejects a different source commit before writing (64.705165ms)
✔ tags on another commit advance selection and cannot authorize an older build version (165.25804ms)
✔ manual builds still reject automatic tags whose version differs from source (63.374855ms)
✔ CI versions change with each run and rerun; releases match their tag (1.472116ms)
✔ reusable release builds use the checked-out tag instead of the caller's branch (0.729195ms)
✔ automatic releases select the next patch above both source version and stable tags (1.89902ms)
✔ automatic retries reuse only newer stable source tags, choosing the highest numerically (0.28468ms)
✔ automatic CLI stamps the selected version and rejects invalid input before writes (190.792258ms)
✔ CLI updates both lockfile versions and native build metadata without changing dependencies (105.633261ms)
✔ macOS packaging signs only ad hoc without discovering certificates or profiles (587.333883ms)
✔ the signing hook leaves other platforms untouched and propagates failure (1.018143ms)
✔ only published stable releases qualify, with monotonic numeric versions (2.359535ms)
✔ verified deployment switches current and retains previous (17.949312ms)
✔ failed build leaves service untouched and requires an explicit retry (9.980088ms)
✔ failed drain leaves current unchanged and never starts replacement (6.880488ms)
✔ failed revision check restores the previous service and pointers (7.592408ms)
✔ failed rollback preserves an interrupted-switch record and blocks updates (16.976734ms)
✔ automatic updates never downgrade and reject moved installed tags (6.074494ms)
✔ incompatible profile formats block activation (5.427949ms)
✔ manual rollback suppresses automatic redeployment of the same release (11.151543ms)
✔ concurrent runs and unsafe pointers are rejected before service actions (4.663287ms)
✔ probe accepts only the requested revision from the protected browser gate (279.752742ms)
✔ synthetic service processes switch and roll back using actual HTTP revision probes (148.838732ms)
✔ empty deployments bootstrap without touching an existing profile (4.450962ms)
✔ published automatic release stamps its isolated source and lock roots before deployment (10.020795ms)
✔ real managed browser starts with a synthetic encrypted profile, rejects unauthenticated API reads and drains (1705.200553ms)
✔ download totals include all desktop installers and keep the last complete count on failure (25.21784ms)
✔ parseRelease maps the four installers and validates assets (1.758228ms)
✔ installerFor picks the right installer for each platform (1.058207ms)
▶ account names stay local and survive reconnect, sync and restart
  ✔ trim, save, clear and maximum length preserve all other fields without provider work (43.591099ms)
  ✔ invalid input, unknown accounts and authentication/CSRF boundaries never write (52.889931ms)
  ✔ rename and clear during successful sync survive status writes (14.093173ms)
  ✔ rename and clear during failed sync survive status writes (9.548768ms)
  ✔ IMAP reconnect finishing after rename uses the latest name and retains identity and sync history (11.514523ms)
  ✔ OAuth reconnect preserves a concurrent rename and replaces refresh credentials (14.800642ms)
  ✔ OAuth reconnect preserves a concurrent clear and retains refresh credentials (11.888189ms)
  ✔ a fresh service process reads the name from the encrypted store without exposing credentials (1120.119991ms)
✔ account names stay local and survive reconnect, sync and restart (1946.166566ms)
▶ BYOK settings and reviewed drafts preserve provider, account and evidence boundaries
  ✔ key storage is encrypted, settings are sanitized, endpoint changes require a fresh key (116.829951ms)
  ✔ HTTPS destination and credential validation fail before fetch (69.247942ms)
  ✔ openai compatible contract sends one selected email and creates only a pending proposal (41.430624ms)
  ✔ deepseek compatible contract sends one selected email and creates only a pending proposal (24.833381ms)
  ✔ provider content cannot control recipient, account or action; prompt and output have limits (19.339429ms)
  ✔ connector receives every validated address when requested (0.336295ms)
  ✔ stalled DNS times out and releases the in-flight guard (21.968336ms)
  ✔ mixed public and private DNS answers are rejected (14.408272ms)
  ✔ provider failures remain generic and never create proposals (55.590746ms)
  ✔ forbidden account, tool, missing source and invalid reply address refuse before fetch (32.496277ms)
  ✔ revoke while provider is pending prevents a stale proposal and duplicate calls (19.129769ms)
  ✔ delete-source while provider is pending prevents a stale proposal and duplicate calls (15.562729ms)
  ✔ source while provider is pending prevents a stale proposal and duplicate calls (15.368558ms)
  ✔ preview while provider is pending prevents a stale proposal and duplicate calls (24.685537ms)
  ✔ neighbor while provider is pending prevents a stale proposal and duplicate calls (15.36396ms)
  ✔ config while provider is pending prevents a stale proposal and duplicate calls (15.607743ms)
  ✔ remove-config while provider is pending prevents a stale proposal and duplicate calls (15.63812ms)
  ✔ account while provider is pending prevents a stale proposal and duplicate calls (12.896573ms)
  ✔ permission while provider is pending prevents a stale proposal and duplicate calls (15.025721ms)
✔ BYOK settings and reviewed drafts preserve provider, account and evidence boundaries (1120.93673ms)
✔ busy attachment admission fails before submission and releases scheduled holds (624.164217ms)
✔ backup preserves uploaded draft bytes without exporting device references or outbox actions (1766.086332ms)
▶ practical encrypted attachment envelope
  ✔ 20 files near 25 MiB, mixed sizes, and oversize validation (1139.595591ms)
  ✔ encrypted draft round-trip, cross-account refusal and opaque outbox retention (174.903883ms)
  ✔ interrupted, cancelled and oversized streams remove partial encrypted chunks (3.627584ms)
  ✔ SMTP SIZE is rejected on submission connection before MAIL or DATA (24.470617ms)
  ✔ legacy inline draft still sends; referenced SMTP send streams and preserves accepted outcome (76.195755ms)
  ✔ referenced IMAP-account send saves the exact streamed message to Sent (70.447755ms)
  ✔ streamed SMTP preserves partial recipient warnings and rejects zero acceptance (12.853144ms)
  ✔ Gmail streams base64url JSON without collecting the message (1.409149ms)
  ✔ large Gmail metadata and explicit single-part encrypted download (33.099404ms)
  ✔ IMAP checks UIDVALIDITY, fetches only requested part and cancels transport (12.932008ms)
  ✔ large IMAP messages import only envelope and part metadata (10.908938ms)
  ✔ raw upload endpoint inherits desktop, origin and CSRF checks; other JSON stays tight (536.868821ms)
✔ practical encrypted attachment envelope (2206.913501ms)
✔ oversized parts do not consume the byte or file budget for later valid imports (685.815528ms)
✔ real outbox transitions retain uploaded bytes and distinguish preflight rejection from uncertainty (610.247967ms)
✔ incomplete uploads reserve admission capacity until completed or erased (61.070591ms)
✔ favicon requests coalesce and isolate memory by data directory (49.749113ms)
✔ oversized streamed favicons cancel and preserve the previous expired disk cache (3.678858ms)
✔ invalid cached image metadata is unavailable and never trusted (1.397357ms)
✔ bootstrap is authenticated, scan-free and independent of corrupt mail (548.690483ms)
✔ browser startup rejects missing secrets, unsafe roots, symlinks and desktop profiles (3.817014ms)
✔ invalid browser entrypoint stops before any storage access (574.37015ms)
✔ browser gate protects reads, writes and assets, with origin checks, rotation, lock and expiry (555.099397ms)
✔ tailnet sessions use Secure host cookies, bind origins and cannot revive after proof expiry (42.937594ms)
✔ only admitted browsers receive the current public build identity without caching (72.737842ms)
✔ public access pages load their own styling and distinguish phone setup from local recovery (43.993146ms)
✔ automatic key bootstrap persists once, reads back and reuses exactly the same OS credential (3.708212ms)
✔ unavailable, malformed, or lost keys never fall back or replace storage keys (2.401684ms)
✔ concurrent bootstrap cannot overwrite the first key and interrupted creation recovers without replacement (2.142803ms)
✔ the browser target requires its expiring gate session before serving /api (1265.641223ms)
✔ paired browser trust survives idle, restart and route recovery until explicit lock or device removal (132.756864ms)
✔ bounded sequential batches preserve per-item success, failure and uncertainty without retry (1075.308955ms)
✔ explicit Google writes use deterministic identity, exact notification payloads and safe unknown reconciliation (447.020276ms)
▶ Emc² calendar events are encrypted, validated, revisioned and range-bounded
  ✔ clearing an omitted Meet link survives reload and later invitation preparation (22.034848ms)
  ✔ a source requires its receiving account even when No account is chosen (2.597017ms)
  ✔ an unavailable source retains its original account (none) (3.208253ms)
  ✔ an unavailable source retains its original account (b) (3.013451ms)
✔ Emc² calendar events are encrypted, validated, revisioned and range-bounded (681.804608ms)
✔ send requires one to 100 To recipients and accepts Bcc (6.737935ms)
✔ connection settings preserve other config and reject line injection (1031.877756ms)
✔ an inherited effective provider keeps its saved key (107.638127ms)
▶ empty and missing configuration accept both parser prototypes
  ✔ ordinary, missing (103.979501ms)
  ✔ ordinary, empty (104.636159ms)
  ✔ null, missing (99.67089ms)
  ✔ null, empty (98.717155ms)
✔ empty and missing configuration accept both parser prototypes (408.514734ms)
✔ encrypted settings migrate, retain launch precedence and recover after failed plaintext cleanup (ordinary parser) (305.375153ms)
✔ encrypted settings migrate, retain launch precedence and recover after failed plaintext cleanup (null parser) (312.747242ms)
✔ settings write and readback failures retain legacy plaintext and prior durable settings (ordinary parser) (207.320682ms)
✔ settings write and readback failures retain legacy plaintext and prior durable settings (null parser) (196.902795ms)
✔ an inherited credential cannot follow a saved provider change (98.309199ms)
✔ Google CSV accepts BOM, quoted names, multiple emails and skips repeated or invalid addresses (3.554046ms)
✔ Yahoo and Outlook CSV headers produce names and supported email columns (0.727162ms)
✔ vCard supports Apple grouped properties, folded UTF-8 names, escaped separators and multiple emails (0.866ms)
✔ malformed, binary, oversized and encoded imports fail closed (7.83301ms)
▶ local contacts: encrypted account-scoped storage, sent recipients and suggestions
  ✔ saved contacts are created, edited and deleted only through authenticated routes (52.03065ms)
  ✔ imports preview without writes, deduplicate per account, and retain existing names (52.388321ms)
  ✔ only accepted sends add recent recipients, excluding connected accounts (11.967589ms)
  ✔ suggestions rank saved contacts first and the sending account before others (12.576172ms)
  ✔ recent recipients keep the newest 200 per account (596.663218ms)
  ✔ contacts are encrypted at rest and readable after a restart (299.628131ms)
  ✔ disconnecting an account removes its contacts and recipients (8.95433ms)
✔ local contacts: encrypted account-scoped storage, sent recipients and suggestions (1585.676748ms)
✔ conversation membership preserves transitive references and separates account and token spaces (1.898899ms)
✔ indexed membership equals the original rule across deterministic mixed graphs and multiple sources (19.369645ms)
✔ conversation hydration decodes only related mail and preserves coherent body snapshots (797.901277ms)
▶ draft deletion avoids unrelated cache reads and leaves safe upload cleanup to maintenance
  ✔ deletion does not decrypt unrelated cached mail (8.543757ms)
  ✔ maintenance reclaims discarded uploads and preserves shared references, holds and grace (19.801958ms)
✔ draft deletion avoids unrelated cache reads and leaves safe upload cleanup to maintenance (589.558544ms)
▶ encrypted drafts: authenticated lifecycle, stale writes, sync and update guards
  ✔ legacy single-To records normalize without rewriting; all recipient arrays persist (33.619018ms)
  ✔ formatted alternatives are exact, encrypted and survive revisions (32.668828ms)
  ✔ session, Host, origin, CSRF and strict validation precede persistence (44.489595ms)
  ✔ incomplete reply fields round-trip; lists expose only bounded summaries; no provider calls (19.432181ms)
  ✔ same-revision saves have one winner; stale save/delete cannot replace acknowledged data (34.201046ms)
  ✔ lost acknowledgement of uncertainty stays sticky through later edits and explicit deletion (20.025774ms)
  ✔ account removal purges its drafts and signature while preserving the other account and templates (21.11028ms)
  ✔ draft save/create/delete work during sync; account mutation remains guarded; updater blocks all draft writes (26.753005ms)
  ✔ bounded creation refuses overflow without eviction; deleting frees a slot (136.856378ms)
✔ encrypted drafts: authenticated lifecycle, stale writes, sync and update guards (933.328225ms)
✔ drafts reopen with the same key after graceful exit and hard process crash (3992.198556ms)
✔ CID mail retains short HTML and encrypted message-bound image metadata (45.58727ms)
▶ provider evidence: bounded Sent, exact threads and encrypted attachment roundtrip
  ✔ Gmail Sent is independent, bounded, and keeps provider thread identity (21.989853ms)
  ✔ Gmail thread refuses more than 100 messages (1.515657ms)
  ✔ Gmail thread includes received and Sent with exact reference identity (10.395483ms)
  ✔ Gmail repeated page token fails instead of looping (0.599674ms)
  ✔ IMAP Sent requires a unique declared folder, qualifies equal Inbox UIDs and rejects mutations (10.642712ms)
  ✔ attachment bytes stay encrypted and account scoped (5.752792ms)
  ✔ oversize incoming attachments remain visible without encoding or saving their bytes (28.083557ms)
  ✔ attachments beyond the byte import count remain visible as unavailable (45.083453ms)
  ✔ account removal or replacement during parsing cannot recreate encrypted attachment bytes (9.035844ms)
  ✔ Gmail and SMTP MIME include Cc and exact attachment bytes, same bytes saved to Sent (12.059765ms)
  ✔ malformed and oversize attachment inputs fail before provider calls (35.357096ms)
✔ provider evidence: bounded Sent, exact threads and encrypted attachment roundtrip (343.861373ms)
✔ forward uses cached plain text, local bounded attachments and explicit omissions without threading (1243.990469ms)
▶ global service searches saved drafts, invalidates saves, yields and cancels
  ✔ draft-only profile searches the full body and returns a typed summary (4.252844ms)
  ✔ draft field/date/account semantics reuse the compiler and reject all read/pin predicates (6.105598ms)
  ✔ same IDs remain distinct and unchanged inputs reuse scans, not draft bodies (6.88671ms)
  ✔ mail metadata remains in its captured snapshot across updates and deletion (28.750614ms)
  ✔ more than 256 draft records yield, hold a snapshot and cancel before decoding the rest (78.478622ms)
✔ global service searches saved drafts, invalidates saves, yields and cancels (130.939989ms)
✔ service Gmail polls persist arrivals, emit changes, and stop for updater drain/removal/shutdown (491.432331ms)
✔ Gmail revision request is bounded, minimal and validates the returned marker (1.230988ms)
✔ 15-second revision polling skips unchanged inboxes and never overlaps pending sync (0.886117ms)
✔ failed sync retains the marker for retry; provider failures back off, and recovery restores cadence (1.137354ms)
✔ replacement, removal and shutdown discard late Gmail responses and cancel timers (0.9795ms)
▶ Gmail labels and ordered read-on-open requests use synthetic provider data
  ✔ sync stores names and label IDs for cached and fresh messages without account collisions (53.729374ms)
  ✔ editing changes only this account's custom labels and rejects system/foreign labels (31.462086ms)
  ✔ read queued during sync runs afterward, remains read on next sync and retries provider failures (23.342665ms)
  ✔ disconnect removes only the account's label cache (3.974226ms)
✔ Gmail labels and ordered read-on-open requests use synthetic provider data (650.597084ms)
▶ optional Google Calendar OAuth, bounded provider reads and isolated encrypted window replacement
  ✔ cache-only reads, explicit account consent and fail-closed ordinary reconnect (99.79945ms)
  ✔ pagination, plain text, limits, account identity, no remote writes and encrypted cache (31.720585ms)
  ✔ failure retains stale cache, deleted/empty results replace only their requested window (29.547728ms)
  ✔ explicit sync defers maintenance, resets idle on completion and participates in update drain (19.295303ms)
  ✔ selection is account-bound, local-only and invalidates in-flight reads; removal cleans up (17.11494ms)
✔ optional Google Calendar OAuth, bounded provider reads and isolated encrypted window replacement (733.075055ms)
✔ REQUEST roundtrip preserves caller UID, sequence, identities and optional fields (9.207944ms)
✔ all-day ends remain exclusive, including leap dates and month boundaries (2.941016ms)
✔ timed dates reject rollover, leap seconds, missing zones and lost precision (2.463198ms)
✔ IANA dates resolve independently of the machine timezone (100.827711ms)
✔ DST gaps, overlaps and unsupported timezones fail closed (62.198704ms)
✔ recurrence, duration and unrepresentable components never become single events (0.757658ms)
✔ RFC5545 text escaping roundtrips punctuation, Unicode and notes newlines (1.491873ms)
✔ folding counts UTF-8 octets, preserves code points and counts the continuation space (2.211049ms)
✔ REPLY includes only the explicitly identified attendee and their PARTSTAT (2.163411ms)
✔ CANCEL preserves identity and revision and requires cancellation status (0.78008ms)
✔ mailboxes, properties and controls cannot inject headers or calendar lines (5.65489ms)
✔ bounded input, physical/unfolded lines, folds and attendee counts reject overload (4.662215ms)
✔ IMAP read uses inbox UIDs or a confirmed archive binding without opening a real connection (106.873608ms)
✔ protocol search budgets apply before compact range expansion (7.701745ms)
✔ watch identity, selection, bounded reconnect and periodic recovery use synthetic IO (14.018375ms)
✔ pending watch replacement and connection/selection rejection cannot revive stale clients (1.358215ms)
▶ IMAP live service journey: import, arrival/read, isolation, bursts, failures and lifecycle
  ✔ first import suppresses arrivals; watches both IMAP transports, API stays polling (171.678869ms)
  ✔ post-import arrival reaches callback once; flags refresh only A and expunge archives (675.417516ms)
  ✔ events during active sync coalesce one follow-up; max two accounts and reads stay serialized (217.364961ms)
  ✔ periodic sync keeps existing watches and polls Gmail API (8.022611ms)
  ✔ partial failures retain cache without notification; duplicate batches count once (210.864558ms)
  ✔ replacement drops old connection and late cache writes; removal and shutdown stop events (518.432933ms)
✔ IMAP live service journey: import, arrival/read, isolation, bursts, failures and lifecycle (2336.812098ms)
✔ codes, security notices, support threads and replies stay in Primary over Gmail's category (1.805406ms)
✔ Gmail categories, AI reasons and sender patterns choose the other tabs (1.569968ms)
✔ a Teach rule marking the sender important pins it to Primary (0.280512ms)
✔ live tabs use account conditions, exclusions and the same rule precedence as sorting (0.272286ms)
✔ reader Google RSVP rejects wrong and stale sources, binds saved requests and reconciles without another write (648.615442ms)
✔ reviewed calendar drafts preserve MIME, identity, revisions, idempotency and encrypted recovery (743.890362ms)
✔ a Jev answer becomes a classification (6.700363ms)
✔ a fractional score rounds to a relevance level (0.437944ms)
✔ the provider picks the endpoint and model, and both can be overridden (2.909618ms)
✔ sender rules still outrank Jev, and an unreadable answer falls back (0.729866ms)
✔ a rejected key and a rejected request are reported (0.838308ms)
✔ without a key the heuristics run and nothing is sent (0.426322ms)
✔ remote plaintext classification endpoints never receive credentials (0.432093ms)
▶ cached reader and startup HTTP avoid whole-mailbox body and transport work
  ✔ real state route negotiates the existing bounded compressed writer (15.640274ms)
  ✔ real conversation route hydrates related bodies only (5.188462ms)
✔ cached reader and startup HTTP avoid whole-mailbox body and transport work (609.056424ms)
✔ local Undo binds exact identities and row versions, rejects tampering and never contacts providers (1214.321135ms)
✔ a sender domain is normalised before it is matched (1.424527ms)
✔ a registrable domain keeps a two-part suffix (0.244224ms)
✔ the brand's own host beats every other entry on that host (0.212625ms)
✔ a subdomain reaches the brand through its registrable domain (0.178943ms)
✔ the subdomain's own label is never read as the brand (0.15054ms)
✔ a name match falls back to slug, then alias, then title (0.251237ms)
✔ free mail hosts and unknown domains resolve to nothing (0.237652ms)
✔ a variant the entry lists is preferred, in colour first (0.203107ms)
✔ an unreadable registry falls back instead of failing (1.952588ms)
✔ a known brand is fetched once and then served from disk (27.326581ms)
✔ a scan reports what it found, missed and could not fetch (2.26528ms)
✔ a scan of nothing is not an error (0.151021ms)
✔ parallel requests for one SVG share the registry and download (15.155656ms)
✔ oversized chunked SVGs are cancelled and reported as failed (3.312275ms)
✔ registry metadata cannot inject icon path components (0.298234ms)
✔ a rejected SVG refresh preserves the expired image on disk (1.949172ms)
✔ bounded source preserves exact decoded HTML and treats absent or oversized HTML as null (1.258839ms)
✔ parser preserves sender structure and drops active content, attributes and global CSS (2.672857ms)
✔ input, nodes and depth are bounded before React traversal (9.031443ms)
✔ inline style grammar retains bounded sender presentation and rejects resource or escape values (1.880815ms)
✔ links use explicit HTTP schemes and privacy catches encoded tokens, malformed UTF-8 and nested encoding (0.799455ms)
✔ inline style grammar keeps sender layout modes and floats but never hides content (0.731289ms)
✔ inline style grammar accepts !important declarations, which newsletters use throughout (0.314154ms)
✔ newsletter-depth tables parse instead of falling back to plain text (0.568055ms)
✔ zero dimensions are dropped so hidden preview text reads as one line, not one letter per line (0.297442ms)
✔ compressed preheaders are shown at readable default dimensions (0.454805ms)
✔ small max-heights remain valid image caps (0.192618ms)
✔ inline style grammar reads Gmail quote insets, any-order borders and centered columns (0.400023ms)
✔ only older image metadata needs embedded content recovery (0.750044ms)
✔ malformed image markup and border functions stay bounded (3.816282ms)
✔ local mail features persist encrypted preferences and pins without provider mutations (727.848327ms)
✔ coherent yielding reads, delta/removal transport, rollback and fresh objects (1822.389423ms)
ℹ tests 1
ℹ suites 0
ℹ pass 1
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 2053.486358
✔ pending warm reads capture the current external-write generation and account scope (368.447885ms)
ℹ tests 1
ℹ suites 0
ℹ pass 1
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 498.160541
{"cold":false,"decodedAtClose":96,"abandonedDecoded":96,"liveDecoded":513}
✔ a disconnected summary copy stops while another request receives a complete coherent snapshot (1346.38988ms)
ℹ tests 1
ℹ suites 0
ℹ pass 1
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 1509.521579
{"cold":true,"decodedAtClose":0,"abandonedDecoded":0,"liveDecoded":513}
✔ a disconnected summary copy stops while another request receives a complete coherent snapshot (1358.464068ms)
ℹ tests 1
ℹ suites 0
ℹ pass 1
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 1542.829516
✔ encrypted mail materialization: contracts (2097.032257ms)
✔ encrypted mail materialization: external-write-race (536.331333ms)
✔ encrypted mail materialization: state-disconnect (1548.045878ms)
✔ encrypted mail materialization: state-disconnect-cold (1585.275315ms)
▶ MCP HTTP authentication, tools and shared mail operations
  ✔ off by default and settings require desktop token and CSRF (34.900794ms)
  ✔ bearer token required; browser origins and foreign hosts rejected (51.591172ms)
  ✔ legacy token has no ambient accounts; grants scope tools, account redaction, filters and search (69.321393ms)
  ✔ connection status stays current without identities; cached views filter inside grants before paging (130.078771ms)
  ✔ local work requires separate grants and preserves account, creation and retry boundaries (178.604916ms)
  ✔ read defaults to no mutation; markRead and archive only create approval proposals (26.674865ms)
  ✔ reply remains an exact immutable proposal and approval saves an editable draft without sending (25.892962ms)
  ✔ draft proposal review preserves recipient arrays and Bcc without sending (10.692281ms)
  ✔ reply proposals on Sent use original recipients instead of the account itself (6.290461ms)
  ✔ approved reply is saved as a draft; token rotation and disable revoke access (18.748023ms)
✔ MCP HTTP authentication, tools and shared mail operations (1132.573484ms)
✔ MIME stores bounded original HTML without changing text or requiring a schema migration (51.235912ms)
✔ Gmail recovers one stable raw message, including archived mail, without downloading cached sync content (5.318795ms)
✔ IMAP content recovery refuses archives before connecting and verifies UIDVALIDITY and Message-ID (11.98821ms)
▶ content API authenticates, caches encrypted content and preserves concurrent image and mail updates
  ✔ old embedded image imports recover HTML and CID metadata once without changing mail state (12.672231ms)
  ✔ read completion preserves content cached during its provider wait (18.881301ms)
  ✔ archive completion preserves content cached during its provider wait (8.660866ms)
  ✔ content recovery preserves state and image metadata written while source fetch waits (4.147518ms)
  ✔ overlapping image API and content recovery keep the first cached image result (5.384588ms)
  ✔ content completion refuses a removed record (3.517388ms)
  ✔ content completion refuses a identity record (3.012549ms)
✔ content API authenticates, caches encrypted content and preserves concurrent image and mail updates (597.261327ms)
✔ MIME parsing keeps text and extracts bounded safe metadata alongside HTML source (56.393806ms)
✔ Gmail skips cached bodies and loads exactly one stable ID on demand, including archives (5.076498ms)
✔ IMAP refuses archived or changed UIDs and checks the requested source identity (11.386662ms)
▶ image API protects access, caches one message and preserves concurrent mail actions and text
  ✔ read completion preserves images cached during the provider wait (20.077033ms)
  ✔ archive completion preserves images cached during the provider wait (7.433825ms)
  ✔ a pending mail action does not recreate a removed message (2.320903ms)
✔ image API protects access, caches one message and preserves concurrent mail actions and text (558.437792ms)
▶ a background sync reports new unread mail once per run
  ✔ delta state carries exact arrivals even when no mail bodies changed (8.24209ms)
  ✔ disconnect prunes removed account details without renumbering surviving arrivals (17.795495ms)
  ✔ failed Trash retains its arrival; successful API Trash prunes only its exact record (11.328012ms)
  ✔ shared Trash prunes arrivals and later sync keeps the cumulative sequence (12.391186ms)
✔ a background sync reports new unread mail once per run (1207.794557ms)
▶ offers use encrypted settings, complete explicit Google reads, reviewed replies and replay-safe local booking
  ▶ empty offer context skips mailbox reads while preserving source validation
    ✔ no saved offers (12.87754ms)
    ✔ only another account (6.160803ms)
    ✔ only another recipient (5.451937ms)
    ✔ invalid source and query still reject before mailbox reads (27.584228ms)
  ✔ empty offer context skips mailbox reads while preserving source validation (57.344278ms)
  ✔ saved offer context retains conversation filtering, ordering and booked events (28.074253ms)
  ✔ separate OAuth access proofs and no implicit busy reads (48.728965ms)
  ✔ every included calendar must succeed with bounded sanitized data (49.585185ms)
  ✔ freebusy must confirm the exact expanded request window before check or booking (47.042052ms)
  ✔ chosen-zone all-day boundaries are exclusive across DST and date-line offsets (8.539543ms)
  ✔ ordinary reviewed replies replay atomically and bind source/account/thread (68.17261ms)
  ✔ booking rechecks local/provider busy and never treats failed data as free (51.873466ms)
✔ offers use encrypted settings, complete explicit Google reads, reviewed replies and replay-safe local booking (901.996946ms)
✔ offered reply times name both endpoint dates, numeric offsets and the saved IANA zone (0.785729ms)
✔ on-demand cached mail contracts in a fresh encrypted store (1528.761166ms)
✔ persisted summaries avoid body decryption after process restart (343.339734ms)
▶ account onboarding keeps transport identities and Gmail mailbox semantics
  ✔ Gmail and Workspace use fixed TLS hosts and normalize only Google grouping spaces (38.591574ms)
  ✔ rejects malformed Google app passwords before any connection and keeps API guards (10.04578ms)
  ✔ same transport reconnect preserves account and cached mail identities (11.613645ms)
  ✔ Google sign-in starts only from the desktop session with capped single-use values (64.304042ms)
  ✔ OAuth cannot replace or duplicate an IMAP identity (4.940056ms)
  ✔ IMAP cannot duplicate an OAuth account, including case differences (3.512384ms)
  ✔ generic IMAP preserves password bytes and a failed check cannot replace credentials (6.896561ms)
  ✔ Gmail Done moves to special-use All Mail and fails closed when unavailable (1.738158ms)
  ✔ Gmail SMTP does not append a second Sent copy; other IMAP still saves one (12.524244ms)
  ✔ connected Gmail sync uses the IMAP provider (7.879827ms)
  ✔ preset Gmail account cannot substitute another IMAP username or servers (5.263337ms)
✔ account onboarding keeps transport identities and Gmail mailbox semantics (710.200531ms)
✔ authenticated HTTP queue, revision locks, Undo, preferences and update holds (645.942793ms)
▶ encrypted local outbox never retries or submits cancelled or recovered pending mail
  ✔ legacy string-To admission normalizes without saving or changing the frozen revision (14.311508ms)
  ✔ status order keeps the newest pending send last regardless of UUID order (12.998859ms)
  ✔ Undo restores the exact draft with Bcc, html and attachments with zero provider calls (6.084949ms)
  ✔ delay expiration submits once and persists sent acceptance before cleaning the draft (4.984318ms)
  ✔ concurrent dispatch and Send now admit one provider attempt (3.924263ms)
  ✔ pending and submitting recover in a fresh process without provider calls (666.268895ms)
  ✔ encrypted payload round-trip is opaque and absent from database and WAL bytes (6.921915ms)
  ✔ explicit rejection is failed, lost acceptance is unknown, Sent-copy warning is sent (20.163105ms)
  ✔ drain holds pending and waits for the whole submitting receipt (9.364371ms)
  ✔ a rejected confirmed resend does not erase earlier uncertainty (6.17696ms)
  ✔ Off, 5, 10 and 30 seconds retain the durable state machine (16.692748ms)
  ✔ recovered pending Send now is explicit; Discard never submits (6.264962ms)
✔ encrypted local outbox never retries or submits cancelled or recovered pending mail (1354.491286ms)
✔ enable verifies a private owned route, preserves foreign mappings, and disable removes only it (50.209749ms)
✔ missing CLI and signed-out hosts fail closed without mutation (75.711519ms)
✔ TLS failure rolls back only the created mapping; failed cleanup retains pending ownership (70.432439ms)
✔ Funnel or foreign route changes suspend access and block destructive cleanup (107.208032ms)
✔ restore verifies TLS before admission and a failed renewal revokes admission (35.887269ms)
✔ malformed saved ownership never invokes route removal (34.924608ms)
✔ all occupied ports leave routes intact; Funnel-only reservations are not overwritten (34.98001ms)
✔ startup verification serializes Settings mutations and close prevents late admission (70.001296ms)
✔ management requires authenticated exact localhost Host and Origin plus explicit confirmation (137.115268ms)
✔ a slow TLS proof stays within the existing route lease without suspending admission (74.253139ms)
✔ renewal leaves time for slow checks and both TLS probes without a lease gap (73.251296ms)
✔ close and restart leave one renewal timer when an old refresh finishes late (69.186181ms)
✔ phone access pages load the public passkey client from a hidden installation directory (156.245884ms)
✔ scan, matching host approval and real WebAuthn registration grant a credential-bound phone session (107.536508ms)
✔ unapproved, expired, reused and cancelled invitations grant no access (86.785035ms)
✔ tampered WebAuthn challenge, origin, RP and missing user verification are rejected (84.739504ms)
✔ ceremony cookies cannot swap challenges; route loss cancels setup but preserves paired browser trust (84.602229ms)
✔ registration is cookie-bound, consumes approval once and requires user verification (86.86259ms)
✔ host cancellation and credential revocation win against in-flight cryptographic verification (88.364741ms)
✔ a claimed invitation allows time for host approval, but still expires and grants no early access (77.837869ms)
✔ phone-initiated setup still requires matching localhost approval and verified registration (85.099413ms)
✔ pin and unpin finish while a long sync holds the mail queue, and still respect update drains (619.690416ms)
✔ provider search plan maps cached-search syntax and names device-only operators (3.209574ms)
▶ Gmail search pages to the cap, imports only uncached matches and stops when cancelled
  ✔ paging stops at the cap and leaves cached mail untouched (117.543855ms)
  ✔ complete and empty results report their full coverage (3.515282ms)
  ✔ cancelling stops further requests and imports nothing (2.799322ms)
✔ Gmail search pages to the cap, imports only uncached matches and stops when cancelled (128.67545ms)
▶ IMAP search examines Archive and Sent read-only, intersects UID searches and imports without flag changes
  ✔ complete results import new matches with their mailbox identity (11.969961ms)
  ✔ the cap keeps the newest UIDs and leaves later folders unsearched (72.275662ms)
  ✔ oversized search responses retain newest UIDs for intersection (6.528382ms)
  ✔ cancelling closes the connection before any download (2.048907ms)
✔ IMAP search examines Archive and Sent read-only, intersects UID searches and imports without flag changes (95.606936ms)
✔ known IMAP timeouts and body-read disconnects remain safe transient failures (2.223973ms)
synthetic Gmail repeat: 120 cached, 3 lists, 0 gets, 2 visible batches, 35ms with 10ms/request
✔ cached Gmail uses paginated inbox/unread lists without metadata gets, keeps older mail and exposes batches (35.266433ms)
synthetic Gmail token: 1 request arrived, transport closed after abort, 1 attempt
▶ Gmail token, list and raw read timeouts abort actual transport and do not retry
  ✔ token (33.059375ms)
synthetic Gmail list: 1 request arrived, transport closed after abort, 1 attempt
  ✔ list (9.409926ms)
synthetic Gmail raw: 1 request arrived, transport closed after abort, 1 attempt
  ✔ raw (6.32794ms)
synthetic Gmail negative control: caller timed out but open transport failed the 1000ms closure bound
  ✔ missing transport abort fails the closure assertion (1004.397913ms)
✔ Gmail token, list and raw read timeouts abort actual transport and do not retry (1054.682067ms)
✔ fresh Gmail batches appear before the next page, and all in-flight gets settle on failure (78.818361ms)
synthetic IMAP repeat: 3 cached bodies, 0 body bytes, 1 flag fetch
✔ IMAP refreshes flags without downloading cached bodies and drains metadata before UID body fetch (4.373267ms)
✔ oversized or malformed Gmail mail rejects without replacing cached messages (1.119219ms)
✔ oversized MIME is rejected before attachment persistence (0.245286ms)
✔ Gmail transport consumes a chunked oversized response with the SDK byte bound (192.034523ms)
✔ streamed Gmail synchronization does not retain the completed mailbox bodies (1.063436ms)
✔ streamed responses cancel at the byte bound without trusting Content-Length (26.108809ms)
✔ declared excess cancels before consuming a response (0.469493ms)
✔ cache evicts by bytes and entries, expires and isolates keys (0.284098ms)
✔ raw mail and Gmail base64 are bounded before decoding or parsing (0.933475ms)
✔ MIME metadata and part counts are bounded by the parser grammar (31.798102ms)
✔ canonical base64 sizes preserve padding validation without repeated decoding (0.383763ms)
✔ work admission bounds active work and pending closures (0.407297ms)
✔ decorative disk cache budgets preserve unrelated files (42.029887ms)
✔ HTML-to-text conversion has a decoded input bound (25.025245ms)
✔ both provider paths send text first and safe HTML; SMTP Sent uses identical bytes (255.395711ms)
✔ saved views persist encrypted exact definitions with authenticated CRUD and stale-write protection (701.65947ms)
▶ scheduled sends retain frozen snapshots, review missed deadlines and never retry
  ✔ authenticated schedule and reschedule routes preserve the exact snapshot (511.11026ms)
  ✔ future admission is idempotent and due dispatch submits once with sent warning (7.197443ms)
  ✔ invalid dates do not admit a schedule (9.027483ms)
  ✔ reschedule retains attempt and snapshot; Cancel restores exact draft (2.869001ms)
  ✔ offline due mail is held; reconnect never sends until explicit reschedule (4.865814ms)
  ✔ sleep gap and restart hold schedules for review without sending (5.884243ms)
  ✔ active and uncertain submissions cannot be rescheduled or retried (12.013492ms)
✔ scheduled sends retain frozen snapshots, review missed deadlines and never retry (1136.690112ms)
✔ summary-first search decrypts only unresolved bodies and preserves exact ordering (28.316213ms)
▶ SMTP acceptance survives Sent-copy and connection cleanup failures
  ✔ accepted with copy and logout (27.145155ms)
  ✔ Sent-copy failure (6.406241ms)
  ✔ logout failure after saved copy (5.284269ms)
  ✔ logout returns false after saved copy (4.044374ms)
  ✔ copy and logout both fail (3.546249ms)
  ✔ append returns false (2.937087ms)
  ✔ Sent-copy connection fails (2.999182ms)
  ✔ connection and close both fail (2.964448ms)
  ✔ partial SMTP rejection is accepted with a sanitized warning and no retry (4.075983ms)
  ✔ SMTP rejection stays a failure and never opens IMAP (2.78786ms)
  ✔ invalid input never submits to SMTP (1.102238ms)
✔ SMTP acceptance survives Sent-copy and connection cleanup failures (442.530276ms)
✔ sender rules override heuristics, case insensitive (1.723993ms)
✔ security stays important, promotions stay compact (0.503436ms)
✔ send validation rejects header injection and invalid recipient (3.642528ms)
✔ scoped conditional Teach wins over global and unconditional rules consistently (0.360179ms)
✔ summary copies isolate nested metadata and healthy compaction preserves every record (31.591387ms)
✔ state transport negotiates gzip, preserves JSON and cancels disconnected readers (213.19146ms)
✔ compaction preserves ciphertext, unknown records, drafts and key bytes across reopen (258.881768ms)
✔ orphan cleanup uses exact references in every view and refuses unsafe or busy work (212.272785ms)
✔ the authenticated maintenance endpoint drains admitted parsing and blocks new work (1146.521919ms)
✔ automatic maintenance is installed at server startup without an HTTP trigger (1334.748512ms)
✔ mail activity exposes queued and active work and records completion (667.035707ms)
✔ automatic diagnostics validate skip codes and reporter errors preserve cooldown and backoff (4.263872ms)
✔ startup scheduler reports sanitized storage skips and failures once and resumes ordinary work (5542.554501ms)
✔ automatic vacuum requires both exact free-byte and free-page thresholds (0.394733ms)
✔ automatic probes require genuine idle, skip unavailable work and close without overlap (0.719798ms)
✔ automatic inventory is independently daily at zero freelist and success waits six hours (0.81794ms)
✔ automatic failures back off once from thirty minutes to six hours, then success resets (0.8182ms)
✔ automatic deferral applies no success cooldown and cheap probes do no inventory (0.346945ms)
✔ automatic cleanup can remove zero-freelist orphans without vacuum and persists encrypted timing (221.040014ms)
✔ automatic busy-reader failure resumes work and backs off; UI reads do not reset genuine idle (1176.082031ms)
✔ automatic maintenance defers updates and aborts a pending drain on server shutdown (1089.522108ms)
✔ sync caches only account summaries and reads current bodies on demand (23.57891ms)
▶ recovery through the actual loopback service
  ✔ real OAuth invalid_grant differs from 503 and same stored token recovers (82.389972ms)
  ✔ 403 quota differs from policy; structured IMAP auth, read and unknown stay safe (41.947906ms)
  ✔ targeted duplicate requests queue once, retain old failure and exclude unrelated errors (23.069217ms)
  ✔ fresh Gmail batches stay visible while a later group in the same page stalls (30.159211ms)
  ✔ a completed failed account reconnects once while its peer remains running (21.102133ms)
  ✔ a failed batch rolls back prior writes and preserves encrypted cached bytes (3.929662ms)
  ✔ AI sorts only committed fresh mail when a later batch rolls back (17.25764ms)
  ✔ reconnect guards and unknown/body inputs never replace or restore credentials (16.324644ms)
actual ImapFlow flags exhaustion: 4 attempts, retained cache, no outer retry
  ▶ real ImapFlow FETCH exhaustion for flags and bodies cannot archive retained cache
    ✔ flags (10.556125ms)
actual ImapFlow body exhaustion: 4 attempts, retained cache, no outer retry
    ✔ body (10.221423ms)
  ✔ real ImapFlow FETCH exhaustion for flags and bodies cannot archive retained cache (22.181848ms)
  ▶ incomplete and concurrent UID snapshots preserve cache; empty and complete expunge reconcile
    ✔ missing (7.771301ms)
    ✔ duplicate (8.29341ms)
    ✔ exists (9.441023ms)
    ✔ uidNext (8.415227ms)
    ✔ validity (10.763841ms)
    ✔ body (8.170422ms)
    ✔ empty (9.025682ms)
    ✔ expunge (9.967841ms)
  ✔ incomplete and concurrent UID snapshots preserve cache; empty and complete expunge reconcile (73.906901ms)
  ✔ actual ImapFlow socket error survives and settles a blocked iterator (8.175943ms)
  ✔ throwing or false logout retains successful listing and primary fetch failure (25.728127ms)
unchanged 100: 0 mail writes, 1 events, 0 body reads
changed 25000: 25000 mail writes, 250 batch commits, 251 events, 0 body reads
  ✔ unchanged 100 rows write zero; changed 25k flags use bounded transactions/events and no body reads (12350.735061ms)
✔ recovery through the actual loopback service (13253.741833ms)
ℹ tests 24
ℹ suites 0
ℹ pass 24
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 14326.494342
✔ synthetic sync recovery, privacy, completeness and operation counts (14377.706233ms)
▶ account connection, progress, coalescing and recovery
  ✔ second and third accounts start while the first is pending; duplicate sync coalesces and guards remain (80.691419ms)
  ✔ Google callback schedules during pending sync and reconnect cannot restore old credentials (28.777774ms)
  ✔ pin changes survive a delayed sync batch (45.107759ms)
  ✔ task completion remains available during sync without opening other edits (11.136313ms)
synthetic Gmail first sync: 1 visible during fetch, 18 visible during AI, 18 AI calls, peak 6
  ✔ fetched Gmail batches are visible while later fetching and every configured AI judgement are pending (54.205394ms)
  ✔ provider failure keeps cached mail, exposes error, clears flags and allows retry (13.260501ms)
  ✔ background connection reports AI failure in account state and retains local mail (8.59434ms)
  ✔ partial fetch failure preserves cached mail and still sorts fetched mail; successful retry reconciles archive and snooze (13.858401ms)
  ✔ late completion cannot recreate a removed account or its mail (3.684306ms)
✔ account connection, progress, coalescing and recovery (769.489153ms)
ℹ tests 10
ℹ suites 0
ℹ pass 10
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 1398.379931
✔ synthetic sync service regressions (1444.607999ms)
▶ Trash actions use synthetic providers, safe targets and confirmed cache removal
  ✔ API authenticates Trash and deletes only after provider MOVE confirmation (53.775946ms)
  ✔ Gmail uses messages.trash including archived mail; rejection retains its cache (10.550124ms)
  ✔ absent, ambiguous and unsafe Trash folders or missing MOVE never mutate mail (6.951808ms)
  ✔ lowercase server flags identify Trash and archive folders (5.203228ms)
  ✔ native MOVE follows active IMAP4rev2, not merely advertised rev2 (2.774576ms)
  ✔ malformed identifiers, stale UIDVALIDITY and mismatched inbox identity cannot trash another message (4.066647ms)
  ✔ archived Trash requires a unique source and exact Message-ID; old inbox UID is never reused (8.919366ms)
  ✔ failed moves retain mail; confirmed moves survive release/logout errors without retries (6.254151ms)
  ✔ snooze is local and read still only adds Seen (3.674027ms)
✔ Trash actions use synthetic providers, safe targets and confirmed cache removal (651.61543ms)
✔ single-message unread and inbox actions use confirmed provider identity and preserve local IDs (404.244321ms)
✔ unsubscribe parsing selects POST, mailto and manual HTTPS without doing network work (29.59319ms)
✔ unsubscribe IP policy rejects special-use and encoded local targets (0.626555ms)
✔ reviewed unsubscribe pins public DNS, refuses redirects and prepares an ordinary draft without sending (118.438779ms)
▶ update quiesce drains renderer sends and queued sync/mutations, approved agent replies stay drafts, rejects admission and resumes
  ✔ activity counts queued and active work and timestamps success, rejection and synchronous throws (2.584583ms)
  ✔ bounded timeout leaves pending work intact; resumption permits later work (6.586759ms)
  ✔ an admitted account connection drains without restarting a watcher until resume (13.880051ms)
✔ update quiesce drains renderer sends and queued sync/mutations, approved agent replies stay drafts, rejects admission and resumes (708.209881ms)
▶ linked work sessions preserve work and mail, enforce local conflicts and retain terminal encrypted tombstones
  ✔ strict scheduling input and current parent proof (35.136544ms)
  ✔ multiple sessions, self exclusion, touching edges and cross-account busy (17.656787ms)
  ✔ generic routes and notification entrypoints reject before side effects (16.143677ms)
  ✔ finish and remove are independent and removed is terminal at current revision (19.470435ms)
  ✔ source/account loss and closure block scheduling while retaining cleanup (14.691507ms)
  ✔ immutable bindings, separate source/account loss and encrypted reopen (757.459159ms)
  ✔ fresh offer booking rereads busy, free, finished and removed sessions (160.857236ms)
✔ linked work sessions preserve work and mail, enforce local conflicts and retain terminal encrypted tombstones (1602.477249ms)
▶ encrypted workspace backup and non-destructive restore, synthetic only
  ✔ allowlist excludes secrets and cached message text (1.595825ms)
  ✔ imported calendar metadata cannot authorize outgoing RSVP (6.539992ms)
  ✔ round trip authenticates manifest and every local record (1056.214718ms)
  ✔ large draft payload round trips within the file limit (708.236389ms)
  ✔ wrong passphrase, tampered ciphertext and truncation fail closed (692.56332ms)
  ✔ newer authenticated payload version and malformed counts rejected (695.004496ms)
  ✔ preview changes nothing, existing records win (4.235139ms)
  ✔ account remapping, merged preferences and deferred flags (10.585408ms)
  ✔ write failure rolls back the entire merge (3.128383ms)
  ✔ export rejects retained account references without identity hints (2.390522ms)
  ✔ preview and import enforce deduplicated destination quotas atomically (75.399825ms)
  ✔ API requires preview receipt before merge (1875.573905ms)
✔ encrypted workspace backup and non-destructive restore, synthetic only (5240.548303ms)
▶ workspace HTTP preserves confirmed obligations, account boundaries and immutable approvals
  ✔ proposal sources reuse the full conversation fingerprint (31.745778ms)
  ✔ same-source proposal responses decrypt one coherent mail view and hash once (20.96871ms)
  ✔ proposal refresh tracks related body changes and missing sources without unrelated mail (24.002309ms)
  ✔ separate obligations persist, reopen explicitly and retain due-date history (22.022521ms)
  ✔ calendar saves one follow-up separately from the promise deadline and preserves history (23.777372ms)
  ✔ conversation uses exact same-account references and reports bounded gaps (2.293371ms)
  ✔ cross-account projects require confirmation of exact resulting set (9.554674ms)
  ✔ Teach preview scopes deterministic matches and rejects changed inputs (11.153875ms)
  ✔ future-only Teach excludes the existing cache after sync and deletion leaves other accounts untouched (12.369173ms)
  ✔ Forward HTTP prepares an encrypted independent draft from cached mail only (5.13409ms)
  ✔ MCP and agent proposal boundaries remain strictly plain text (23.590264ms)
  ✔ proposals approve only exact immutable payload once and reply approval saves a draft without sending (26.356043ms)
  ✔ new reply invalidates exact conversation approval and MCP switch refuses approvals (35.432899ms)
  ✔ assistant access edits keep the credential and apply to the next tool call (41.652826ms)
  ✔ grant revoked while approved mutation is queued prevents the provider action (22.907655ms)
  ✔ bounded Sent evidence preserves Inbox read state and never enters Inbox reconciliation (11.603681ms)
  ✔ queued Sent import refuses changed account credentials before contacting the provider (5.487377ms)
  ✔ encrypted attachment bytes download inertly and survive draft Cc/attachment round-trip (80.875708ms)
  ✔ disconnect erases automatic private bytes and grants while keeping confirmed work unavailable (6.837766ms)
✔ workspace HTTP preserves confirmed obligations, account boundaries and immutable approvals (994.270859ms)
✔ credential fallback notice appears only in Linux local-key mode (7.898627ms)
✔ expanded fallback notice offers a hide-for-session control (0.786051ms)
✔ collapsed fallback notice stays discoverable as a one-line chip (0.776983ms)
✔ storage copy is state-aware (0.276354ms)
✔ formatted tables retain whole-word intrinsic widths instead of shrinking to individual letters (145.496705ms)
✔ embedded image-only mail keeps its position without bypassing consent (17.547235ms)
✔ formatted renderer keeps headings, nested formatting, tables and validated inline presentation (24.209274ms)
✔ tiny newsletter preheader typography and box height do not overlap the body (44.187527ms)
✔ newsletter image loading does not add prose inside a narrow icon cell (15.432436ms)
✔ sender active tags, handlers, global styles, font resources and positioning never reach DOM (16.227804ms)
✔ links reject unsafe destinations and suppress hidden tokens including percent-encoded names and addresses (29.295585ms)
✔ nested formatted text uses the same parent redactor and cannot split hidden tokens across tags (55.573773ms)
✔ inline images require consent and suppress private sources and metadata in privacy mode (72.813205ms)
✔ formatted image alt redacts complete metadata before the display limit: 509 units, address (28.666015ms)
✔ formatted image alt redacts complete metadata before the display limit: 507 units, description (28.096687ms)
✔ formatted image alt redacts complete metadata before the display limit: 506 units, description (42.586332ms)
✔ formatted image alt redacts complete metadata before the display limit: 42 units, address (28.086188ms)
✔ formatted image alt redacts complete metadata before the display limit: 16 units, description (28.608479ms)
✔ privacy preserves interleaved captions with private tokens split across tags (13.305252ms)
✔ privacy preserves interleaved captions with private tokens split across images (11.96894ms)
✔ privacy leaf offsets stay aligned after nested blocks and void separators (13.947416ms)
✔ supported image-only mail keeps its formatted image without replacing it with fallback text (40.741405ms)
✔ unsupported, missing and over-budget content falls back through the parent text renderer (68.792877ms)
✔ mounted inline images report load/error and leave DOM when consent is revoked (69.705773ms)
✔ links keep the sender's text decoration and underline only when the sender sets no decoration (10.501032ms)
✔ loaded images sit in the sender's line instead of an inline-block box (11.248983ms)
✔ images sized only by height keep that height instead of their natural size (13.316083ms)
✔ blocked images keep their size as an empty box and carry the reason as a label (9.441414ms)
✔ image max-height caps survive blocked, unsupported and private placeholders (28.331112ms)
✔ legacy alignment centers tables, center wraps blocks and quotes take the app inset (13.209615ms)
✔ social icon rows keep their sender layout: table cells, inline-block wrappers and floated tables (53.342708ms)
✔ one click downloads then requests install, and progress prevents duplicate clicks (129.377772ms)
✔ failure and cancelled draft guard remain visible and permit an explicit retry (15.604795ms)
✔ ad-hoc macOS and missing updater metadata give honest states without an install control (16.676688ms)
✔ details can be dismissed with Escape and expose progress and failure status (11.038942ms)
✔ macOS installer action explains automatic replacement and platform trust checks (14.686038ms)
✔ About identifies browser version and host freshness without reloading (148.912269ms)
✔ About uses desktop update state, preserves newer events and checks without installing (13.299853ms)
✔ account statuses use readable fixed text and never expose provider details (1.196964ms)
✔ an explicitly granted MCP assistant reads cached mail, tracks work and exposes it in Today (1432.1705ms)
✔ BYOK disclosure loads sanitized settings, saves both presets, keeps blank key and removes (372.070415ms)
✔ BYOK source picker is bounded, searches permitted received mail, and preparation needs explicit acknowledgment (58.21667ms)
✔ BYOK failures preserve key, settings and instruction; privacy masks private text and attributes (69.771762ms)
✔ BYOK unconfirmed preparation stays blocked when history refresh returns false (59.090364ms)
✔ BYOK unconfirmed preparation stays blocked when history refresh returns throw (61.568609ms)
✔ BYOK acknowledged preparation stays blocked when the history refresh fails (49.957733ms)
✔ BYOK pending preparation disables duplicate work and ignores late responses after disable (46.561081ms)
✔ BYOK pending preparation disables duplicate work and ignores late responses after permission (44.145312ms)
✔ BYOK pending preparation disables duplicate work and ignores late responses after changeSource (39.168424ms)
✔ BYOK pending preparation disables duplicate work and ignores late responses after provider (35.877349ms)
✔ BYOK pending preparation disables duplicate work and ignores late responses after unmount (33.685325ms)
✔ BYOK missing permissions are explicit and cannot prepare (28.822188ms)
✔ BYOK reopening saved settings never prefills a key and does not prepare implicitly (22.615645ms)
✔ BYOK epoch recovery holds acknowledged preparation until settled history reconciliation (45.412938ms)
✔ BYOK epoch recovery holds lost preparation until settled history reconciliation (39.389956ms)
✔ BYOK starts with provider and key, keeps preset models in closed Advanced, and requires explicit preparation (48.702671ms)
✔ transparency picks the Windows material live and migrates the earlier on/off switch (92.827585ms)
✔ window opacity persists endpoints, rejects invalid values and survives material and theme changes (24.034973ms)
✔ macOS offers Off and Glass only and reads a stored Subtle as Glass (7.433934ms)
✔ light mode sets the scheme, a deeper accent and the native theme; System follows the OS (7.174212ms)
✔ custom selection and both palettes survive a restart, with safe fallback for a missing theme (11.350301ms)
✔ custom and preview colors follow the resolved scheme and clear fully when a built-in returns (10.240439ms)
✔ glass brightens faint text for custom palettes and clears with it (8.053426ms)
✔ an unavailable storage write leaves the saved theme library and selection intact (6.573936ms)
✔ attachment selection accounts for exact decoded bytes and retains the draft after rejected, cancelled or failed reads (407.142558ms)
✔ practical selections upload raw files serially and keep only IDs in the draft (61.946802ms)
✔ attachments download every format, preview only on demand, and clear previews on privacy changes (246.480703ms)
✔ large attachment download is explicit and the Cancel action aborts it (20.026324ms)
✔ slots use duration steps from working start, fit the query, and filter weekdays (20.765166ms)
✔ overlap excludes contained and covering busy periods but permits touching zero-buffer boundaries (3.346599ms)
✔ buffers extend both ends of every busy period, including busy periods outside working and query hours (2.215977ms)
✔ offset instants and fractional query or busy boundaries retain exact overlap semantics (0.923216ms)
✔ invalid untrusted settings fail before slots can be offered (4.822802ms)
✔ invalid ranges and malformed busy data throw instead of treating unknown time as free (2.401403ms)
✔ range bounds count local dates with an exclusive end, including a 31-day fall-back window (9.900337ms)
✔ output is bounded to the first 200 chronological slots and accepts five-minute durations (4.287698ms)
✔ working days use the chosen zone even when the UTC date differs, with fractional-hour offsets (1.289897ms)
✔ working hours retain local time on both sides of spring and fall DST changes (2.348073ms)
✔ nonexistent or ambiguous working boundaries skip the day rather than choose an offset (1.67935ms)
✔ individual slot boundaries skip spring gaps and fall folds and preserve elapsed duration (2.206039ms)
✔ half-hour DST folds and completely skipped local dates are not guessed (1.06564ms)
✔ results are deterministic, independent of host timezone, and leave inputs untouched (21.464836ms)
✔ startup bootstrap: status-first (393.524478ms)
✔ startup bootstrap: full-first (94.258684ms)
✔ startup bootstrap: bootstrap-failure (82.490184ms)
✔ startup bootstrap: retry (122.821613ms)
✔ startup bootstrap: auth-reset (83.84882ms)
✔ startup bootstrap: auth-after-status (135.70752ms)
✔ startup bootstrap: unmount (21.303589ms)
✔ startup bootstrap: retry-unmount (55.416713ms)
✔ startup bootstrap: browser-pending (46.77803ms)
✔ startup bootstrap: browser-failed (55.328038ms)
✔ explicit browser lock removes private content; temporary offline checks hide and automatically recover (149.00971ms)
✔ browser update waits for idle, protects writes and honors Later (121.867972ms)
✔ browser update navigation is tab-local, validated and consumed only once (6.836776ms)
✔ keyboard toggles, inclusive ranges, Shift-click, Escape and virtualized select-all remain bounded (999.066974ms)
✔ Trash captures exact count, cancel sends nothing, mixed results survive pruning and never retry (103.53335ms)
✔ response loss marks every item unknown and cache refresh failure does not resubmit (73.597399ms)
✔ platform select-all works anywhere on a mail page but leaves fields, dialogs and the other modifier alone (89.242322ms)
✔ select-all over Sent mail offers only the actions Sent supports (91.45284ms)
✔ select-all chord follows the platform (0.698739ms)
✔ custom selection bindings and existing arrow shortcuts retain their owners (69.671032ms)
✔ selection stays available during sync while bulk actions wait for it (61.824172ms)
✔ a sync refresh keeps a still-listed range anchor (119.762455ms)
✔ a sync refresh keeps an open bulk dialog until one of its messages disappears (70.508459ms)
✔ master checkbox reports none, mixed and all selected, and clears when all are selected (55.231238ms)
✔ a 200-item range outside the first batch reads mixed, and the master then selects the first 200 (89.703169ms)
✔ visible Day/Week/Month/Agenda bounds use Monday and exact intersecting months (7.757396ms)
✔ America/New_York 2026-03-08 axis spans 1380 real minutes (15.000416ms)
✔ America/New_York 2026-11-01 axis spans 1500 real minutes (1.871398ms)
✔ Australia/Lord_Howe 2026-10-04 axis spans 1410 real minutes (6.669113ms)
✔ Australia/Lord_Howe 2026-04-05 axis spans 1470 real minutes (1.779978ms)
✔ UTC 2026-10-25 axis spans 1440 real minutes (1.768817ms)
✔ fall-back repeated clock ticks show distinct offsets and spring skips missing hours (5.579659ms)
✔ half-open clipping uses each day's real midnight, including fractional DST (5.109014ms)
✔ stable overlap lanes share connected groups, and touching edges do not overlap (5.313164ms)
✔ follow-up/snooze points have zero duration; date-only work has no timed span (2.850077ms)
✔ date-only deadlines retain their chosen day across timezones and legacy records (2.531415ms)
✔ calendar separates deadlines from local timed follow-ups, keeps undated open work on today and omits closed work (8.209586ms)
✔ snoozed mail follows the local return time and disappears on unsnooze, expiry or archive (0.436601ms)
✔ Emc² events appear on each local day they cover, all-day first, and never count as overdue (1.056975ms)
✔ event fields convert to exclusive all-day ends and UTC instants, and reject impossible input (7.428345ms)
✔ a meeting from an email takes its subject and everyone on it except the user (0.912396ms)
✔ a long Google event covers the requested month without shifting all-day boundaries (0.43588ms)
✔ month merge keeps moved/newer versions and full identities (forward response order) (1.204698ms)
✔ month merge keeps moved/newer versions and full identities (reverse response order) (0.420973ms)
✔ equal local revisions use updatedAt and equal canonical records remain fresh (0.631223ms)
✔ cross-month cache reads are serial exact month windows, preserve partial coverage, and never sync on focus (913.22576ms)
✔ account/range changes discard obsolete reads, stop the old serial range and clear prior results (31.623467ms)
✔ command search wraps enabled choices, rejects disabled commands, and restores focus (320.67099ms)
✔ command search ranks exact labels, then aliases, then substrings inside quiet groups (34.929446ms)
✔ Commands button shows the platform modifier (28.639808ms)
✔ outbound formatting has a canonical safe subset and faithful text alternative (4.948034ms)
✔ outbound markup rejects active resources, attributes, unsafe links and budgets at the trusted boundary (8.769415ms)
✔ template and signature text changes preserve preceding formatting (0.903048ms)
✔ rich suffix changes preserve paragraph boundaries and intentional trailing newlines (1.114771ms)
✔ plain alternatives preserve inline-to-block boundaries (1.249432ms)
✔ ordered-list ordinals ignore whitespace nodes (0.327398ms)
✔ template suffixes retain complete lists and quotes while explicit newlines remain visible (0.88765ms)
✔ composer discloses empty Cc, keeps recovered recipients visible and preserves recovery controls (345.04433ms)
✔ reply retains original context and file drops reuse attachment validation without sending (82.603383ms)
✔ composer From hides account addresses in privacy mode (32.231672ms)
✔ compose shares its action-row height across the app and cleans up the observer (25.016676ms)
✔ new and reply drafts add one account signature while retaining content and reply references (2.266522ms)
✔ account switches replace untouched suffixes and preserve edited signatures and send uncertainty (0.420532ms)
✔ explicit template insertion preserves existing subject, body, signature and reply/send metadata (0.386328ms)
✔ private template chooser and settings contain no template or signature text (10.891699ms)
✔ mounted settings retain edits after save failure, block duplicate saves and confirm only resolved saves (248.774759ms)
✔ mounted template picker filters by name and content and inserts the highlighted match (111.390736ms)
✔ composer template picker moves with arrows, inserts with Enter and closes on Escape without closing the draft (66.568638ms)
✔ mounted template picker keeps generic labels in privacy mode (17.789486ms)
✔ mounted private settings reveal only the focused editor and enforce the template count bound (32.801853ms)
✔ formatted templates and signature switches retain subject, reply metadata and preceding formatting (3.088489ms)
✔ reply all parses quoted display names and groups, deduplicates and excludes only exact own addresses (3.669659ms)
✔ Sent replies address original recipients instead of the sending account (0.521499ms)
✔ a lost response retains the draft and declined resend submits no second request (70.6349ms)
▶ HTTP 400, parse failure and transport failure all retain an unknown draft
  ✔ HTTP 400 (0.67767ms)
  ✔ Invalid JSON (0.282345ms)
  ✔ fetch failed (0.205301ms)
✔ HTTP 400, parse failure and transport failure all retain an unknown draft (2.097538ms)
✔ click and Enter form submissions share the unknown-send confirmation (273.100595ms)
✔ editing an unknown draft preserves its warning and the next send guard (59.227987ms)
✔ pre-submission form validation never calls send (24.864493ms)
✔ explicitly discarding an unknown draft warns about possible delivery without calling it unsent (26.514599ms)
✔ send success and provider warnings survive a separate inbox refresh failure (0.574127ms)
✔ an in-flight send blocks another submission before React updates busy (0.227522ms)
✔ a failure retains edits made while the send was pending and hides error details (0.315626ms)
✔ an unacknowledged draft save blocks sending and cleanup (0.27487ms)
✔ accepted send cleanup failure never becomes a send failure or retry (0.377221ms)
✔ a response without provider acceptance preserves uncertainty and skips cleanup (0.20987ms)
✔ empty templates share one action row and a sole account uses a private-safe label (189.723073ms)
✔ retained compose drafts survive saved-value updates and remounts without effect callbacks (43.683063ms)
✔ standalone compose syncs untouched values and preserves local unsaved edits (28.306319ms)
✔ compose saves lock every field, retain failed edits and never clear a newer parent draft (43.680106ms)
✔ Settings resets scroll for section transitions and history restoration, not same-section refresh (25.132151ms)
✔ sender logos keep a compact explanation and disable fetching while busy (13.899348ms)
✔ Settings forwards compose drafts and updates without overwriting them on section remount (22.13458ms)
✔ connection and sorting copy distinguish Google setup, optional keys and provider disclosure (24.715216ms)
✔ native window explanation is Darwin-only and About retains storage and destructive-action warnings (73.836312ms)
✔ Contacts page lists, adds, edits and deletes contacts and removes recent recipients (346.892534ms)
✔ privacy mode hides contact names and addresses on the Contacts page (47.748699ms)
✔ import requires a preview and confirmation, hides personal preview data, and recovers from failure (40.836635ms)
✔ enabling privacy hides an unfocused contact search until focused (26.120047ms)
✔ account removal clears cached contacts, edits and import previews while Contacts remains mounted (48.025724ms)
✔ right-click requests a menu for the target mail and suppresses the default menu (2.049409ms)
✔ message actions render as accessible menu items and preserve disabled actions (7.520204ms)
✔ Gmail inline stack ordering, keyboard, consent, privacy and coverage (320.809729ms)
✔ IMAP inline stack ordering, keyboard, consent, privacy and coverage (59.914777ms)
✔ malformed or foreign conversation retains opened mail: undefined (15.725632ms)
✔ malformed or foreign conversation retains opened mail: {} (14.336631ms)
✔ malformed or foreign conversation retains opened mail: {"messages":[],"gaps":[]} (13.805594ms)
✔ malformed or foreign conversation retains opened mail: {"accountId":"a","messages":[null],"gaps":[]} (13.279427ms)
✔ malformed or foreign conversation retains opened mail: {"accountId":"a","messages":[{"id":"bad","accountId":"a","remoteId":"bad","threadId":"thread","messageId":"bad@example.test","sender":"Synthetic Sender","address":"sender@example.test","to":"reader@example.test","subject":"Same subject","preview":"Synthetic preview","body":"Synthetic body","html":null,"images":[],"attachments":[],"date":null,"unread":false,"archived":false,"snoozedUntil":null,"relevance":2,"category":"important","reason":""}],"gaps":[]} (13.834719ms)
✔ malformed or foreign conversation retains opened mail: {"accountId":"a","messages":[{"id":"bad","accountId":"a","remoteId":"bad","threadId":"thread","messageId":"bad@example.test","sender":null,"address":"sender@example.test","to":"reader@example.test","subject":"Same subject","preview":"Synthetic preview","body":"Synthetic body","html":null,"images":[],"attachments":[],"date":2000,"unread":false,"archived":false,"snoozedUntil":null,"relevance":2,"category":"important","reason":""}],"gaps":[]} (14.999523ms)
✔ malformed or foreign conversation retains opened mail: {"accountId":"a","messages":[{"id":"bad","accountId":"a","remoteId":"bad","threadId":"thread","messageId":"bad@example.test","sender":"Synthetic Sender","address":"sender@example.test","to":"reader@example.test","subject":"Same subject","preview":"Synthetic preview","body":"Synthetic body","html":null,"images":[null],"attachments":[],"date":2000,"unread":false,"archived":false,"snoozedUntil":null,"relevance":2,"category":"important","reason":""}],"gaps":[]} (19.77028ms)
✔ malformed or foreign conversation retains opened mail: {"accountId":"a","messages":[{"id":"a:2","accountId":"a","remoteId":"a:2","threadId":"thread","messageId":"a:2@example.test","sender":"Synthetic Sender","address":"sender@example.test","to":"reader@example.test","subject":"Same subject","preview":"Synthetic preview","body":"Synthetic body","html":null,"images":[],"attachments":[],"date":2000,"unread":false,"archived":false,"snoozedUntil":null,"relevance":2,"category":"important","reason":""}],"gaps":[null]} (18.568364ms)
✔ malformed or foreign conversation retains opened mail: {"accountId":"a","messages":[{"id":"bad","accountId":"a","remoteId":"bad","threadId":"thread","messageId":"bad@example.test","sender":"Synthetic Sender","address":"sender@example.test","to":"reader@example.test","subject":"Same subject","preview":"Synthetic preview","body":"Synthetic body","html":null,"images":[],"attachments":[],"date":2000,"unread":false,"archived":false,"snoozedUntil":null,"relevance":2,"category":"important","reason":"","invitation":{"status":"ok"}}],"gaps":[]} (15.80537ms)
✔ malformed or foreign conversation retains opened mail: {"accountId":"b","messages":[{"id":"foreign","accountId":"b","remoteId":"foreign","threadId":"thread","messageId":"foreign@example.test","sender":"Synthetic Sender","address":"sender@example.test","to":"reader@example.test","subject":"Same subject","preview":"Synthetic preview","body":"Synthetic body","html":null,"images":[],"attachments":[],"date":2000,"unread":false,"archived":false,"snoozedUntil":null,"relevance":2,"category":"important","reason":""}],"gaps":["Foreign secret"]} (13.837213ms)
✔ malformed or foreign conversation retains opened mail: {"accountId":"a","messages":[{"id":"foreign","accountId":"b","remoteId":"foreign","threadId":"thread","messageId":"foreign@example.test","sender":"Synthetic Sender","address":"sender@example.test","to":"reader@example.test","subject":"Same subject","preview":"Synthetic preview","body":"Synthetic body","html":null,"images":[],"attachments":[],"date":2000,"unread":false,"archived":false,"snoozedUntil":null,"relevance":2,"category":"important","reason":""}],"gaps":[]} (13.901702ms)
✔ malformed or foreign conversation retains opened mail: {"accountId":"a","messages":[{"id":"a:2","accountId":"a","remoteId":"a:2","threadId":"thread","messageId":"a:2@example.test","sender":"Synthetic Sender","address":"sender@example.test","to":"reader@example.test","subject":"Same subject","preview":"Synthetic preview","body":"Synthetic body","html":null,"images":[],"attachments":[],"date":2000,"unread":false,"archived":false,"snoozedUntil":null,"relevance":2,"category":"important","reason":""},{"id":"a:2","accountId":"a","remoteId":"a:2","threadId":"thread","messageId":"a:2@example.test","sender":"Synthetic Sender","address":"sender@example.test","to":"reader@example.test","subject":"Same subject","preview":"Synthetic preview","body":"Synthetic body","html":null,"images":[],"attachments":[],"date":2000,"unread":false,"archived":false,"snoozedUntil":null,"relevance":2,"category":"important","reason":""}],"gaps":["Referenced message unavailable: missing@example.test"]} (14.986058ms)
✔ bounded expansion rejects malformed data and failures, preserves cache, and guards pending and busy (31.225425ms)
✔ failed GET and failed Gmail expansion keep the opened mail without retrying (13.87846ms)
✔ late GET cannot replace another opening or refresh it (13.755321ms)
✔ late POST cannot replace another opening or refresh it (23.155228ms)
✔ keyboard boundaries, modified arrows, explicit selection and focused context menu stay per message (37.179028ms)
✔ actual IMAP References membership feeds ordered stack without subject or account grouping (17.189713ms)
✔ actual Gmail thread membership feeds ordered stack without subject or account grouping (16.147266ms)
✔ equal dates sort by id and an empty valid cache still retains the opened message (20.09942ms)
✔ Reader preserves selected snooze/reply/label callbacks and never applies them to another expanded message (32.805581ms)
✔ a single cached IMAP message renders without conversation chrome (28.175828ms)
✔ a single Gmail message keeps expansion and coverage notes without a count or rows (12.679351ms)
✔ a lone Gmail email keeps Load full conversation but no coverage notes (11.306851ms)
✔ late initial cache cannot overwrite a completed expansion (14.701509ms)
✔ private input stays hidden on dialog opening, reveals for editing and hides on blur (145.49706ms)
✔ private textarea stays hidden on dialog opening, reveals for editing and hides on blur (17.669133ms)
✔ dialog skips a masked private field and initially focuses the next enabled safe field (9.814418ms)
✔ dialog keeps ordinary initial private-field editing outside privacy mode (12.889382ms)
✔ dialog falls back to a safe button when its fields are disabled (7.178239ms)
✔ compose focus cycle skips controls inside an inert sidebar while busy (8.570858ms)
✔ nested dialog owns Escape and Tab, then restores its opener before the outer closes (14.170873ms)
✔ Disconnect warns before permanently deleting drafts and honors cancellation (170.178685ms)
✔ Drafts lists account, envelope, snippet and saved time; scopes search, opens once and hides private details (417.363619ms)
✔ draft quick delete confirms uncertainty, locks requests and preserves account identity and failed rows (102.355903ms)
✔ draft deletion invalidates a delayed refresh so deleted rows stay removed (23.479281ms)
An update to App inside a test was not wrapped in act(...).

When testing, code that causes React state updates should be wrapped into act(...):

act(() => {
  /* fire events that update state */
});
/* assert on the output */

This ensures that you're testing the behavior the user would see in the browser. Learn more at https://react.dev/link/wrap-tests-with-act
An update to App inside a test was not wrapped in act(...).

When testing, code that causes React state updates should be wrapped into act(...):

act(() => {
  /* fire events that update state */
});
/* assert on the output */

This ensures that you're testing the behavior the user would see in the browser. Learn more at https://react.dev/link/wrap-tests-with-act
✔ mounted drafts use encrypted HTTP persistence, recover edits and guard uncertain sends (2405.402561ms)
✔ content normalization strips metadata, orders fields and copies reply references (2.231176ms)
✔ constructors are silent; blank new composers and unchanged recovery do not write (0.68876ms)
✔ create writes content only and preserves reply metadata (1.104222ms)
✔ writes serialize and coalesce; older acknowledgements leave the newest edit dirty (9.864701ms)
✔ reverting to acknowledged text during an active write stays dirty until the reversion is saved (2.221318ms)
✔ clearing a saved draft persists empty strings and removes omitted reply fields (0.587692ms)
▶ failed and lost POST acknowledgements pause and never create a second copy
  ✔ committed=false (3.253576ms)
  ✔ committed=true (1.763928ms)
✔ failed and lost POST acknowledgements pause and never create a second copy (5.841024ms)
✔ failed PUT retains content and pauses; explicit retry reads unchanged revision before saving latest edits (2.013962ms)
▶ lost PUT acknowledgement accepts only its exact next revision and then drains newer edits
  ✔ newerEdit=false (0.574508ms)
  ✔ newerEdit=true (0.340893ms)
✔ lost PUT acknowledgement accepts only its exact next revision and then drains newer edits (1.369104ms)
✔ failed PUT reconciled to unchanged original needs no write when the local edit was reverted (0.402859ms)
▶ conflicting, unexpected or missing PUT recovery never overwrites or recreates
  ✔ same revision with changed text (0.57045ms)
  ✔ next revision with conflicting text (0.329292ms)
  ✔ next revision with conflicting reply metadata (0.389584ms)
  ✔ two revision advances with matching text (0.362473ms)
  ✔ regressed revision (0.418518ms)
  ✔ missing record (0.334231ms)
  ✔ different account (0.416684ms)
  ✔ different id (0.333551ms)
✔ conflicting, unexpected or missing PUT recovery never overwrites or recreates (4.173736ms)
✔ a failed reconciliation read preserves paused state and safe errors (9.583038ms)
✔ discard waits active creation, cancels queued edits, and prevents resurrection (1.089905ms)
✔ discard before a queued create starts makes no record (0.277826ms)
▶ discard reconciles ambiguous PUT before deleting only the known revision
  ✔ committed=false (1.386146ms)
  ✔ committed=true (1.243982ms)
✔ discard reconciles ambiguous PUT before deleting only the known revision (3.304721ms)
✔ lost DELETE response retains session until a repeated discard confirms 404 (0.448965ms)
▶ a failed DELETE can repeat only after GET confirms the exact original snapshot
  ✔ conflict=false (0.41947ms)
  ✔ conflict=true (0.264852ms)
✔ a failed DELETE can repeat only after GET confirms the exact original snapshot (1.053567ms)
✔ an external edit racing DELETE is never deleted and cannot resume autosave (0.36032ms)
▶ uncertainty is sticky through recovery, in-flight edits and conflicting reconciliation
  ✔ recovered marker (0.299576ms)
  ✔ in-flight marker (4.090642ms)
  ✔ observed conflicting marker (0.568857ms)
✔ uncertainty is sticky through recovery, in-flight edits and conflicting reconciliation (5.496754ms)
✔ sessions reject mixed accounts synchronously and encode the bound account in routes (0.626515ms)
✔ To, Cc, Bcc and attachments survive draft snapshots, save changes and attachment-only drafts (0.94125ms)
✔ formatted draft save, lost acknowledgement, restart and separate copy retain exact alternatives (0.623739ms)
✔ embedded images stay message-bound, consent-controlled and safe against late responses (1108.937509ms)
✔ removed-account event sources explicitly unlink before reassignment; Cancel preserves saved source (812.674463ms)
✔ local events without a connected sending account cannot prepare invitation or cancellation drafts (34.067787ms)
✔ follow-up presets use local calendar days through DST, month and year rollover (7.076029ms)
✔ draft-only search debounces once, aborts superseded work and reuses stable results until same-count save (1008.704015ms)
✔ draft opening rejects query/account/compose changes and stale revisions before replacing a compose session (87.963808ms)
✔ privacy-safe account labels distinguish address-only names and retain meaningful custom names (2.15737ms)
✔ connected event access retains per-account re-consent for missing free/busy permission (118.819713ms)
✔ cross-month Google coverage stays visible and each Sync uses its exact existing month (119.556582ms)
✔ mounted reader binds Google RSVP, reconciles response loss after remount, and reviews an insert without a synced window (2027.871947ms)
✔ saved Google insert review stays bound to its source when selecting another event (28.000428ms)
✔ registry preserves existing keys, Teach alias, history defaults and exact modifiers (84.461778ms)
✔ conflicts, fixed keys, editing, and known system combinations are rejected (0.48945ms)
✔ matching never runs inside editing, dialogs or settings, or on consumed/IME/repeat events (39.969171ms)
✔ storage sanitizes fields, rejects corrupted bindings and tolerates unavailable storage (31.543293ms)
✔ mounted settings captures without app dispatch, rejects conflicts, changes opening, resets and passes Escape (288.533724ms)
✔ Settings shell permits only safe shortcuts and its nearest child dialog and editors keep ownership (22.48119ms)
✔ Gmail bindings, sequence conflicts, custom sequences and legacy preferences survive storage (12.605717ms)
✔ web sessions detect Mac modifiers without the desktop bridge (5.984993ms)
✔ adding selection preserves an existing custom X binding (7.657822ms)
✔ mounted calendar and reader prepare bound drafts, recover ordinary Send, preserve privacy and keyboard focus (2242.774415ms)
✔ invitation review displays the same server proposal as its confirmation token (25.983675ms)
✔ mounted window reaches all 3000 messages with bounded rows and preserves the offscreen selection (1824.518952ms)
✔ 25624-message first, middle and last selections restore focus and retain a bounded DOM (127.971824ms)
✔ density, date groups, offsets, resize, filtering, sort, shrink and empty arrays preserve reachability (128.007945ms)
✔ inputs, message editors, menus and dialogs keep focus through selection and passive updates (154.668096ms)
✔ selection remains visible when the list sits inside an offset page ancestor (338.143176ms)
✔ split cards retain every message across density and pane layout changes (2203.941164ms)
✔ density changes retain the selected row in the viewport at default and large text sizes (264.965824ms)
✔ same-provider receiving accounts remain distinct in every density and pane layout (213.253464ms)
✔ single-account filtering hides account metadata but retains the sorting status (32.500876ms)
✔ privacy-safe duplicate labels, address-only names and unavailable accounts stay distinguishable (48.769327ms)
✔ uniform row sizing keeps status meaning and never invents missing labels (87.113985ms)
✔ selected and reader toolbars confirm reads immediately, coalesce opens and reject stale snapshots (1143.125977ms)
✔ failed reads stay unread without automatic retry; keyboard reopen retries and refresh failure keeps success (286.935744ms)
✔ pointer Snooze and keyboard Return to inbox use the local message action (411.406319ms)
✔ the snooze menu accepts a custom future time, rejects a past one and closes on Escape (159.750889ms)
✔ the reader's Change time reschedules a snooze and restores focus on Escape (294.456588ms)
✔ Trash confirmation is private, cancelable and keyboard accessible; success removes only the confirmed mail (271.596277ms)
✔ failed reader Trash keeps mail visible and never retries or claims success (252.484242ms)
✔ archived IMAP without Message-ID disables Trash with an accessible explanation (81.359427ms)
✔ row Trash targets the menu's own email without opening or marking it read (124.663747ms)
✔ Up and Down select mail without scrolling, opening or changing read state (243.145548ms)
✔ commands pin cached mail, structured search finds it and arrival notices are counted once (271.851101ms)
✔ saved Compose settings reach new drafts, templates and account signatures without sending (355.894309ms)
✔ archive reports confirmed success even when inbox refresh fails (88.654254ms)
✔ snooze and context menus Return to inbox confirm the local action (187.304021ms)
✔ pending and failed mail actions never publish success (432.379014ms)
✔ notification preferences validate stored fields and handle unavailable storage (92.505771ms)
✔ mounted Notifications settings honor persisted choices, preview, changes, reset and write failure (539.163179ms)
✔ App routes persisted and changed durations to mounted preview notices (188.184063ms)
✔ mounted revision reload preserves focus, full body/HTML updates, removals and generation recovery (286.649093ms)
✔ accepted arrival IDs drive private-safe toasts and exact reader navigation across filters (443.488998ms)
✔ native notification clicks wait for compose and busy work before marking only their exact target read (202.172929ms)
✔ mounted notification settings configure native details, chooser, preview, sound and reset (308.189888ms)
▶ delayed pruned snapshots keep removed details out of toasts and preserve surviving arrival IDs
  ✔ disconnect (376.339233ms)
  ✔ trash (418.635984ms)
✔ delayed pruned snapshots keep removed details out of toasts and preserve surviving arrival IDs (795.855131ms)
✔ a previously delivered toast cannot open removed mail or its replacement (119.735685ms)
✔ cancelling the audio chooser preserves Off and System with saved audio; importing selects Custom (194.274992ms)
✔ unread and Move to Inbox keep single-message targets and do not reread the open message (186.987269ms)
✔ App select-all selects closed-list mail without reading and leaves an open reader alone (123.999829ms)
✔ local Undo Commands work with confirmations off, retain target identity and consume a lost response without retry (231.524693ms)
✔ local confirmation Undo captures its message, rejects stale changes and restores Snooze from its notice (865.126799ms)
✔ Commands Undo consumes its confirmation receipt after success without consuming other notices (161.446025ms)
✔ Commands Undo consumes its confirmation receipt after a lost response without consuming other notices (286.564754ms)
✔ scope names exact filters, sort and private account without implying provider completeness (1.916784ms)
✔ widen retains query, account and sort and leaves original scope available to history (0.3279ms)
✔ plain text, quoted phrases, field terms and exclusions combine with AND (3.669293ms)
✔ account aliases, state filters, and unknown prefixes (0.362103ms)
✔ date bounds use UTC day starts with before exclusive and after inclusive (0.398301ms)
✔ malformed recognized operators fail closed without echoing query text (0.351524ms)
✔ canonical and Latin accent variants match names and content without changing original text (2.129691ms)
✔ recipient names and CC content are searchable with normalized phrases (0.34357ms)
✔ phrases stay within individual fields while separate terms combine across fields (0.293185ms)
✔ email identifiers and non-Latin combining marks stay distinct (0.499288ms)
✔ cached documents reflect in-place edits, same-ID replacements and live flags (0.402658ms)
✔ normalized documents are reused across queries and rebuilt after searchable edits (0.519937ms)
✔ every searchable field invalidates its document and same IDs cannot mix accounts (1.465255ms)
✔ search document entry budget evicts the least recently used identity without changing matches (2.125803ms)
✔ search document byte budget counts raw canonical folded and identity strings at the boundary (253.628248ms)
✔ search document replacement releases its previous byte allowance (66.969993ms)
✔ search cache identities isolate accounts and read flags dates and unused content live (0.562546ms)
✔ cached evicted and oversized documents preserve Unicode phrase and exclusion semantics (140.781733ms)
✔ plain words tolerate one typo while phrases, exclusions, addresses and operators stay exact (0.397218ms)
✔ AI reclassification preserves the open message and its reply source (1.116255ms)
✔ closed-reader selection stays in the filtered list (0.17789ms)
✔ removing the opened message cannot retarget the reader or reply (0.147675ms)
✔ unchanged snapshots reuse state, including mail formatting, images and account-scoped labels (1.363884ms)
✔ changed mail, recipient privacy names, new records, removals and order remain observable (0.493177ms)
✔ compose preferences keep unchanged snapshots stable while edits and arrivals remain observable (0.355672ms)
✔ revision deltas preserve untouched identities without serializing bodies and apply explicit removals (2.393318ms)
✔ account labels keep custom names visible while redacting literal and encoded addresses (2.73857ms)
✔ text size shortcuts recognize main keyboard and numpad without hijacking other modifiers (0.283247ms)
✔ Gmail label filters and editors stay account-scoped, escape names and preserve address privacy (9.887247ms)
✔ opening archived unread mail requests read, coalesces duplicate opens and allows retry after failure (0.670496ms)
✔ opened mail stays visible after marking read removes it from the Unread label filter (0.22606ms)
✔ local cache combines account, label, query, read and relevance without mutating mail (3.083341ms)
✔ local cache preserves Inbox tab, archive and active snooze boundaries; search spans tabs (2.249ms)
✔ Newest, Oldest and Relevance sorts have deterministic date and ID ties across accounts (0.573727ms)
✔ MCP endpoint Copy uses the desktop bridge when browser clipboard permission is denied (120.139166ms)
✔ the real body renderer links explicit HTTP URLs and preserves surrounding text (8.357483ms)
✔ body markup stays escaped and unsafe or malformed URLs stay text (0.761355ms)
✔ curly quotation marks stay outside link destinations (1.413858ms)
✔ privacy masks encoded addresses even when another URL byte is not UTF-8 (1.501471ms)
✔ balanced brackets and nested parentheses stay in URLs, prose punctuation stays outside (0.574999ms)
✔ privacy keeps addresses out of hrefs and never nests address controls in links (2.398227ms)
✔ long runs of unmatched URL brackets do not stall the renderer (3.889299ms)
✔ reader uses bounded paragraphs without altering links, indentation or address masking (11.454159ms)
✔ image sources reject credentials, local hosts, unsupported schemes and malformed URLs (0.609222ms)
✔ mounted reader blocks images until activation, reports loading/failure, and resets on message change (202.524871ms)
✔ formatted reader recovery keeps text on failure, ignores late content and clears consent on privacy (62.708733ms)
▶ fallback image metadata keeps truncated private tokens out of alt and loaded captions
  ✔ address: alt (75.497383ms)
  ✔ address: loaded caption (10.883809ms)
  ✔ name: alt (8.289387ms)
  ✔ name: loaded caption (9.44217ms)
  ✔ UTF-16 name: alt (7.678742ms)
  ✔ UTF-16 name: loaded caption (8.90967ms)
  ✔ public at boundary: alt (8.397077ms)
  ✔ public at boundary: loaded caption (8.033842ms)
  ✔ over boundary: alt (8.306699ms)
  ✔ over boundary: loaded caption (13.811851ms)
  ✔ short private descriptions remain masked and explicitly revealable (7.13452ms)
  ✔ short public descriptions remain readable (3.577189ms)
✔ fallback image metadata keeps truncated private tokens out of alt and loaded captions (181.203773ms)
✔ reader hides known-empty metadata but retains consent for unknown metadata and HTML images (5.895979ms)
✔ opaque sticky date captions cover the rows scrolling beneath them (554.323932ms)
✔ compact card checkboxes keep their gutter after the complete stylesheet cascade (158.915458ms)
✔ dark selection is distinct and rebuild headers and footers retain shared geometry (171.904581ms)
✔ theme choices grow above accent swatches without inheriting the mail-row height (211.46033ms)
✔ image status styles preserve body paragraph size, spacing and sender presentation (107.294022ms)
✔ sender colors, backgrounds, borders and links use the app theme (99.158681ms)
✔ window opacity applies immediately, persists and disables with transparency off (956.787942ms)
✔ theme dialogs retain edits and block Back/Forward until closed (659.83363ms)
✔ Ctrl+K cannot stack Commands over a theme dialog (411.998113ms)
✔ Cmd+K cannot stack Commands over a theme dialog (431.245926ms)
✔ custom theme preview cancels without saving; both palettes persist through an App restart (497.114091ms)
✔ edit, duplicate, rename conflicts and confirmed deletion preserve independent themes (291.63083ms)
✔ JSON import validates before saving and export downloads a portable copy (289.568016ms)
✔ failed theme saves keep the editor and draft available and Cancel restores the saved appearance (210.960292ms)
✔ theme file input reads bounded files and ignores a read completed after Cancel (163.775682ms)
✔ a full theme library keeps editing available and the theme picker supports keyboard wrapping (239.148984ms)
✔ context menu Open navigates and marks read without a menu guard blocking it (107.860064ms)
✔ Settings persist opening mode and custom keys while single-click opens and marks read once (463.383809ms)
✔ privacy removes connected recipient names and addresses from list, headers, body and attributes (253.0462ms)
✔ formatted privacy keeps image order and keyboard reveal across image boundaries (205.561396ms)
✔ privacy hides message-derived names and destinations in Gmail label filter (129.51899ms)
✔ privacy hides message-derived names and destinations in Gmail label editor (197.323929ms)
✔ privacy hides one-character recipient names and encoded destinations in mounted mail (197.28683ms)
✔ unread navigation sends independent read requests while earlier reads are pending (89.292593ms)
✔ empty and rejected formatting retain readable text and consent-controlled fallback images (1100.055219ms)
✔ mounted cached-mail controls combine filters, retain the read-on-open reader and restore history (587.337721ms)
✔ multiple IMAP accounts stay distinguishable and private, choose compose From and reuse Add account (214.578241ms)
✔ sidebar account choices close the reader, keep history and leave number shortcuts working (161.007389ms)
✔ mounted Oldest and Relevance controls reorder cached rows and history restores the sort (128.756815ms)
✔ Unread reader navigation keeps the opened message as an ordering anchor (965.47077ms)
✔ sidebar destinations have distinct decorative navigation glyphs (53.213095ms)
✔ the rebuild account footer follows the filter, preserves privacy and opens existing settings (154.817812ms)
✔ the rebuild footer opens Accounts with no connected accounts (53.274731ms)
✔ sidebar toggle stays first in its header, hides the panel and survives a restart (147.842652ms)
✔ Settings keeps mail navigation, uses a section rail and shows one section at a time (196.095195ms)
✔ side by side keeps the list beside the opened email; full width opens it in place (236.657958ms)
✔ side by side uses one column on narrow screens (94.124836ms)
✔ compose preferences survive Settings navigation, close and failed save (195.772554ms)
✔ compose save stays locked across Settings navigation and success (200.310973ms)
✔ compose save stays locked across Settings navigation and failure (332.401942ms)
✔ retained compose preferences stay savable after disconnecting an account (170.60444ms)
✔ filters open as a popover that Escape closes, and the button stays lit while filtered (115.089743ms)
✔ desktop mail rows use a native context menu and run the chosen action (67.438391ms)
✔ sidebar sections fold away and stay folded after a restart (105.492494ms)
✔ initial reader Back and Forward restore the latest reader without traversal visits (277.054121ms)
Encountered two children with the same key, `Esc`. Keys should be unique so that components maintain their identity across updates. Non-unique keys may cause children to be duplicated and/or omitted — the behavior is unsupported and could change in a future version.
✔ mouse side buttons leave and restore an initial reader while dialogs guard both directions (372.086103ms)
✔ menu history restores view, account, search and Settings without restoring readers (576.508383ms)
✔ reader buttons reuse unread anchors, edge guards and image resets without history visits (355.72287ms)
✔ updater Escape dismisses only update details and preserves reader focus (118.051418ms)
✔ updater Escape from Search preserves Search and the opened reader (89.626483ms)
✔ reader button traversal keeps focus in the reader so Tab preserves the mail view (209.521748ms)
✔ private rename confirms saving and displays the custom account label (140.299912ms)
✔ Settings rename persists through PATCH and reload, clears to email, cancels and retains failed input (255.783424ms)
✔ custom account labels remain visible in privacy while addresses and unfocused edit values are hidden (220.4847ms)
✔ menu Back and Forward shortcuts work from focused sidebar controls (162.830902ms)
An update to SearchToolbar inside a test was not wrapped in act(...).

When testing, code that causes React state updates should be wrapped into act(...):

act(() => {
  /* fire events that update state */
});
/* assert on the output */

This ensures that you're testing the behavior the user would see in the browser. Learn more at https://react.dev/link/wrap-tests-with-act
An update to App inside a test was not wrapped in act(...).

When testing, code that causes React state updates should be wrapped into act(...):

act(() => {
  /* fire events that update state */
});
/* assert on the output */

This ensures that you're testing the behavior the user would see in the browser. Learn more at https://react.dev/link/wrap-tests-with-act
✔ text size works from filters, search and reply editors without changing density (148.306437ms)
✔ 3000-row split App window retains tail mail, navigation, actions and passive-scroll focus (2378.495061ms)
✔ 3000-row full App window retains tail mail, navigation, actions and passive-scroll focus (1917.819057ms)
✔ Forward rejects a removed reader message (99.705619ms)
✔ Forward rejects a removed reader account (162.913447ms)
✔ privacy masks addresses embedded in custom account labels (144.537651ms)
✔ reader history restores row focus from a removed reader and preserves focused controls (154.212979ms)
Encountered two children with the same key, `Esc`. Keys should be unique so that components maintain their identity across updates. Non-unique keys may cause children to be duplicated and/or omitted — the behavior is unsupported and could change in a future version.
✔ mounted App guards modal dialogs and uses one native side-button source with cleanup (286.53587ms)
✔ menu history clears saved readers before resolving and never marks them read (96.936091ms)
✔ global search leaves Settings for cached mail and Commands navigates to work views (363.485013ms)
✔ V2 compact toolbar, text size, page keys and drafts navigation (281.5443ms)
✔ pane tools live in the persistent toolbar and section controls share the title line (301.393594ms)
✔ copying the MCP endpoint toasts without locking or remounting the sidebar (115.172786ms)
✔ assistant management stays in Settings and Agent review only shows review work (163.28303ms)
✔ compose keeps toolbar search and privacy usable without losing the draft or settings (398.47676ms)
✔ compose improvements preserve device settings and account preferences through restart (491.54552ms)
✔ compose history saves before mouse Back and retains Forward (109.400066ms)
✔ compose history saves before native Back and retains Forward (195.680166ms)
✔ compose navigation keeps failed saves open and sidebar navigation saves before leaving (255.425636ms)
✔ compose keyboard cycle reaches sidebar and toolbar without stealing editing or native field keys (292.001297ms)
✔ compose attachment drain keeps completed bytes during navigation (103.338025ms)
✔ compose attachment drain retains failed reads during navigation (99.621552ms)
✔ Settings floats over the mounted reader, owns focus and restores its opener (143.477867ms)
✔ Settings history keeps the mounted reader through sections, Back and Forward (318.347426ms)
✔ Settings keeps the work view mounted and limits shortcuts to safe modal actions (137.871112ms)
✔ Settings history rejects an unavailable reader when returning to mail (103.936908ms)
✔ global search enters all accounts once, preserves narrowing and restores scope through history (807.836247ms)
✔ Find pinned mail searches this view or All cached and keeps the selected account (198.595ms)
▶ mixed global search draft focus isolates mail shortcuts and traversal
  ✔ .draft-row: e (380.908415ms)
  ✔ .draft-row: r (455.877885ms)
  ✔ .draft-row: b (449.003685ms)
  ✔ .draft-row: m (454.098585ms)
  ✔ .draft-row: j (448.751226ms)
  ✔ .draft-row: k (440.919078ms)
  ✔ .draft-row: ArrowDown (453.253575ms)
  ✔ .draft-row: ArrowUp (442.491942ms)
  ✔ .draft-row: PageDown (427.496291ms)
  ✔ .draft-row: PageUp (456.744025ms)
  ✔ .draft-row: Enter (435.293297ms)
  ✔ .draft-refresh: e (453.685962ms)
  ✔ .draft-refresh: r (451.018866ms)
  ✔ .draft-refresh: b (438.597538ms)
  ✔ .draft-refresh: m (479.411884ms)
  ✔ .draft-refresh: j (472.264305ms)
  ✔ .draft-refresh: k (445.487194ms)
  ✔ .draft-refresh: ArrowDown (451.465577ms)
  ✔ .draft-refresh: ArrowUp (444.24722ms)
  ✔ .draft-refresh: PageDown (453.944114ms)
  ✔ .draft-refresh: PageUp (451.110095ms)
  ✔ .draft-refresh: Enter (437.869036ms)
✔ mixed global search draft focus isolates mail shortcuts and traversal (9828.157327ms)
✔ mixed global search draft focus preserves global shortcuts and draft activation (479.630989ms)
✔ global search finds and opens a saved draft body with no cached mail and no account-list requests (478.66822ms)
✔ global search Gmail label choices use distinct friendly account names without private addresses (94.420736ms)
✔ F6 cycles the visible regions and Shift+F6 reverses (172.98609ms)
✔ F6 skips a closed sidebar and a full-width reader (165.63705ms)
Encountered two children with the same key, `Esc`. Keys should be unique so that components maintain their identity across updates. Non-unique keys may cause children to be duplicated and/or omitted — the behavior is unsupported and could change in a future version.
✔ F6 keeps dialog and composer focus scope (117.108507ms)
✔ global search draft deletion reports a failed count refresh without retrying deletion (523.743835ms)
Encountered two children with the same key, `Esc`. Keys should be unique so that components maintain their identity across updates. Non-unique keys may cause children to be duplicated and/or omitted — the behavior is unsupported and could change in a future version.
✔ Gmail go-to sequences navigate views, cancel safely and expose saved hints (309.006278ms)
✔ custom sequences and mouse-history preferences persist and respect editor focus (139.644606ms)
✔ Gmail pin, mark-read and reply-all shortcuts reuse guarded mail actions (93.309717ms)
✔ custom sequences retain safe Settings and compose actions and Caps Lock navigation (309.606519ms)
✔ pending sequences preserve Escape, Tab and system shortcuts (134.99667ms)
✔ phone navigation can leave Today, close the drawer and reopen it for Settings (224.716753ms)
✔ phone users can create, customize and retain a theme without changing mail (270.362635ms)
✔ an empty browser page refreshes imported accounts when the phone tab returns (52.368107ms)
✔ phone Settings section picker switches panels without changing saved mail (123.680416ms)
✔ Forward shortcut prepares one draft without sending (69.926213ms)
✔ Commands lists Forward with its configured shortcut (98.886842ms)
✔ delayed Forward preserves context: keyboard (69.543772ms)
✔ delayed Forward preserves context: sidebar (78.340311ms)
✔ delayed Forward preserves context: saved draft (387.942983ms)
✔ delayed Forward preserves context: source removed (137.697699ms)
✔ delayed Forward preserves context: account removed (125.279448ms)
✔ delayed Forward preserves context: update (93.860069ms)
✔ Forward admits only one request before React renders (61.073458ms)
✔ search widening preserves query and account and Back restores exact filters (357.574265ms)
✔ account warning opens the affected private account without reconnecting on focus (148.309404ms)
✔ persistent density agrees between Appearance, shortcut and Commands (312.822085ms)
✔ browser update banner protects editors and work views and restores the selected mail (431.37628ms)
✔ browser updates cannot interrupt pending reads or reload after an uncertain write (1596.266763ms)
✔ Contacts opens as a main view, stays outside Settings and cannot trigger mail shortcuts (106.773801ms)
✔ saved search views restore query, account, filters and sort through keyboard Commands (614.283072ms)
✔ saved view names and queries stay hidden in privacy mode (310.563607ms)
✔ selecting mail from an Inbox tab moves focus to the rail checkbox (93.670186ms)
✔ mounted Offer times saves a reviewed reply, recovers lost responses and books in the reader/calendar with privacy and focus (2282.784076ms)
✔ grouped offered slots retain original indexes, ten-slot limit and removed-draft protection (127.270408ms)
✔ recovered replies resolve exactly one source in the sending account (1.10315ms)
✔ summary hydration preserves legacy content recovery and retry without image activation (201.713362ms)
✔ body hydration rejects late, cross-account and changed-version completions; reader resets image consent (496.013131ms)
✔ pending body searches retain confirmed header matches through result and version refresh (313.751546ms)
✔ unconfigured Google sign-in is not offered and account onboarding stays separate from developer setup (15.761628ms)
✔ configured Google sign-in is offered (6.02036ms)
✔ Gmail app password form explains Workspace and policy limits without server fields (1.531517ms)
✔ known providers have official password help and only custom IMAP exposes servers (4.402904ms)
✔ busy connection form prevents another submission (0.890215ms)
✔ Google callback dismisses the normal provider chooser (264.552308ms)
✔ Google callback retains idle icloud form and input (130.558661ms)
✔ Google callback retains pending icloud form and input (148.977295ms)
✔ Google callback retains idle imap form and input (103.338874ms)
✔ Google callback retains pending imap form and input (114.417035ms)
✔ actual connection submission blocks duplicates and dismissal, retains errors and retries corrected input (11.866067ms)
✔ initially busy connection rejects a dispatched submit and permits it when busy clears (7.484382ms)
✔ add-account footer reflects credential fallback mode (11.914667ms)
✔ fallback warning collapses across mail and Settings and remains reopenable (280.53108ms)
✔ mounted delayed Undo preserves a newer composer and the recoverable source (1507.995226ms)
✔ mounted user Send queues, exact keyboard Undo restores the draft, and Off submits once (2052.103441ms)
✔ Settings displays verified URL, hides it from private DOM and confirms route changes (208.601177ms)
✔ Settings presents remote and unsupported states without management controls, and recovers from offline (41.578146ms)
✔ localhost can revoke paired phones while the route is off or unavailable (37.77177ms)
✔ Settings shows QR only outside Privacy, approves the matching code and revokes phones (218.934801ms)
✔ stale polls cannot overwrite a newer pairing (23.116729ms)
✔ collects only connected-account names and aliases from current To/Cc headers (4.367148ms)
✔ handles bare addresses, unquoted surname commas, folded whitespace and deduplication (0.263189ms)
✔ hides one-character connected recipient names and their encoded destinations (1.662781ms)
✔ masks whole Unicode phrases case-insensitively while preserving source offsets and punctuation (0.509267ms)
✔ escapes name punctuation instead of treating it as regex syntax (0.29583ms)
✔ address and overlapping name ranges produce one mask and no gaps (0.468481ms)
✔ encoded names and addresses cannot survive URL text or attribute redaction (1.16754ms)
✔ formatted text hides a name across decoded markup leaves, without rendering sender HTML (2.054038ms)
✔ names separated by block text and unknown body-only names stay distinct (0.370559ms)
✔ split private parts share the source-token reveal key despite overlapping names and encoding (0.574598ms)
✔ long ordinary words do not trigger quadratic address matching (1.059289ms)
✔ plus-sign words in a recipient name do not cause catastrophic backtracking (0.227523ms)
✔ ordinary text scans without allocating per-character offset pairs (1.844188ms)
✔ direct UTF-16 ranges match the decoder path across Unicode, surrogates and overlaps (2.512209ms)
✔ previews drop plain-text image placeholders but keep ordinary brackets (2.603469ms)
✔ names beyond the matcher's limits hide the whole text (0.741298ms)
✔ Unicode expansion does not hide original name from fallback matching (0.264832ms)
✔ both Greek sigma forms match, like case-insensitive Unicode matching (0.149257ms)
✔ provider search coverage names the source, scope and remaining matches (1.262727ms)
✔ older mail search asks the provider only on activation and reports coverage (160.148255ms)
✔ a query or account change cancels a running search (19.401445ms)
✔ quick tracking shows one summary, explicit new and saved choices, and requires a choice for multiple items (228.534767ms)
✔ reader opens a single cached message without conversation chrome and shows the local snooze return time (29.75992ms)
✔ reader j opens unread B and sends one coalesced read request (112.508889ms)
✔ list j only selects B without opening or reading (61.185837ms)
✔ reader k opens unread B and sends one coalesced read request (48.662467ms)
✔ list k only selects B without opening or reading (54.566753ms)
✔ account shortcut a to b closes the reader and clears selection (24.838211ms)
✔ account shortcut a to all closes the reader and clears selection (25.613061ms)
✔ account shortcut all to b closes the reader and clears selection (28.467858ms)
✔ same or missing account shortcut 1 preserves the reader (18.735216ms)
✔ same or missing account shortcut 0 preserves the reader (17.629892ms)
✔ same or missing account shortcut 9 preserves the reader (17.188852ms)
✔ automatic read removal from Unread keeps the opened body (10.54417ms)
✔ reader navigation failures keep unread and expose retry through openMail (27.964553ms)
✔ editors, modifiers, settings and dialogs guard navigation and account shortcuts (495.508634ms)
✔ actions mail-action shortcuts require an opened source and retain input, modal and busy guards (744.469709ms)
✔ projects mail-action shortcuts require an opened source and retain input, modal and busy guards (690.065694ms)
✔ calendar mail-action shortcuts require an opened source and retain input, modal and busy guards (662.05733ms)
✔ token helpers complete only the address after the last comma (1.060201ms)
✔ the picker filters the current token and inserts only a picked suggestion (456.435423ms)
✔ Escape dismisses suggestions and a click picks one (191.379169ms)
✔ privacy mode hides suggested names and addresses until revealed (189.126783ms)
✔ the cycle visits the documented order in both directions and wraps (1.760123ms)
✔ hidden regions are skipped without leaving the cycle (0.216312ms)
✔ focus outside the cycle enters at the matching end (0.162923ms)
✔ the cycle stops when no region is available (0.214329ms)
✔ regionOf maps focused elements to their window region (97.687383ms)
✔ reply context uses safe sender formatting instead of raw plaintext tracking URLs (185.283634ms)
✔ reply context recovers formatted content and resets image consent on privacy and source changes (228.140991ms)
✔ empty-body replies keep the cached preview when HTML is absent or rejected (8.334877ms)
✔ rich compose preserves selection, saves alternatives and inserts only plain clipboard text (307.933087ms)
✔ link entry uses an inline keyboard form without relying on a native browser prompt (46.842856ms)
✔ hover exposes row actions and removes the overlapping timestamp (1.516199ms)
✔ each row offers one More actions button that opens the message menu (11.017294ms)
✔ the More actions button opens the menu for its own mail without selecting or opening it (301.153943ms)
✔ direct row actions retain target identity, disabled guards and native button activation (55.439611ms)
✔ snoozed rows replace Snooze with Return to inbox and expose local pin state (32.151691ms)
✔ touch and narrow lists do not reserve a persistent action strip (99.956544ms)
✔ the rendered row layout and the windowing height agree in every density and width (122.751476ms)
✔ row offers only the applicable read-state action: unread=true (2.859806ms)
✔ row offers only the applicable read-state action: unread=false (1.992796ms)
✔ row shows only applicable actions in toolbar order: archived=false (3.110323ms)
✔ row shows only applicable actions in toolbar order: archived=true (2.759301ms)
SYNTHETIC_SCHEDULE_TRACE [{"order":1,"phase":"request","route":"/api/accounts/a/drafts"},{"order":2,"phase":"response","route":"/api/accounts/a/drafts","status":200,"aborted":false},{"order":3,"phase":"parsed","route":"/api/accounts/a/drafts","drafts":[{"id":"03b639be-3a04-4bc0-b1ed-b09ab0c6283b","revision":1}]},{"order":4,"phase":"request","route":"/api/accounts/a/drafts/03b639be-3a04-4bc0-b1ed-b09ab0c6283b"},{"order":5,"phase":"response","route":"/api/accounts/a/drafts/03b639be-3a04-4bc0-b1ed-b09ab0c6283b","status":200,"aborted":false},{"order":6,"phase":"parsed","route":"/api/accounts/a/drafts/03b639be-3a04-4bc0-b1ed-b09ab0c6283b","drafts":[{"id":"03b639be-3a04-4bc0-b1ed-b09ab0c6283b","revision":1}]},{"order":7,"phase":"request","route":"/api/accounts/a/drafts"},{"order":8,"phase":"response","route":"/api/accounts/a/drafts","status":200,"aborted":false},{"order":9,"phase":"parsed","route":"/api/accounts/a/drafts","drafts":[{"id":"03b639be-3a04-4bc0-b1ed-b09ab0c6283b","revision":1}]},{"order":10,"phase":"request","route":"/api/accounts/a/drafts"},{"order":11,"phase":"response","route":"/api/accounts/a/drafts","status":200,"aborted":false},{"order":12,"phase":"parsed","route":"/api/accounts/a/drafts","drafts":[{"id":"03b639be-3a04-4bc0-b1ed-b09ab0c6283b","revision":2}]},{"order":13,"phase":"before-restored-row-click","ariaBusy":"false","rowPresent":true,"rowDisabled":false,"refreshDisabled":false,"loading":false,"error":"","inert":false,"compose":false,"storedRevision":2},{"order":14,"phase":"request","route":"/api/accounts/a/drafts/03b639be-3a04-4bc0-b1ed-b09ab0c6283b"},{"order":15,"phase":"after-restored-row-click","ariaBusy":"true","rowPresent":true,"rowDisabled":true,"refreshDisabled":true,"loading":false,"error":"","inert":false,"compose":false,"storedRevision":2},{"order":16,"phase":"response","route":"/api/accounts/a/drafts/03b639be-3a04-4bc0-b1ed-b09ab0c6283b","status":200,"aborted":false},{"order":17,"phase":"parsed","route":"/api/accounts/a/drafts/03b639be-3a04-4bc0-b1ed-b09ab0c6283b","drafts":[{"id":"03b639be-3a04-4bc0-b1ed-b09ab0c6283b","revision":2}]},{"order":18,"phase":"request","route":"/api/accounts/a/drafts"},{"order":19,"phase":"response","route":"/api/accounts/a/drafts","status":200,"aborted":false},{"order":20,"phase":"parsed","route":"/api/accounts/a/drafts","drafts":[{"id":"03b639be-3a04-4bc0-b1ed-b09ab0c6283b","revision":2}]}]
✔ mounted Send later preserves custom time, reschedule, cancel and exact edit recovery (4586.538262ms)
✔ search typing paints immediately and coalesces expensive result updates (577.419414ms)
✔ search resolves header facts without guessing about unknown message bodies (3.425407ms)
✔ known summary outcomes agree with every possible full body (0.745316ms)
✔ pending search communicates progress instead of claiming no matches (6.260327ms)
✔ segmented choices keep one tab stop, wrap with arrows and skip disabled values (289.230783ms)
✔ sender class styles retain bounded columns and responsive colors without resource or selector metadata (3.859244ms)
✔ sender CSS rejects active features, private attribute selectors, escapes and hidden text (0.767758ms)
✔ isolated reader binds document, privacy, image consent and keyboard lifetime to the current opening (389.740263ms)
✔ embedded image responses cannot cross message bindings and release owned blobs (73.502339ms)
✔ sender stylesheet font sizes use the reader text-scale preference (0.483258ms)
✔ custom snooze growth stays inside the viewport without moving input focus (299.711736ms)
✔ snooze presets act immediately, preserve local morning across DST and respect busy state (36.25938ms)
✔ progress notifications share one active reload and one pending final refresh (2.85113ms)
✔ a notification queued during a rejected read still receives one final refresh (1.449855ms)
✔ failed reload releases its slot so a later request can recover (0.836906ms)
✔ Teach previews account scope and requires a fresh preview after edits, including pending requests (334.709245ms)
✔ theme files round-trip both palettes without exporting device identity (6.887553ms)
✔ generated text remains readable when a dark palette starts from a bright background (0.348969ms)
✔ import rejects unsupported formats, missing palettes, active CSS, and oversized input (2.245163ms)
✔ libraries reject duplicate or reserved ids and give imported copies distinct names (1.407526ms)
✔ notice stacks scroll within both viewport anchors with room for shadows and animations (1.504196ms)
✔ toasts queue without dropping errors, deduplicate, redact, pause expiry and dismiss (338.687785ms)
✔ configured durations, no expiry, permanent errors and filtering survive preference changes (44.769798ms)
✔ tracking saves from one explicit status choice without editing a form or marking mail read (876.681175ms)
✔ Today empty work uses one empty state without repeated empty groups (81.123162ms)
✔ Today opens a source and conversation inline, preserves account, filters, selection and list scroll, and restores keyboard focus (545.761262ms)
✔ full-width Today keeps the list mounted and Back/Escape return to its selected row; missing sources stay explicit (233.288338ms)
✔ Today keeps task evidence collapsed above the email and avoids duplicate source rows (120.739612ms)
✔ Projects shows email rows and open tasks, reads inline and restores focus without changing projects (183.104056ms)
✔ Projects resets reading after creation and task reassignment, and decision links restore focus (257.796363ms)
✔ new work clears an unrelated open email before returning to the list (441.542363ms)
✔ quick tracking creates one explicit item on duplicate submit and refreshes counts visible from mail (163.321907ms)
✔ quick updates select one of several deliverables and preserve exact revisions, evidence, deadlines and sibling status (103.672446ms)
✔ failed and unknown quick saves retain input, block blind retries and reconcile a lost create response before another choice (294.680204ms)
✔ acknowledged save with failed refresh cannot create again, and stale revisions require explicit review (246.695991ms)
✔ due counts share account scope across views and exclude cleared, completed and cancelled work; refresh failure hides stale totals (186.712241ms)
✔ Today privacy masks private source text and attributes, and image consent resets for each inline opening (120.892301ms)
✔ quick tracking carries entered title, status and reminder into the full editor and guards navigation (111.009228ms)
✔ closed deliverables require the full editor rather than an implicit quick reopen (83.849488ms)
✔ completing one deliverable updates the shared due count in Today and mail without completing its sibling (115.636159ms)
✔ an expired Later today preset is refused at save without changing the deadline or creating work (110.139983ms)
✔ quick tracking masks distinct cached source and evidence aliases through recovery and saved result (188.27169ms)
✔ quick recovery preserves draft title status and reminder through explicit New and full editor (386.957031ms)
✔ Today opened source accepts reply shortcut without changing commitment (88.84773ms)
✔ Today opened source accepts archive shortcut without changing commitment (77.752504ms)
✔ Today opened source accepts snooze shortcut without changing commitment (83.053397ms)
✔ Today opened source accepts teach shortcut without changing commitment (76.800374ms)
✔ Schedule meeting prefills an email's subject and people, saves one Emc² event, and Calendar reads mail in its own pane (249.771473ms)
✔ inline conversation context and explicit selection target one message without bulk actions or commitment changes (238.889651ms)
✔ reader unsubscribe sends no request on render, review or cancel and submits once only after confirmation (321.776518ms)
✔ mailto unsubscribe opens the returned receiving-account draft for ordinary review (28.813255ms)
✔ HTTPS unsubscribe reveals no private destination until review and uses the existing external-link path (44.870264ms)
✔ unsupported or absent unsubscribe headers expose no reader action (28.018708ms)
✔ mounted App drains its send promise and retains the real unload guard for an unknown draft (932.983213ms)
▶ mounted linked sessions preserve independent lifecycle, recovery, focus and parent invariants
  ✔ explicit create guards, frozen-ID recovery and acknowledged save with failed refresh (969.785178ms)
  ✔ edit recovers the frozen 13:00 UUID while 15:00 sorts first (285.916477ms)
  ✔ Today finish direct restores focus after its trigger disappears (198.048415ms)
  ✔ Today finish recovered restores focus after its trigger disappears (174.551077ms)
  ✔ Today remove direct restores focus after its trigger disappears (115.52712ms)
  ✔ Today remove recovered restores focus after its trigger disappears (149.200223ms)
  ✔ remount, privacy, keyboard and Calendar detail/source focus preserve saved sessions (482.999208ms)
✔ mounted linked sessions preserve independent lifecycle, recovery, focus and parent invariants (6030.96528ms)
✔ Projects hides known account names while preserving exact cross-account approval (611.657898ms)
✔ Agent Reviews hides known account names in allowed accounts and existing grants (89.721871ms)
✔ assistant access can be edited inline to add and remove accounts and permissions (117.306827ms)
✔ Agent creation permissions are visible, opt-in and absent from the reply preset (66.675481ms)
✔ removing an assistant requires confirmation, preserves proposals and blocks their approval (98.135169ms)
✔ review cards link each email once and preserve distinct action, account, recipient and content proposals (40.26627ms)
✔ real App launches on the manual action screen without selecting or reading hidden Inbox mail (82.351771ms)
✔ work controls and agent sections render inside the pane header (27.377962ms)
✔ manual commitments keep source identity, partial updates and explicit reopen history (171.150505ms)
✔ failed commitment save retains edits and privacy removes unfocused editor values (93.900007ms)
✔ project links require explicit confirmation of the exact multi-account set (46.662339ms)
✔ acknowledged save with failed refresh retains input and blocks duplicate submission (57.119036ms)
✔ failed decision save keeps text and sources through project clicks until recovery is reviewed (66.092156ms)
✔ proposal envelope omits empty Cc and attachment rows without removing the review gate (33.283018ms)
✔ reply proposals freeze exact payload, need reviewed evidence and approve into Drafts without the sending switch (48.593649ms)
✔ workspace hides source-header-only names in commitments, history and proposal content (82.882317ms)
✔ reader tracking source is consumed and returning to Actions does not start duplicate confirmation (265.305702ms)
✔ calendar schedules and clears a follow-up without completing or moving its deadline (93.581281ms)
✔ month and agenda keep undated, overdue, account scope and source inspection reachable (55.149724ms)
✔ Calendar keeps cached navigation and inspection after a stale error while editing stays blocked (55.097015ms)
✔ source picker stays bounded while search reaches older cached messages (41.360713ms)
✔ commitment dialog blocks app navigation and Commands until explicitly closed (94.867552ms)
✔ OpenCode manual setup copies the scoped grant config, keeps the credential out of the DOM and clears on revoke (59.002224ms)
✔ OpenCode manual setup uses the browser clipboard with the shared config when no desktop bridge exists (37.786008ms)
✔ OpenCode manual setup reports a generic copy failure without echoing the credential (35.989418ms)
✔ OpenCode one-button setup saves through the native bridge, enables MCP once and keeps JSON in the manual disclosure (43.019626ms)
✔ OpenCode one-button setup reports a saved config when enabling MCP fails, without a false rollback (35.210931ms)
✔ OpenCode one-button setup surfaces native cancellation with no success and no MCP change (36.014044ms)
✔ OpenCode one-button setup reports a native failure without echoing the credential (35.75356ms)
✔ OpenCode one-button setup ignores a save that resolves after the grant is revoked (64.56254ms)
✔ OpenCode setup without the native bridge offers only the manual fallback (35.474711ms)
✔ BYOK acknowledged reconciles a post-settlement snapshot through Workbench (93.743643ms)
✔ BYOK stored-but-lost reconciles a post-settlement snapshot through Workbench (93.753601ms)
✔ BYOK failed fresh read reconciles a post-settlement snapshot through Workbench (120.745354ms)
✔ workspace ordinary reads coalesce and retain the shared mutation and recovery gates (17.465235ms)
✔ Reply assistant preset grants only explicit chosen accounts and draft tools on Create (25.60236ms)
✔ new commitment template Reply to this email is editable, explicit and source-bound (38.479537ms)
✔ new commitment template Do a task is editable, explicit and source-bound (40.234289ms)
✔ new commitment template Waiting for someone is editable, explicit and source-bound (38.16412ms)
✔ coverage account labels redact known private names without losing coverage state (13.979726ms)
✔ templates keep source subjects out of private text and attributes and explain dates (27.78075ms)
✔ actions explains its purpose (18.569918ms)
✔ calendar explains its purpose (14.041301ms)
✔ agents explains its purpose (8.152084ms)
✔ agent sections preserve setup entries and presets never add immediate creation rights (19.678449ms)
✔ project buttons switch context without saving or combining accounts (19.905762ms)
✔ a project task starts with its project and source, while private email rows hide known names (47.134334ms)
✔ calendar creates an Emc² event, shows it in the grid and day list, and edits or deletes it from the right-hand pane (221.62915ms)
✔ a failed event save keeps the form and retries with the same ID (149.959248ms)
✔ calendar events follow the account filter and hide titles, places and attendees in privacy mode (62.779636ms)
✔ Google Calendar stays opt-in, syncs explicitly, displays read-only remote events and labels stale/consent states (79.961905ms)
✔ Calendar freezes pending event inputs, guards closure and navigation, and retains the identical retry (131.953469ms)
✔ Schedule meeting freezes pending event inputs, guards closure and navigation, and retains the identical retry (164.376226ms)
✔ narrow Calendar Agenda event Back pane close returns focus after the origin renders (96.103078ms)
✔ narrow Calendar Agenda event Back source return returns focus after the origin renders (160.326469ms)
✔ narrow Calendar Agenda event Escape pane close returns focus after the origin renders (154.003576ms)
✔ narrow Calendar Agenda event Escape source return returns focus after the origin renders (239.830853ms)
✔ narrow Calendar Agenda commitment Back pane close returns focus after the origin renders (102.275993ms)
✔ narrow Calendar Agenda commitment Back source return returns focus after the origin renders (119.484581ms)
✔ narrow Calendar Agenda commitment Escape pane close returns focus after the origin renders (104.203987ms)
✔ narrow Calendar Agenda commitment Escape source return returns focus after the origin renders (135.74178ms)
✔ narrow Calendar Agenda snoozed Back pane close returns focus after the origin renders (122.516466ms)
✔ narrow Calendar Agenda snoozed Escape pane close returns focus after the origin renders (182.099575ms)
✔ narrow Calendar Day event Back pane close returns focus after the origin renders (166.506136ms)
✔ narrow Calendar Day event Back source return returns focus after the origin renders (180.391346ms)
✔ narrow Calendar Day event Escape pane close returns focus after the origin renders (122.225425ms)
✔ narrow Calendar Day event Escape source return returns focus after the origin renders (153.418318ms)
✔ narrow Calendar Day commitment Back pane close returns focus after the origin renders (114.7715ms)
✔ narrow Calendar Day commitment Back source return returns focus after the origin renders (245.114014ms)
✔ narrow Calendar Day commitment Escape pane close returns focus after the origin renders (172.640729ms)
✔ narrow Calendar Day commitment Escape source return returns focus after the origin renders (193.569592ms)
✔ narrow Calendar Day snoozed Back pane close returns focus after the origin renders (126.611038ms)
✔ narrow Calendar Day snoozed Escape pane close returns focus after the origin renders (123.323947ms)
✔ narrow Calendar Week event Back pane close returns focus after the origin renders (257.573174ms)
✔ narrow Calendar Week event Back source return returns focus after the origin renders (493.499189ms)
✔ narrow Calendar Week event Escape pane close returns focus after the origin renders (312.166754ms)
✔ narrow Calendar Week event Escape source return returns focus after the origin renders (448.410477ms)
✔ narrow Calendar Week commitment Back pane close returns focus after the origin renders (369.932407ms)
✔ narrow Calendar Week commitment Back source return returns focus after the origin renders (475.002376ms)
✔ narrow Calendar Week commitment Escape pane close returns focus after the origin renders (342.095015ms)
✔ narrow Calendar Week commitment Escape source return returns focus after the origin renders (520.939209ms)
✔ narrow Calendar Week snoozed Back pane close returns focus after the origin renders (359.37834ms)
✔ narrow Calendar Week snoozed Escape pane close returns focus after the origin renders (361.588118ms)
✔ event deletion uses a guarded dialog, retains failure and revision, and restores focus on cancel (182.696961ms)
✔ event deletion response loss restores Calendar focus on Cancel (163.839558ms)
✔ event deletion response loss restores Calendar focus on Escape (245.808267ms)
✔ quitting with a dirty event form uses the same unload guard as a draft (191.735893ms)
✔ complete a waiting task directly from Today, Projects and Calendar (69.080743ms)
✔ task completion preserves an unfinished project decision and its evidence (23.604077ms)
✔ task completion restores focus to the next task (21.900371ms)
✔ task completion preserves focus moved during the request (21.310694ms)
✔ automatic refresh finishes an acknowledged save before task completion (33.727475ms)
✔ Back after completing actions task details restores focus with an empty list (36.310557ms)
✔ Back after completing actions task details restores focus with another task (27.334471ms)
✔ Back after completing projects task details restores focus with an empty list (31.278563ms)
✔ Back after completing projects task details restores focus with another task (30.821262ms)
✔ an unconfirmed completion keeps the task and prevents another write (15.667614ms)
✔ Today status views preserve task identity and distinguish overdue, upcoming and completed work without writes (17.933376ms)
✔ Calendar Day and Week preserve navigation, point labels and cache-only reads (428.077503ms)
✔ Settings backup requires passphrase confirmation and explicit preview confirmation (232.616445ms)
ℹ tests 1655
ℹ suites 0
ℹ pass 1655
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 418032.19079
Post job cleanup.
[command]/usr/bin/tar --posix -cf cache.tzst --exclude cache.tzst -P -C /home/runner/work/aggregate-mail/aggregate-mail --files-from manifest.txt --use-compress-program zstdmt
Failed to save: Unable to reserve cache with key node-cache-Linux-x64-npm-6b14dcece2a75c86d49a0f9c3261d6fda6037d831a60553d12ce9ee0ee0257b8, another job may be creating this cache.
Post job cleanup.
[command]/usr/bin/git version
git version 2.56.0
Temporarily overriding HOME='/home/runner/work/_temp/48f0113a-1a1d-47ef-a0c8-ffecb55748c3' before making global git config changes
Adding repository directory to the temporary git global config as a safe directory
[command]/usr/bin/git config --global --add safe.directory /home/runner/work/aggregate-mail/aggregate-mail
Removing SSH command configuration
[command]/usr/bin/git config --local --name-only --get-regexp core\.sshCommand
[command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"
Removing HTTP extra header
[command]/usr/bin/git config --local --name-only --get-regexp http\.https\:\/\/github\.com\/\.extraheader
[command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'http\.https\:\/\/github\.com\/\.extraheader' && git config --local --unset-all 'http.https://github.com/.extraheader' || :"
Removing includeIf entries pointing to credentials config files
[command]/usr/bin/git config --local --name-only --get-regexp ^includeIf\.gitdir:
[command]/usr/bin/git submodule foreach --recursive git config --local --show-origin --name-only --get-regexp remote.origin.url
Cleaning up orphan processes