Browser immediate actions¶

This inventory follows the approved contract. It describes the existing owner for each mutation and the remaining adoption work. A visible local result is separate from provider confirmation.

Schema 17 extends the existing folder owner to checked Rename, Move and Delete. Reviews freeze exact subtrees and capture at most 50 metadata rows per cache transaction. Each provider acknowledgement is durable before cache repair; unknown rename results never invent UID mappings. A fresh checked recovery can stop tracking while keeping cached mail and receipts, without claiming success. Pending individual/group work, retained Sent roles and frozen outgoing filing destinations exclude conflicting admission. Cross-account and protected special folders require a separate reviewed migration; folder Undo is not offered.

Individual action ownership¶

Folder planning distinguishes confirmed target refusal from unavailable discovery. The gateway returns a tagged rejected plan for shared PlanRejected; the browser retains it for review. Transport errors and malformed observations remain Waiting. Both paths retain the saved request and cannot issue CREATE. Unit, backend and real control regressions cover this distinction.

Schema 18 Calendar work shares the existing fair owner. The event form retains an immutable save or delete request across a lost local reply; retry returns its current saved status before deciding whether the editor may close. A completed create supplies the physical identity for newer edits. Local cancellation cannot wait for an earlier provider request, and cancelled predecessors leave newer saved edits available for review. Refresh, projected events and summary counts have independent stale-result fences.

Integrated verification passes 250 unit tests and 20 Calendar/folder/Preferences Chromium scenarios. The final Calendar/storage gate passes 13, including the root lost-delete-reply rejection test and schema 14/15/16/17 upgrades. These are fixture controls, not live Google or input-to-pixel measurements. Browser CalDAV, timed creation, recurrence editing and complete Calendar Undo remain open.

Acknowledged create/edit Undo passes nine focused journal tests and three actual control scenarios. Inverse admission checks current ownership and receipt identity, survives lost replies and projects before provider work. Deleted events have no Undo control until a provider restoration contract preserves all event metadata. The combined browser suite passes 266 units and the production build.

Mail database schema 13 adds mailActions, owned by BrowserIntents; schema 14 adds connection-attempt removal ownership. Ordinary registration saves its explicit fields, lease revision and original physical identity in the same transaction as field ownership. It stores no MIME, body, password or OAuth data. Group claims continue to use their own journal and do not add individual records. There is no second dispatcher.

Only a queued or waiting individual record may begin dispatch. The existing provider path records Running first; replay of the same started lease is rejected. Its acknowledgment callback saves the actual receipt before fallible cache work. Receipt-bearing records retain Repair through subsequent errors. Successful cache/intent completion retains at most 20 recent successful records for Undo; unrelated success cannot erase a different failure. Unknown results retain Uncertain, while interrupted Running records remain explicit unfinished work, never automatic retries.

Each tab holds a profile-scoped Web Lock for its action owner. A replacement tab resumes only Queued or Waiting records after proving the old owner has released that lock. Adoption checks earlier unresolved work for the account; dispatch checks the saved account configuration and physical source identity. At most four accounts resume concurrently through the existing mutation method. Disconnected IMAP work remains Waiting until reconnect or the periodic check, including newly requested foreground changes. A live tab's queued work cannot be stolen by another tab.

Activity returns at most 20 records plus one continuation key. Admission is bounded at 128 unresolved records and rejects additional work visibly. The existing safe cache repair operation is available for acknowledged receipts; reviewed definite failures can be dismissed. Interrupted or uncertain work has an explicit checked acceptance of current folder state. This retires only its still-owned local intent, without inferring a provider outcome. Account and tab locks refuse that decision while the original owner is active. Group History and Outbox retain their own specialised recovery controls. Account removal includes these records in its review and atomic deletion, and schema fencing closes older writers.

Mailbox queries and captured selections derive pending individual fields inside their existing readonly source snapshot. They inspect at most 148 metadata records and retain only fields still owned by that lease and physical lineage. Waiting, running and uncertain desired state survives reload; this projection does not claim server confirmation. Rejection, cancellation and checked acceptance retire it. Cancellation compares the exact saved record atomically, so a started operation cannot be cancelled as though it never ran. An earlier unresolved operation on the same message field must finish or be reviewed first; cancellation cannot revive an older superseded field decision. Different fields can be cancelled while their predecessor remains active.

Recent changes exposes saved Undo. Inverse admission reserves a new revision in the same transaction that verifies the original receipt and marks its Undo decision. Only fields still owned by the original action are eligible; newer choices survive. The inverse uses the actual acknowledged identity and the existing dispatch path, so it can wait offline, recover after restart or retain its own uncertainty. Unknown move destinations do not enable Undo.

Send, connections and preferences¶

Send first saves the frozen draft and a local queued Outbox record in one transaction. Existing draft locks protect its files and prevent concurrent editing. Its composer closes with an explicit queued notice before reservation, MIME preparation or SMTP. Queued work continues after reconnect/restart through the existing Send method. At most four accounts run concurrently. Preparing or submitting work is never automatically repeated; the original reservation and wire receipt govern recovery. Returning a queued message to Drafts is local and creates a fresh editable identity. Admission failure retains the open editor.

Connection attempts save account configuration, attempt identity and status, never passwords. Activation rechecks that identity under the connection lock after both probes, then commits account settings and retires progress together. Dismissal invalidates an unfinished activation; failure preserves a previously usable connection. Reload shows interrupted/failed attempts and requires password entry before retry. Removal reviews include attempts and atomically clear them. Activity reads at most 21 attempts to display 20 plus an overflow indication, using these same records. Reconnect opens the existing credential controls; dismissal compares the exact captured attempt and cannot retire its replacement. Connection failures and individual mail failures remain independently visible.

Preference values and ownership revisions share one localStorage write. A failed legacy mirror does not undo an admitted choice; failed authoritative admission cannot be acknowledged as a profile application. The existing publication journal preserves exact retries and durable errors independently of this device save. No credential or mail action is imported through preference state.

Preferences retains failed local intent and its own Retry through unrelated mail errors. Retry merges locally edited top-level fields with the latest saved settings and preserves explicit portable intent through a failed change-and-revert. New profile capture/application and sign-out wait for local admission. Preference notices preserve held controls when unrelated errors arrive; remote publication keeps its separate status and journal.

Verification and remaining rollout¶

Drafts retain a session-owned latest revision, save status and file request through closing and navigation. Failed storage retains editable text and Retry; sign-out waits for accepted saves and page leave warns about uncommitted work. Stable Drafts rows preserve held pointer input through late failure. Attachment retry reuses exact identities/bytes after a lost reply, while Use saved attachments reads the current files before retiring a refused request. Successful Send and account removal retire the session. Schema 15 compares the exact observed text/revision under the draft lock and fences older writers. A conflict retains both versions for explicit review; Use saved text and Save my text recheck that observation. Newer saved changes reject stale choices. Unadmitted text remains tab-local.

Focused tests cover atomic admission failure, restart retention, replay refusal, receipt dominance, independent group ownership, bounded pages/admission and account removal. Browser scenarios exercise actual Activity controls and retained errors through unrelated work and reload, immediate admission rejection while earlier work is held, acknowledged cache repair without provider replay, queued continuation after tab loss, offline projection/cancellation, saved Undo after reload and refusal to repeat interrupted dispatch. Desktop and narrow dark Activity screenshots were reviewed. Exact execution evidence belongs in the completion log after integration.

Remaining work includes common summary adapters for the remaining domains, shared WASM lifecycle fixtures and cross-browser execution. Activity reconnect directs users to the existing Preferences controls. This slice does not establish the 100 ms performance target, live provider parity, whole-client memory bounds or mobile/Apple behaviour.