Merge pull request 'Rename the repository to inbuxa-webmail' (#38) from chore/rename-to-inbuxa-webmail into main

The repository moved from inbuxa/ihasmail-inbuxa to inbuxa/inbuxa-webmail,
matching inbuxa-server and inbuxa-admin. Point the source links, the image
name and the package link at the new name. The OAuth client id stays
ihasmail-inbuxa, since that is what the server registers.

.env.example

@@ -75,7 +75,7 @@ APP_NAME=ihasmail
 # you have patched it, point this at your own tree. Shown on the sign-in page
 # and in Settings > About. INBUXA's webmail is itself a modified ihasmail, so
 # the default is this fork.
-SOURCE_URL=https://git.coffeylabs.org/inbuxa/ihasmail-inbuxa
+SOURCE_URL=https://git.coffeylabs.org/inbuxa/inbuxa-webmail
 
 # ---- Settings this installation decides (all optional) ----
 #

.gitea/workflows/announce.yml

@@ -0,0 +1,17 @@
+# Announce each published release on the community forum, in this project's
+# Announcements category (coffey-labs/actions discourse-release; the repo ->
+# category map is its release-map.json). Safe to re-run: one topic per tag.
+name: announce
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  announce:
+    runs-on: light
+    steps:
+      - uses: coffey-labs/actions/discourse-release@e9293996e2efa770839121fa8f8da93083f216be
+        with:
+          api-key: ${{ secrets.DISCOURSE_RELEASE_KEY }}
+          discord-webhook: ${{ secrets.DISCORD_RELEASE_WEBHOOK }}

.gitea/workflows/ci.yml

@@ -1,6 +1,19 @@
 # CI on the self-hosted Gitea, ported from .gitlab-ci.yml during the move off
 # GitLab (2026-09-22). Gitea reads .gitea/workflows and ignores .github/ once
-# this directory exists; .github/workflows stays as it was for GitHub.
+# this directory exists; .github/workflows is the GitHub side, below.
+#
+# WHERE THE BUILD RUNS. Gitea push-mirrors this repository to GitHub, and the
+# org variable BUILD_ON picks which forge does the heavy work:
+#   * unset (or anything but `github`): every job here runs, as it always did,
+#     and GitHub's workflow skips all of its jobs.
+#   * `github`: the test, build and publish jobs here are skipped, GitHub
+#     Actions runs .github/workflows/ci.yml on its hosted runners (native
+#     arm64, no QEMU), and the `github` job below waits for the commit status
+#     that run posts back, passing or failing with it. So this run's result is
+#     still the one that counts, for a PR's checks as for anything that merges
+#     on green CI. The variable is set on both forges, and must agree.
+# If GitHub is ever unavailable, unsetting BUILD_ON here is the whole
+# fallback: the jobs below take over again unchanged.
 #
 # Releases are cut by pushing a tag named `inbuxa-v<version>`, where
 # <version> is what scripts/version.mjs says for the tagged commit with the
@@ -35,6 +48,7 @@ concurrency:
 jobs:
   # -------------------------------------------------------------- test ------
   node:
+    if: ${{ vars.BUILD_ON != 'github' }}
     runs-on: light
     container:
       image: node:26-bookworm-slim@sha256:582460f614631b59b824ac6020533b9bf339c7fdf3a6d7db31abb6b4065f0212 # 26-bookworm-slim
@@ -73,7 +87,7 @@ jobs:
   # equivalent of ci.yml's final `docker build -t ihasmail:ci .` step. The
   # Dockerfile builds everything itself; `needs` only keeps the order.
   docker-build:
-    if: ${{ !startsWith(github.ref, 'refs/tags/') }}
+    if: ${{ vars.BUILD_ON != 'github' && !startsWith(github.ref, 'refs/tags/') }}
     needs: [node]
     runs-on: docker
     container:
@@ -93,7 +107,7 @@ jobs:
   # all agree, and the commit has to be on main, so a release never describes
   # code that was not reviewed onto the default branch.
   version:
-    if: ${{ startsWith(github.ref, 'refs/tags/inbuxa-v') }}
+    if: ${{ vars.BUILD_ON != 'github' && startsWith(github.ref, 'refs/tags/inbuxa-v') }}
     runs-on: light
     container:
       image: node:26-bookworm-slim@sha256:582460f614631b59b824ac6020533b9bf339c7fdf3a6d7db31abb6b4065f0212 # 26-bookworm-slim
@@ -119,13 +133,13 @@ jobs:
           echo "DOCKER_TAG=${V/+/-}" >> "$GITHUB_OUTPUT"
           echo "VERSION=$V DOCKER_TAG=${V/+/-}"
 
-  # Multi-arch image at <REGISTRY>/inbuxa/ihasmail-inbuxa, then the release.
+  # Multi-arch image at <REGISTRY>/inbuxa/inbuxa-webmail, then the release.
   # arm64 is built under QEMU on this amd64 host, which is slow but fine for
   # a hand-cut release. PACKAGE_TOKEN (jcoffey-dev, write:package) logs in:
   # the job's own token is refused by the container registry. The release is
   # created last, so a release on the page always has its image behind it.
   publish:
-    if: ${{ startsWith(github.ref, 'refs/tags/inbuxa-v') }}
+    if: ${{ vars.BUILD_ON != 'github' && startsWith(github.ref, 'refs/tags/inbuxa-v') }}
     needs: [node, version]
     runs-on: docker
     container:
@@ -177,3 +191,57 @@ jobs:
           echo "release $TAG created"
       - if: always()
         run: docker logout "$REGISTRY" || true
+
+  # The release above is made with the job's own token, and Gitea starts no
+  # workflow for events the Actions bot causes -- announce.yml's
+  # 'on: release' never fires for it -- so announce it from here. With
+  # BUILD_ON=github the release is created by GitHub's run instead, and this
+  # follows the `github` job. Announcing stays on Gitea either way; the
+  # action posts once per tag, so a second attempt is a no-op.
+  announce:
+    needs: [publish, github]
+    if: ${{ always() && startsWith(github.ref, 'refs/tags/inbuxa-v') && (needs.publish.result == 'success' || needs.github.result == 'success') }}
+    runs-on: light
+    steps:
+      - uses: coffey-labs/actions/discourse-release@e9293996e2efa770839121fa8f8da93083f216be
+        with:
+          api-key: ${{ secrets.DISCOURSE_RELEASE_KEY }}
+          discord-webhook: ${{ secrets.DISCORD_RELEASE_WEBHOOK }}
+          tag: ${{ github.ref_name }}
+
+  # ------------------------------------------------------------ github ------
+  # With BUILD_ON=github, the work above happens in GitHub Actions, which
+  # posts one commit status back here when it finishes: "github/ci (branch)"
+  # for a branch push, "github/ci (tag)" for a tag. This job waits for that
+  # status on the commit under test -- the PR's head for a pull request -- and
+  # passes or fails with it. Nothing arriving within the timeout means GitHub
+  # never built the commit (a mirror that failed to sync, or GitHub being
+  # down): check the mirror, or unset BUILD_ON to build here.
+  github:
+    if: ${{ vars.BUILD_ON == 'github' }}
+    # Its own runner label with plenty of slots: this job only polls, but holds a slot
+    # for as long as the GitHub build takes, and must not starve the build runners.
+    runs-on: wait
+    timeout-minutes: 150
+    container:
+      image: node:26-bookworm-slim@sha256:582460f614631b59b824ac6020533b9bf339c7fdf3a6d7db31abb6b4065f0212 # 26-bookworm-slim
+    env:
+      TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+      CONTEXT: github/ci (${{ github.ref_type == 'tag' && format('tag {0}', github.ref_name) || 'branch' }})
+    steps:
+      - run: apt-get update -qq && apt-get install -y -qq --no-install-recommends ca-certificates curl jq >/dev/null
+      - shell: bash
+        run: |
+          set -uo pipefail
+          url="$CI_SERVER_INTERNAL/api/v1/repos/$GITHUB_REPOSITORY/commits/$SHA/statuses?limit=50"
+          echo "waiting for '$CONTEXT' on $SHA"
+          while :; do
+            state="$(curl -fsS -H "Authorization: token $TOKEN" "$url" \
+                     | jq -r --arg c "$CONTEXT" '[.[] | select(.context == $c)] | sort_by(.id) | last | .status // empty')"
+            case "$state" in
+              success) echo "GitHub reported success"; exit 0 ;;
+              failure|error) echo "GitHub reported $state -- see the status's link for the run" >&2; exit 1 ;;
+            esac
+            sleep 20
+          done

.github/dependabot.yml

@@ -1,44 +0,0 @@
-version: 2
-updates:
-  # The npm entry sits at the root because that is where the single lockfile
-  # is: root, server and web are one npm workspace, so one entry covers all
-  # three. Pointing entries at server/ or web/ would find package.json files
-  # with no lockfile beside them and update nothing.
-  - package-ecosystem: npm
-    directory: "/"
-    schedule:
-      interval: weekly
-      day: tuesday
-      time: "09:00"
-      timezone: Etc/UTC
-    open-pull-requests-limit: 5
-    groups:
-      # Everything routine arrives as one PR a week, so the dashboard is not
-      # the only place these get noticed. Majors are deliberately left out of
-      # the group: they are migrations, not bumps -- vitest 3 to 4 is one --
-      # and each deserves its own PR and its own CI run.
-      minor-and-patch:
-        update-types:
-          - minor
-          - patch
-  - package-ecosystem: github-actions
-    directory: "/"
-    schedule:
-      interval: weekly
-      day: tuesday
-      time: "09:00"
-      timezone: Etc/UTC
-    groups:
-      actions:
-        patterns:
-          - "*"
-  # The runtime and build stages both pin node:22-alpine, so this is what
-  # keeps the published container images off a stale base between the weekly
-  # releases.
-  - package-ecosystem: docker
-    directory: "/"
-    schedule:
-      interval: weekly
-      day: tuesday
-      time: "09:00"
-      timezone: Etc/UTC

.github/workflows/ci.yml

@@ -1,39 +1,345 @@
-name: CI
+# CI and publishing on GitHub Actions, for a repository whose source of truth
+# is the self-hosted Gitea. Gitea push-mirrors every commit and tag here, and
+# this workflow does the heavy work on GitHub's hosted runners -- native arm64
+# included -- then reports the result back to Gitea as a commit status.
+#
+# THE SWITCH. Every job here runs only when the org variable BUILD_ON is
+# `github`. Gitea's .gitea/workflows/ci.yml reads the same variable (set on
+# the Gitea org too): with it set, Gitea skips its own build jobs and waits for
+# the status this workflow posts; without it, Gitea builds everything itself,
+# exactly as before, and every job here is skipped. If GitHub is ever
+# unavailable, unsetting BUILD_ON on Gitea is the whole fallback.
+#
+# There is no pull_request trigger: pull requests live on Gitea. A PR's branch
+# arrives here as an ordinary push, and the status lands on its head commit,
+# which is where Gitea's PR looks for it.
+#
+# Releases are cut by pushing a tag named `inbuxa-v<version>` (see
+# .gitea/workflows/ci.yml for why the prefix matters: this repository carries
+# upstream ihasmail's own `v...` tags, and only `inbuxa-v` tags publish).
+#
+# Org configuration, not in this file:
+#   vars.BUILD_ON     `github` to build here
+#   vars.REGISTRY     the Gitea container registry's DNS-only name
+#   vars.GITEA_URL    Gitea's public URL, for statuses, releases and packages
+#   secrets.GITEA_TOKEN  jcoffey-dev, write:repository + write:package
+#
+# Every `uses:` is pinned to a full commit SHA with the release in the
+# trailing comment. A tag is a mutable pointer, so trusting `@v7` is trusting
+# every future version of that action. Do not "simplify" a pin back to a tag.
+name: ci
+
 on:
   push:
-    branches: [main]
-  pull_request:
-  # Lets CI be run by hand against any ref, including a specific commit.
-  # Without this there is no way to re-run a check that never started: a run
-  # GitHub queues and then orphans -- as it did to every run created during the
-  # Actions outage on 2026-08-26 -- can be neither rerun ("already running")
-  # nor canceled ("already completed"), and the workflow has no other trigger
-  # to reach for. Useful too for putting a check on a commit that predates a CI
-  # change, without pushing an empty commit to move it.
+    branches: ['**']
+    tags: ['**']
   workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  GITEA_URL: ${{ vars.GITEA_URL }}
+  REGISTRY: ${{ vars.REGISTRY }}
+  # A registry path must be lowercase; the repository name already is.
+  IMAGE: ${{ vars.REGISTRY }}/inbuxa/inbuxa-webmail
+  # A tag's context names the tag: upstream v* and inbuxa-v* tags can sit on
+  # the same commit, and Gitea must not read one tag's result as the other's.
+  STATUS_CONTEXT: github/ci (${{ github.ref_type == 'tag' && format('tag {0}', github.ref_name) || 'branch' }})
+
 jobs:
-  build:
+  # Tells Gitea a result is on its way, so a PR shows the check as running
+  # rather than missing.
+  pending:
+    if: ${{ vars.BUILD_ON == 'github' }}
+    runs-on: ubuntu-latest
+    steps:
+      - env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          jq -n --arg c "$STATUS_CONTEXT" \
+                --arg u "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" \
+                '{state:"pending", context:$c, target_url:$u, description:"GitHub Actions"}' \
+          | curl -fsS -o /dev/null -X POST -H "Authorization: token $GITEA_TOKEN" \
+                 -H "Content-Type: application/json" --data @- \
+                 "$GITEA_URL/api/v1/repos/$GITHUB_REPOSITORY/statuses/$GITHUB_SHA"
+
+  # -------------------------------------------------------------- test ------
+  # version.test.ts shells out to git to resolve a build version from the
+  # history, so the checkout is a full one. The hosted runner runs as an
+  # unprivileged user, so config.test.ts's read-only directory holds here
+  # without the `su node` Gitea needs.
+  node:
+    if: ${{ vars.BUILD_ON == 'github' }}
     runs-on: ubuntu-latest
     steps:
-      # Every `uses:` in this repository is pinned to a full commit SHA, with
-      # the release it belongs to in the trailing comment, and the repository
-      # requires it -- an unpinned ref fails the run rather than quietly
-      # resolving. A tag is a mutable pointer: `@v7` is whatever the publisher
-      # last moved it to, so trusting one is trusting every future version of
-      # that action, including the one pushed by whoever compromises the
-      # account. Read the comment for the version; the SHA is what runs.
-      #
-      # Dependabot updates both halves together on its weekly github-actions
-      # run, so this costs nothing to keep current -- do not "simplify" a pin
-      # back to a tag.
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 26
           cache: npm
+      # --ignore-scripts: a postinstall script in any transitive dependency
+      # would otherwise run with the job's credentials in its environment.
       - run: npm ci --ignore-scripts
       - run: npm run typecheck
       - run: npm test
       - run: npm run build
-      - name: Docker build
-        run: docker build -t ihasmail:ci .
+
+  # ------------------------------------------------------------- build ------
+  # Proves the Dockerfile still builds on every change, without pushing.
+  docker-build:
+    if: ${{ vars.BUILD_ON == 'github' && github.ref_type == 'branch' }}
+    needs: [node]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - run: docker build -t "ihasmail:ci-${GITHUB_SHA::8}" .
+
+  # ----------------------------------------------------------- release ------
+  # Only for `inbuxa-v` tags. The tag has to name its own commit's version, so
+  # the image, the release and the About screen all agree, and the commit has
+  # to be on main, so a release never describes code that was not reviewed
+  # onto the default branch.
+  version:
+    if: ${{ vars.BUILD_ON == 'github' && startsWith(github.ref, 'refs/tags/inbuxa-v') }}
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.v.outputs.version }}
+      docker_tag: ${{ steps.v.outputs.docker_tag }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 26
+      - id: v
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          V="$(node scripts/version.mjs)"
+          want="inbuxa-v${V/+/-}"
+          [ "$TAG" = "$want" ] || { echo "::error::$TAG does not name this commit's version; expected $want"; exit 1; }
+          git merge-base --is-ancestor "$(git rev-parse "${TAG}^{commit}")" origin/main \
+            || { echo "::error::$TAG is not on main"; exit 1; }
+          echo "version=$V" >> "$GITHUB_OUTPUT"
+          # A Docker tag may not contain '+', so build metadata becomes '-'.
+          echo "docker_tag=${V/+/-}" >> "$GITHUB_OUTPUT"
+          echo "version $V -> tag ${V/+/-}"
+
+  # Each architecture on its own native runner, pushed as an untagged image by
+  # digest; `publish` joins the two digests into one multi-arch tag.
+  build:
+    if: ${{ vars.BUILD_ON == 'github' && startsWith(github.ref, 'refs/tags/inbuxa-v') }}
+    needs: [node, version]
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: linux/amd64
+            runner: ubuntu-latest
+          - platform: linux/arm64
+            runner: ubuntu-24.04-arm
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: ${{ vars.REGISTRY }}
+          username: jcoffey-dev
+          password: ${{ secrets.GITEA_TOKEN }}
+      - name: Build and push by digest
+        id: push
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
+        with:
+          context: .
+          platforms: ${{ matrix.platform }}
+          build-args: IHASMAIL_VERSION=${{ needs.version.outputs.version }}
+          # Attestations add manifests of their own to the index, and
+          # `imagetools create` below expects the two entries pushed here.
+          provenance: false
+          sbom: false
+          cache-from: type=gha,scope=${{ matrix.platform }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.platform }}
+          outputs: type=image,name=${{ env.IMAGE }},push-by-digest=true,name-canonical=true,push=true
+      - name: Save the digest
+        env:
+          DIGEST: ${{ steps.push.outputs.digest }}
+        run: |
+          mkdir -p /tmp/digests
+          # Bare hash as the filename; the prefix is put back when joining.
+          touch "/tmp/digests/${DIGEST#sha256:}"
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: digest-${{ strategy.job-index }}
+          path: /tmp/digests/*
+          # Kept a week, and overwritable, so a re-run of the build or of
+          # publish alone still finds (or replaces) the digests.
+          retention-days: 7
+          overwrite: true
+          if-no-files-found: error
+
+  # Joins the digests into `:<version>` and `:latest`, links the package to
+  # the repository on Gitea, then creates the release there -- last, so a
+  # release on the page always has its image behind it. The release is made
+  # with GITEA_TOKEN, a user's token, so Gitea's announce.yml fires for it;
+  # Gitea's ci.yml announces as well once this run's status arrives, and the
+  # announce action posts once per tag whichever gets there first.
+  publish:
+    if: ${{ vars.BUILD_ON == 'github' && startsWith(github.ref, 'refs/tags/inbuxa-v') }}
+    needs: [version, build]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          path: /tmp/digests
+          pattern: digest-*
+          merge-multiple: true
+      - uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: ${{ vars.REGISTRY }}
+          username: jcoffey-dev
+          password: ${{ secrets.GITEA_TOKEN }}
+      - name: Create the manifest
+        env:
+          DOCKER_TAG: ${{ needs.version.outputs.docker_tag }}
+        run: |
+          refs=()
+          for f in /tmp/digests/*; do refs+=("${IMAGE}@sha256:$(basename "$f")"); done
+          docker buildx imagetools create -t "${IMAGE}:${DOCKER_TAG}" -t "${IMAGE}:latest" "${refs[@]}"
+          docker buildx imagetools inspect "${IMAGE}:${DOCKER_TAG}"
+      # Shows the package on the repository's Packages tab. Idempotent.
+      - env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          curl -fsS -o /dev/null -X POST -H "Authorization: token $GITEA_TOKEN" \
+            "$GITEA_URL/api/v1/packages/inbuxa/container/inbuxa-webmail/-/link/inbuxa-webmail" \
+            || echo "package already linked (or link refused); not fatal"
+      - env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          TAG: ${{ github.ref_name }}
+          VERSION: ${{ needs.version.outputs.version }}
+          DOCKER_TAG: ${{ needs.version.outputs.docker_tag }}
+        run: |
+          set -eu
+          API="$GITEA_URL/api/v1/repos/$GITHUB_REPOSITORY/releases"
+          # A re-run finds the release already there.
+          if curl -fsS -o /dev/null -H "Authorization: token $GITEA_TOKEN" "$API/tags/$TAG"; then
+            echo "release $TAG already exists"; exit 0
+          fi
+          body="$(printf 'INBUXA webmail %s.\n\nImage: `%s:%s` (linux/amd64, linux/arm64), also tagged `latest`.' "$VERSION" "$IMAGE" "$DOCKER_TAG")"
+          jq -n --arg tag "$TAG" --arg body "$body" '{tag_name:$tag, name:$tag, body:$body}' \
+          | curl -fsS -o /dev/null -H "Authorization: token $GITEA_TOKEN" -H "Content-Type: application/json" \
+                 --data @- "$API"
+          echo "release $TAG created"
+
+  # ------------------------------------------------------ ghcr replica ------
+  # Copies the release image from the Gitea registry, which stays the
+  # authoritative one, to ghcr.io under the same version tag and :latest. It is
+  # a copy, not a second build: the digest on GHCR is the digest on the
+  # registry, so `docker pull ghcr.io/...` gets exactly the same image. Left
+  # out of the report to Gitea, like the release copy, so a GHCR problem
+  # cannot fail a release.
+  ghcr:
+    if: ${{ vars.BUILD_ON == 'github' && github.ref_type == 'tag' }}
+    needs: [version, publish]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ needs.version.outputs.docker_tag }}
+        run: |
+          set -euo pipefail
+          src="${{ vars.REGISTRY }}/${GITHUB_REPOSITORY,,}"
+          dst="ghcr.io/${GITHUB_REPOSITORY,,}"
+          tag="$TAG"
+          echo "$GH_TOKEN" | docker login ghcr.io -u "$GITHUB_ACTOR" --password-stdin
+          docker buildx imagetools create -t "$dst:$tag" -t "$dst:latest" "$src:$tag"
+          want="$(docker buildx imagetools inspect "$src:$tag" --format '{{json .Manifest.Digest}}')"
+          got="$(docker buildx imagetools inspect "$dst:$tag" --format '{{json .Manifest.Digest}}')"
+          echo "registry $src:$tag = $want"
+          echo "ghcr     $dst:$tag = $got"
+          [ "$want" = "$got" ] || echo "::warning::GHCR digest differs from the registry's"
+          docker logout ghcr.io
+
+  # ---------------------------------------------------- github release ------
+  # Copies this tag's Gitea release -- notes and files -- to a GitHub release,
+  # so the replica's Releases page, and anyone watching it, keeps up. Gitea's
+  # release is the real one; this is left out of the report to Gitea, so a
+  # failure here cannot fail a release. PR and issue numbers in the notes are
+  # rewritten to Gitea links: on GitHub a bare #16 is some other PR.
+  github-release:
+    if: ${{ vars.BUILD_ON == 'github' && github.ref_type == 'tag' }}
+    needs: [publish]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    env:
+      GITEA_URL: ${{ vars.GITEA_URL }}
+      GH_TOKEN: ${{ github.token }}
+      TAG: ${{ github.ref_name }}
+    steps:
+      - run: |
+          set -euo pipefail
+          if gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            echo "GitHub already has a release for $TAG"; exit 0
+          fi
+          # The Gitea release exists by now if this run made it; if the weekly
+          # release job made it, it came before the tag. Allow a few minutes.
+          code=0
+          for _ in $(seq 1 15); do
+            code="$(curl -sS -o rel.json -w '%{http_code}' "$GITEA_URL/api/v1/repos/$GITHUB_REPOSITORY/releases/tags/$TAG")"
+            [ "$code" = 200 ] && break
+            sleep 20
+          done
+          if [ "$code" != 200 ]; then echo "No Gitea release for $TAG; nothing to copy"; exit 0; fi
+          if [ "$(jq -r .draft rel.json)" = true ]; then echo "The Gitea release is a draft; not copying"; exit 0; fi
+          export BASE="$(jq -r '.html_url | sub("/releases/tag/.*$"; "")' rel.json)"
+          jq -r '.body // ""' rel.json | perl -pe 's{(?<![\w/&\[])#(\d+)\b}{[#$1]($ENV{BASE}/pulls/$1)}g' > notes.md
+          printf '\n\n_Mirrored from [the Gitea release](%s); report issues on [Gitea](%s/issues)._\n' \
+            "$(jq -r .html_url rel.json)" "$BASE" >> notes.md
+          files=()
+          mkdir -p files
+          while IFS=$'\t' read -r name url; do
+            curl -fsSL -o "files/$name" "$url"; files+=("files/$name")
+          done < <(jq -r '.assets[]? | [.name, .browser_download_url] | @tsv' rel.json)
+          title="$(jq -r '.name // ""' rel.json)"; [ -n "$title" ] || title="$TAG"
+          if [ "$(jq -r .prerelease rel.json)" = true ]; then kind=--prerelease; else kind=--latest; fi
+          gh release create "$TAG" --repo "$GITHUB_REPOSITORY" --verify-tag --title "$title" \
+            --notes-file notes.md "$kind" "${files[@]}"
+          echo "created the GitHub release for $TAG with ${#files[@]} file(s)"
+
+  # One commit status on Gitea for the whole run: what Gitea's ci.yml waits
+  # for, and what a Gitea PR shows.
+  report:
+    if: ${{ always() && vars.BUILD_ON == 'github' }}
+    needs: [pending, node, docker-build, version, build, publish]
+    runs-on: ubuntu-latest
+    steps:
+      - env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          STATE: ${{ contains(needs.*.result, 'failure') && 'failure' || (contains(needs.*.result, 'cancelled') && 'cancelled' || 'success') }}
+        run: |
+          # A cancelled run was superseded by a newer run for the same commit (the
+          # mirror can push one commit twice); that run reports. Posting "failure"
+          # here would fail the Gitea check while the real build is still going.
+          if [ "$STATE" = cancelled ]; then echo "cancelled: leaving the result to the newer run"; exit 0; fi
+          jq -n --arg s "$STATE" --arg c "$STATUS_CONTEXT" \
+                --arg u "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" \
+                '{state:$s, context:$c, target_url:$u, description:"GitHub Actions"}' \
+          | curl -fsS -o /dev/null -X POST -H "Authorization: token $GITEA_TOKEN" \
+                 -H "Content-Type: application/json" --data @- \
+                 "$GITEA_URL/api/v1/repos/$GITHUB_REPOSITORY/statuses/$GITHUB_SHA"
+          echo "reported $STATE as '$STATUS_CONTEXT'"

.github/workflows/cleanup.yml

@@ -1,69 +0,0 @@
-# Prune old image versions from GHCR.
-#
-# Releases are kept forever -- they carry no assets and their generated notes
-# are this project's only changelog, so deleting one destroys history that
-# cannot be reconstructed for nothing saved. Images are the opposite: a
-# multi-arch build a week, and the by-digest push in publish.yml leaves two
-# untagged per-architecture manifests behind each time on top of the tagged
-# index. Those accumulate and nobody wants fifty of them.
-#
-# THE FOOTGUN: the obvious tool for this -- delete-package-versions with
-# `delete-only-untagged-versions` -- will happily delete the per-architecture
-# manifests that a multi-arch tag points *at*, because they are untagged by
-# design. Nothing appears to break: the tag still exists, and pulls simply
-# start failing for one architecture. This action understands manifest lists
-# and will not orphan a retained index, and `validate` re-checks every
-# multi-arch manifest against the registry afterwards.
-#
-# Separate from publish.yml, and dispatchable on its own, so `dry_run` can show
-# exactly what would be deleted without rebuilding and re-pushing an image to
-# find out.
-name: Prune images
-
-on:
-  workflow_call:
-    inputs:
-      dry_run:
-        type: boolean
-        default: false
-  workflow_dispatch:
-    inputs:
-      dry_run:
-        description: "List what would be deleted, delete nothing"
-        type: boolean
-        default: true
-
-jobs:
-  prune:
-    runs-on: ubuntu-latest
-    permissions:
-      packages: write
-    steps:
-      # The only third-party action here that is not published by GitHub or
-      # Docker, and the one with the most to lose: it is handed
-      # `packages: write` and its whole job is deletion, so a ref repointed at
-      # something else -- by a compromise or a mistake upstream -- is a bad
-      # day. It was pinned to a commit long before the rest of them were.
-      - uses: dataaxiom/ghcr-cleanup-action@d52806a0dc70b430571a37da1fde39733ffd640f # v1.2.2
-        with:
-          owner: Coffey-Labs
-          package: ihasmail
-          token: ${{ secrets.GITHUB_TOKEN }}
-          # Ten weekly releases is roughly a quarter of history, which is more
-          # than enough to roll back to and far less than the year's worth that
-          # would otherwise pile up. Older *releases* stay either way; this
-          # only removes the images.
-          keep-n-tagged: 10
-          # Belt and braces on top of the action's own manifest awareness:
-          # `latest` is never a candidate for deletion under any counting.
-          exclude-tags: latest
-          delete-untagged: true
-          # Sweeps the wreckage of a half-failed run: an index whose platform
-          # images did not all land, and referrers whose parent is gone.
-          delete-partial-images: true
-          delete-orphaned-images: true
-          # Checks every remaining multi-architecture manifest still resolves
-          # in the registry. This is the step that would catch the footgun
-          # above rather than leaving a reader to discover it on `docker pull`.
-          validate: true
-          dry-run: ${{ inputs.dry_run }}

.github/workflows/publish.yml

@@ -1,206 +0,0 @@
-# Publish the container image to GHCR.
-#
-# The README and the docs site have told people to run
-# `ghcr.io/coffey-labs/ihasmail:latest` for a long time, and nothing ever
-# pushed it: `docker pull` answered `denied`, because the package did not
-# exist. This is the workflow that makes those instructions true. It is also
-# the prerequisite for the self-hosted app catalogs -- TrueNAS and Unraid
-# both install by pulling an image and neither builds from source.
-#
-# FIRST RUN: a package GHCR creates for the first time is **private**, even in
-# a public repository, and an anonymous `docker pull` will still answer
-# `denied`. Nothing in a workflow can change that -- the visibility is set once
-# by hand under the package's settings, and until it is, this looks like it
-# worked while the docs stay just as wrong as before. Check with a logged-out
-# pull, not with one from a machine that has credentials.
-#
-# Two architectures, each built on its own native runner rather than under
-# QEMU. Emulated arm64 has to run `npm ci` and the Vite build through
-# instruction translation, which takes tens of minutes and occasionally runs
-# out of memory; `ubuntu-24.04-arm` is free for public repositories and does
-# the same work at native speed. The cost is the by-digest dance below: each
-# runner pushes an untagged image, and a final job joins the two digests into
-# one multi-arch tag.
-name: Publish image
-
-on:
-  release:
-    types: [published]
-  # Callable, so release.yml can build the release it just cut. This is not a
-  # stylistic choice: a release created with GITHUB_TOKEN does **not** raise a
-  # `release` event -- GitHub refuses to let a token trigger another workflow,
-  # to stop a workflow looping on its own output. A scheduled job that cut a
-  # release and expected this file to notice would silently never publish. The
-  # alternatives are a personal access token kept as a secret, or calling the
-  # workflow directly. This is the one that needs no credential.
-  workflow_call:
-    inputs:
-      ref:
-        description: "Tag, branch or SHA to build"
-        required: true
-        type: string
-      tag_latest:
-        description: "Also move :latest to this build"
-        type: boolean
-        default: false
-  # Same reasoning as ci.yml's dispatch trigger: a run GitHub queues and then
-  # orphans can be neither rerun nor canceled, and this workflow otherwise
-  # only fires on a release -- which is not something to cut twice because a
-  # runner died. `ref` also allows publishing an image for a tag that predates
-  # this workflow, which is how the first one gets built.
-  workflow_dispatch:
-    inputs:
-      ref:
-        description: "Tag, branch or SHA to build"
-        required: true
-        default: main
-      tag_latest:
-        description: "Also move :latest to this build"
-        type: boolean
-        default: false
-
-env:
-  # Hardcoded rather than derived from github.repository: a registry path must
-  # be lowercase and the owner is spelled `Coffey-Labs`, so deriving it means
-  # remembering to lowercase it. This is the string the docs already name.
-  # inbuxa: this fork publishes to INBUXA's own path. Inherited from public
-  # ihasmail, which publishes ghcr.io/coffey-labs/ihasmail -- leaving that
-  # here would push INBUXA's webmail over the image every public ihasmail
-  # install pulls, which SPEC.md 5 exists to prevent.
-  IMAGE: ghcr.io/inbuxa/ihasmail-inbuxa
-
-jobs:
-  # The version is worked out once and handed to both builds, so the two
-  # architectures cannot disagree about what they are. scripts/version.mjs
-  # reads the commit date and how the commit arrived, so it needs real history
-  # rather than a shallow clone.
-  version:
-    runs-on: ubuntu-latest
-    outputs:
-      version: ${{ steps.v.outputs.version }}
-      docker_tag: ${{ steps.v.outputs.docker_tag }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ inputs.ref || github.ref }}
-          fetch-depth: 0
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 26
-      - id: v
-        run: |
-          V="$(node scripts/version.mjs)"
-          echo "version=$V" >> "$GITHUB_OUTPUT"
-          # A Docker tag may not contain '+', so build metadata becomes '-'.
-          # The build is still *told* the real form, which is what About and
-          # /api/health report.
-          echo "docker_tag=${V/+/-}" >> "$GITHUB_OUTPUT"
-          echo "version $V -> tag ${V/+/-}"
-
-  build:
-    needs: version
-    runs-on: ${{ matrix.runner }}
-    permissions:
-      contents: read
-      packages: write
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - platform: linux/amd64
-            runner: ubuntu-latest
-          - platform: linux/arm64
-            runner: ubuntu-24.04-arm
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ inputs.ref || github.ref }}
-      - uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
-      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build and push by digest
-        id: push
-        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
-        with:
-          context: .
-          platforms: ${{ matrix.platform }}
-          build-args: IHASMAIL_VERSION=${{ needs.version.outputs.version }}
-          # Attestations are off deliberately: they add manifests of their own
-          # to the index, and `imagetools create` below expects the two entries
-          # it pushed rather than four.
-          provenance: false
-          sbom: false
-          cache-from: type=gha,scope=${{ matrix.platform }}
-          cache-to: type=gha,mode=max,scope=${{ matrix.platform }}
-          outputs: type=image,name=${{ env.IMAGE }},push-by-digest=true,name-canonical=true,push=true
-      - name: Save the digest
-        run: |
-          mkdir -p /tmp/digests
-          # The prefix is stripped here and put back in the merge job, so the
-          # filename is the bare hash. Leaving it on produces
-          # `image@sha256:sha256:...` when the reference is rebuilt.
-          digest="${{ steps.push.outputs.digest }}"
-          touch "/tmp/digests/${digest#sha256:}"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          # One artifact per platform; the merge job globs them back together.
-          name: digest-${{ strategy.job-index }}
-          path: /tmp/digests/*
-          retention-days: 1
-          if-no-files-found: error
-
-  # Joins the per-architecture digests into a single tagged manifest, so
-  # `docker pull ghcr.io/coffey-labs/ihasmail:<tag>` resolves on both.
-  publish:
-    needs: [version, build]
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          path: /tmp/digests
-          pattern: digest-*
-          merge-multiple: true
-      - uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
-      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Create the manifest
-        run: |
-          # Arrays rather than a string: the tags and the digest references
-          # have to reach docker as separate arguments, and building them by
-          # word-splitting an unquoted variable is the version of this that
-          # breaks the day a value contains a space.
-          tags=(-t "${IMAGE}:${{ needs.version.outputs.docker_tag }}")
-          # :latest follows real releases only. A prerelease that moved it
-          # would hand every `:latest` deployment an unfinished build, and a
-          # dispatch run has to ask for it on purpose.
-          if [ "${{ github.event_name }}" = "release" ] && [ "${{ github.event.release.prerelease }}" = "false" ]; then
-            tags+=(-t "${IMAGE}:latest")
-          elif [ "${{ inputs.tag_latest }}" = "true" ]; then
-            tags+=(-t "${IMAGE}:latest")
-          fi
-          refs=()
-          for f in /tmp/digests/*; do
-            refs+=("${IMAGE}@sha256:$(basename "$f")")
-          done
-          echo "tags: ${tags[*]}"
-          echo "refs: ${refs[*]}"
-          docker buildx imagetools create "${tags[@]}" "${refs[@]}"
-      - name: Show what landed
-        run: docker buildx imagetools inspect "${IMAGE}:${{ needs.version.outputs.docker_tag }}"
-
-  # Runs only after a successful publish, because that is the only moment the
-  # package grows. See cleanup.yml for why this is not the obvious one-liner.
-  prune:
-    needs: publish
-    permissions:
-      packages: write
-    uses: ./.github/workflows/cleanup.yml

.github/workflows/release.yml

@@ -1,163 +0,0 @@
-# Cut a release once a week, but only if there is something in it.
-#
-# Releases had drifted 184 commits behind main, which made `:latest` describe
-# a build nobody was running -- the demo, prod and anyone building from source
-# were all ahead of it. Publishing on release is the right trigger only if
-# releases actually happen, so this is the part that makes that true without
-# anyone having to remember.
-#
-# It does nothing on a quiet week. A release with no commits in it is worse
-# than no release: it moves `:latest` to an identical build, spends a version
-# number, and mails everybody watching the repository about nothing.
-name: Weekly release
-
-on:
-  schedule:
-    # Mondays, 09:17 UTC. GitHub runs scheduled jobs on a best-effort basis and
-    # can delay a run by a good while when the queue is busy, so do not read
-    # the exact minute as a promise. The odd minute is deliberate: the top of
-    # the hour is when most schedules fire, and at 09:00 the first scheduled
-    # run started almost six hours late and the second had not started at all
-    # four and a half hours in. Moving off the hour does not make GitHub keep
-    # time, but it stops competing for the busiest slot. A missed week can be
-    # cut by hand with workflow_dispatch; a late scheduled run that follows
-    # finds the tag already there and does nothing.
-    #
-    # Note also that GitHub disables scheduled workflows in a repository with
-    # no activity for 60 days -- not a concern while this one is being worked
-    # on weekly, but it is why a silent stop is worth checking for before
-    # assuming the file is broken.
-    - cron: "17 9 * * 1"
-  workflow_dispatch:
-    inputs:
-      dry_run:
-        description: "Work out what would be released, then stop"
-        type: boolean
-        default: false
-
-# One at a time. Two overlapping runs would race to create the same tag, and
-# the loser fails noisily for a reason that has nothing to do with the code.
-concurrency:
-  group: weekly-release
-  cancel-in-progress: false
-
-jobs:
-  check:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    outputs:
-      should_release: ${{ steps.decide.outputs.should_release }}
-      tag: ${{ steps.decide.outputs.tag }}
-      title: ${{ steps.decide.outputs.title }}
-      sha: ${{ steps.decide.outputs.sha }}
-      previous: ${{ steps.decide.outputs.previous }}
-      count: ${{ steps.decide.outputs.count }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: main
-          fetch-depth: 0
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 26
-      - id: decide
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-
-          # The newest published release, or empty on a repository that has
-          # never had one -- in which case everything counts as new. Drafts are
-          # excluded: an unpublished draft is not a release anybody has, so
-          # counting from it would hide commits that have never shipped.
-          previous="$(gh release list --limit 1 --exclude-drafts --json tagName --jq '.[0].tagName // ""')"
-          # A tag named by a release is normally present after a full checkout,
-          # but a release can outlive its tag. Falling back to the whole
-          # history is the safe direction to be wrong in: it over-counts, which
-          # cuts a release that was due anyway, where under-counting would skip
-          # one that was.
-          if [ -n "$previous" ] && git rev-parse -q --verify "refs/tags/${previous}" >/dev/null; then
-            count="$(git rev-list --count "${previous}..HEAD")"
-          else
-            count="$(git rev-list --count HEAD)"
-          fi
-
-          version="$(node scripts/version.mjs)"
-          # A Docker tag may not contain '+', and neither should the git tag,
-          # so the two always agree about what to call a build.
-          tag="v${version/+/-}"
-          title="v${version%%+*}"
-          sha="$(git rev-parse HEAD)"
-
-          should_release=true
-          reason=""
-          if [ "$count" -eq 0 ]; then
-            should_release=false
-            reason="no commits since ${previous}"
-          elif git rev-parse -q --verify "refs/tags/${tag}" >/dev/null; then
-            # Same commit, different week: the version is derived from the
-            # commit, so nothing new means the tag already exists.
-            should_release=false
-            reason="tag ${tag} already exists"
-          fi
-
-          {
-            echo "should_release=$should_release"
-            echo "tag=$tag"
-            echo "title=$title"
-            echo "sha=$sha"
-            echo "previous=$previous"
-            echo "count=$count"
-          } >> "$GITHUB_OUTPUT"
-
-          # Written to the run summary so a skipped week reads as a decision
-          # rather than as a workflow that quietly did nothing.
-          {
-            echo "### Weekly release"
-            echo
-            if [ "$should_release" = "true" ]; then
-              echo "Releasing **${tag}** — ${count} commit(s) since ${previous:-the beginning}."
-            else
-              echo "Nothing to release: ${reason}."
-            fi
-          } >> "$GITHUB_STEP_SUMMARY"
-
-  cut:
-    needs: check
-    if: needs.check.outputs.should_release == 'true' && !inputs.dry_run
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: main
-          fetch-depth: 0
-      - env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-          args=(--target "${{ needs.check.outputs.sha }}"
-                --title "${{ needs.check.outputs.title }}"
-                --generate-notes)
-          # Bound the notes to what is actually new. Without a start tag the
-          # generator reaches back to whatever it decides is previous, which on
-          # a repository with older tag shapes is not always the last release.
-          if [ -n "${{ needs.check.outputs.previous }}" ]; then
-            args+=(--notes-start-tag "${{ needs.check.outputs.previous }}")
-          fi
-          gh release create "${{ needs.check.outputs.tag }}" "${args[@]}"
-
-  # Called rather than left to the `release` trigger on purpose: see the note
-  # at the top of publish.yml. A release created with GITHUB_TOKEN raises no
-  # event, so without this the tag would exist and no image would follow it.
-  publish:
-    needs: [check, cut]
-    permissions:
-      contents: read
-      packages: write
-    uses: ./.github/workflows/publish.yml
-    with:
-      ref: ${{ needs.check.outputs.sha }}
-      tag_latest: true

README.md

@@ -8,6 +8,12 @@
   <a href="LICENSE"><img alt="License: AGPL-3.0-or-later" src="https://img.shields.io/badge/license-AGPL--3.0--or--later-2dd4bf?style=flat-square"></a>
 </p>
 
+> [!NOTE]
+> Development happens on [git.coffeylabs.org/inbuxa/inbuxa-webmail](https://git.coffeylabs.org/inbuxa/inbuxa-webmail); the copy on GitHub is a read-only mirror.
+> Report issues at **[git.coffeylabs.org/inbuxa/inbuxa-webmail/issues](https://git.coffeylabs.org/inbuxa/inbuxa-webmail/issues)**, and join discussions at **[community.coffeylabs.org](https://community.coffeylabs.org)**.
+>
+> This repository was called `ihasmail-inbuxa` until October 2026. Container images are now published as `inbuxa/inbuxa-webmail`; the old `inbuxa/ihasmail-inbuxa` image stops at `2026.9.26-g654d298`.
+
 The webmail of the INBUXA suite: mail, calendars, contacts, files and filters
 in one app that works as well on a phone as on a desktop. It talks only JMAP to
 the INBUXA mail server, and keeps nothing of its own: everything durable,
@@ -70,7 +76,7 @@ docker compose up --build -d
 ## Source code
 
 INBUXA webmail is a modified ihasmail, so the AGPL's offer is this fork:
-<https://git.coffeylabs.org/inbuxa/ihasmail-inbuxa>. The sign-in page and Settings ›
+<https://git.coffeylabs.org/inbuxa/inbuxa-webmail>. The sign-in page and Settings ›
 About link there, beside the version, which names the commit the running build
 came from.
 

docker-compose.yml

@@ -29,7 +29,7 @@ services:
       APP_SECRET: ${APP_SECRET:?set APP_SECRET in .env (openssl rand -base64 48)}
       APP_NAME: ${APP_NAME:-ihasmail}
       BASE_PATH: ${BASE_PATH:-}
-      SOURCE_URL: ${SOURCE_URL:-https://git.coffeylabs.org/inbuxa/ihasmail-inbuxa}
+      SOURCE_URL: ${SOURCE_URL:-https://git.coffeylabs.org/inbuxa/inbuxa-webmail}
       TRUST_PROXY: "1"
       IMAGE_PROXY: "1"
     volumes:

server/src/app.ts

@@ -41,7 +41,7 @@ import {
   revokeAppPassword,
 } from "./account.js";
 import { imageProxyHandler } from "./imageproxy.js";
-import { SignInError, finish as finishSignIn, needsRefresh, oauthEnabled, refreshTokens, singleServer, start as startSignIn, type TokenSet } from "./oauth.js";
+import { SignInError, finish as finishSignIn, needsRefresh, oauthEnabled, passwordConfirms, refreshTokens, singleServer, start as startSignIn, type TokenSet } from "./oauth.js";
 import { icsProxyHandler } from "./icsproxy.js";
 import { staticHandler } from "./static.js";
 import { mailNode, webmailNode } from "./nodes.js";
@@ -1127,11 +1127,10 @@ async function readJson<T>(c: Context): Promise<T | null> {
  */
 async function confirmsPassword(session: LiveSession, candidate: string): Promise<boolean> {
   if (session.tokens) {
-    // Holding no password, the only judge is the server.
+    // Holding no password, the only judge is the server, asked on its sign-in
+    // endpoint since it takes no password over JMAP.
     try {
-      const authorization = `Basic ${Buffer.from(`${session.username}:${candidate}`, "utf8").toString("base64")}`;
-      await fetchUpstreamSession(authorization, upstreamFor(session.username));
-      return true;
+      return await passwordConfirms({ base: upstreamFor(session.username), username: session.username, password: candidate });
     } catch {
       return false;
     }

server/src/config.ts

@@ -292,10 +292,10 @@ export const config = {
    *
    * The AGPL asks whoever *runs* a modified version to offer that version's
    * source, not the one it was forked from -- so anyone deploying a patched
-   * ihasmail should point this at their own tree. ihasmail-inbuxa is itself
+   * ihasmail should point this at their own tree. inbuxa-webmail is itself
    * such a tree, so the default is INBUXA's fork.
    */
-  sourceUrl: env("SOURCE_URL", "https://git.coffeylabs.org/inbuxa/ihasmail-inbuxa"),
+  sourceUrl: env("SOURCE_URL", "https://git.coffeylabs.org/inbuxa/inbuxa-webmail"),
   /**
    * ihasmail-inbuxa: this webmail's own name, shown in Settings > About next
    * to the mail node it talks to. Set per host by the deploy; empty means the

server/src/mock/data.ts

@@ -122,7 +122,11 @@ export function addSignedEmail(o: { which: keyof typeof SIGNED_MESSAGES; from: [
     hasAttachment: false,
     preview: body.slice(0, 120),
     textBody: [{ partId: "1", blobId: textBlob, size: body.length, name: null, type: "text/plain", charset: "utf-8", disposition: null, cid: null }],
-    htmlBody: [],
+    // `htmlBody` is derived (RFC 8621 4.1.4): a message with no HTML
+    // alternative still gets one, holding the text/plain part. Checked against
+    // Stalwart 0.16.21 on 2026-09-10 -- see hasHtmlAlternative() in the client,
+    // which reads the part's type rather than trusting this list to be empty.
+    htmlBody: [{ partId: "1", blobId: textBlob, size: body.length, name: null, type: "text/plain", charset: "utf-8", disposition: null, cid: null }],
     attachments: [],
     bodyValues: { "1": { value: body, isEncodingProblem: false, isTruncated: false } },
     bodyStructure: {
@@ -192,7 +196,8 @@ export function addEmail(o: { from: [string, string]; to?: string; subject: stri
     from: [{ name: o.from[0], email: o.from[1] }], to: [{ name: "Demo User", email: o.to ?? USER }], cc: null, bcc: null, replyTo: null, sender: null,
     subject: o.subject, hasAttachment: Boolean(o.attach), preview: text.slice(0, 120).replace(/\n/g, " "),
     textBody: [{ partId: "1", blobId: textBlob, size: text.length, name: null, type: "text/plain", charset: "utf-8", disposition: null, cid: null }],
-    htmlBody: o.html ? [{ partId: "2", blobId: htmlBlob, size: (o.styled ? STYLED_MARKETING_HTML : html).length, name: null, type: "text/html", charset: "utf-8", disposition: null, cid: null }] : [],
+    // No HTML alternative means `htmlBody` names the text part, not nothing. See addSignedEmail.
+    htmlBody: o.html ? [{ partId: "2", blobId: htmlBlob, size: (o.styled ? STYLED_MARKETING_HTML : html).length, name: null, type: "text/html", charset: "utf-8", disposition: null, cid: null }] : [{ partId: "1", blobId: textBlob, size: text.length, name: null, type: "text/plain", charset: "utf-8", disposition: null, cid: null }],
     attachments,
     bodyValues: { "1": { value: text, isEncodingProblem: false, isTruncated: false }, ...(o.html ? { "2": { value: o.styled ? STYLED_MARKETING_HTML : html, isEncodingProblem: false, isTruncated: false } } : {}) },
     bodyStructure: { partId: null, blobId: null, size: 0, type: "multipart/mixed", name: null, charset: null, disposition: null, cid: null, subParts: [{ partId: "1", blobId: textBlob, size: text.length, type: "text/plain", name: null, charset: "utf-8", disposition: null, cid: null }, ...(o.html ? [{ partId: "2", blobId: htmlBlob, size: (o.styled ? STYLED_MARKETING_HTML : html).length, type: "text/html", name: null, charset: "utf-8", disposition: null, cid: null }] : []), ...attachments] },

server/src/mock/index.ts

@@ -14,7 +14,7 @@ import { MAX_OBJECTS, MethodError, directory, enforceLimits, resolveRefs } from
 import { handlers } from "./handlers.js";
 export { account } from "./config.js";
 import { checkOtp } from "./auth.js";
-import { checkBearer, handleOAuth } from "./oauth.js";
+import { basicRefused, checkBearer, handleOAuth } from "./oauth.js";
 import { sseClients, broadcast } from "./events.js";
 
 /* ---------- http ---------- */
@@ -26,7 +26,7 @@ function unauthorized(res: ServerResponse) {
 function checkAuth(req: IncomingMessage): boolean {
   const h = req.headers.authorization ?? "";
   if (checkBearer(h)) return true;
-  if (!h.startsWith("Basic ")) return false;
+  if (!h.startsWith("Basic ") || basicRefused) return false;
   const raw = Buffer.from(h.slice(6), "base64").toString();
   const sep = raw.indexOf(":");
   if (sep < 0) return false;

server/src/mock/oauth.ts

@@ -23,11 +23,18 @@ const refreshTokens = new Map<string, Grant>();
 
 const base = () => `http://127.0.0.1:${PORT}`;
 
+/**
+ * Whether JMAP refuses Basic, as INBUXA's server does outside DAV (contract
+ * C-23). Off by default, since the mock also serves password sign-in.
+ */
+export let basicRefused = false;
+
 /** For tests: how long new access tokens last, and a way to end every token. */
 export const oauthMock = {
   setAccessTokenTtl(seconds: number) { accessTokenTtl = seconds; },
   expireAccessTokens() { for (const t of accessTokens.values()) t.expiresAt = 0; },
-  reset() { codes.clear(); accessTokens.clear(); refreshTokens.clear(); accessTokenTtl = 3600; },
+  refuseBasic(on: boolean) { basicRefused = on; },
+  reset() { codes.clear(); accessTokens.clear(); refreshTokens.clear(); accessTokenTtl = 3600; basicRefused = false; },
 };
 
 /** A bearer token the mock issued, still valid under the current password. */
@@ -50,6 +57,14 @@ function readForm(req: IncomingMessage): Promise<URLSearchParams> {
   });
 }
 
+function readBody(req: IncomingMessage): Promise<Buffer> {
+  return new Promise((resolve) => {
+    const chunks: Buffer[] = [];
+    req.on("data", (c) => chunks.push(c));
+    req.on("end", () => resolve(Buffer.concat(chunks)));
+  });
+}
+
 function issue(res: ServerResponse, refresh: string | null) {
   const access = `mock-at-${randomBytes(16).toString("hex")}`;
   accessTokens.set(access, { password: account.password, expiresAt: Date.now() + accessTokenTtl * 1000 });
@@ -93,6 +108,35 @@ export async function handleOAuth(req: IncomingMessage, res: ServerResponse, url
     res.end();
     return true;
   }
+  if (url.pathname === "/api/auth" && req.method === "POST") {
+    // The server's sign-in page posts here; the mock answers for the demo user.
+    let body: Record<string, unknown>;
+    try {
+      body = JSON.parse((await readBody(req)).toString()) as Record<string, unknown>;
+    } catch {
+      json(res, 400, { error: "invalid_request" });
+      return true;
+    }
+    const redirectUri = typeof body.redirectUri === "string" ? body.redirectUri : "";
+    if (body.type !== "authCode" || body.clientId !== OAUTH_CLIENT_ID || !redirectUri || body.codeChallengeMethod !== "S256") {
+      json(res, 400, { error: "invalid_request" });
+      return true;
+    }
+    const secret = typeof body.accountSecret === "string" ? body.accountSecret : "";
+    const passwordOk = body.accountName === USER && (secret === account.password || account.appPasswords.some((a) => a.secret === secret));
+    if (!passwordOk) {
+      json(res, 200, { type: "failure" });
+      return true;
+    }
+    if (account.otpUrl && secret === account.password && !body.mfaToken) {
+      json(res, 200, { type: "mfaRequired" });
+      return true;
+    }
+    const code = randomBytes(16).toString("hex");
+    codes.set(code, { challenge: String(body.codeChallenge ?? ""), redirectUri, issuedAt: Date.now() });
+    json(res, 200, { type: "authenticated", client_code: code, iss: base() });
+    return true;
+  }
   if (url.pathname === "/auth/token" && req.method === "POST") {
     const form = await readForm(req);
     if (form.get("client_id") !== OAUTH_CLIENT_ID || form.get("client_secret") !== OAUTH_CLIENT_SECRET) {

server/src/oauth.test.ts

@@ -198,6 +198,8 @@ test("a password change signs the session out, since the server revokes its toke
 
 test("creating an app password checks the typed password with the server", async () => {
   await signIn();
+  // As INBUXA's server does: no password over JMAP (contract C-23).
+  oauthMock.refuseBasic(true);
   const wrong = await call("/api/account/app-passwords", { method: "POST", body: JSON.stringify({ description: "Phone", current: "nope" }) });
   assert.equal(wrong.status, 403);
   const right = await call("/api/account/app-passwords", { method: "POST", body: JSON.stringify({ description: "Phone", current: "demo-password" }) });

server/src/oauth.ts

@@ -134,6 +134,39 @@ export async function start(params: { username: string; base: string; remember:
   return { location: url.toString(), state };
 }
 
+/**
+ * Whether `password` is the account's password, for a session that holds a
+ * token and so has no password to compare with.
+ *
+ * Asked of the server's sign-in endpoint, the one its own sign-in page posts
+ * to, because the server takes no password over JMAP (contract C-23). The
+ * request is this client's, to its registered redirect URI, so it passes the
+ * same checks a real sign-in does. A code it issues can never be exchanged:
+ * the PKCE verifier behind its challenge is thrown away here.
+ *
+ * "Two-factor code needed" counts as confirmed: the server says so only once
+ * the password has matched.
+ */
+export async function passwordConfirms(params: { base: string; username: string; password: string }): Promise<boolean> {
+  const res = await fetch(absoluteUpstream("/api/auth", params.base), {
+    method: "POST",
+    headers: { "content-type": "application/json", accept: "application/json" },
+    body: JSON.stringify({
+      type: "authCode",
+      accountName: params.username,
+      accountSecret: params.password,
+      clientId: config.oauthClientId,
+      redirectUri: redirectUri(),
+      codeChallenge: challengeOf(randomToken(48)),
+      codeChallengeMethod: "S256",
+    }),
+    signal: AbortSignal.timeout(config.upstreamTimeout),
+  });
+  if (!res.ok) throw new UpstreamError(`Password check failed (${res.status})`, 502);
+  const answer = (await res.json()) as { type?: string };
+  return answer.type === "authenticated" || answer.type === "mfaRequired";
+}
+
 export class SignInError extends Error {
   constructor(readonly code: "state_mismatch" | "expired" | "denied" | "exchange_failed", message: string) {
     super(message);

web/index.html

@@ -19,9 +19,9 @@
     <meta name="apple-mobile-web-app-capable" content="yes" />
     <meta name="apple-mobile-web-app-status-bar-style" content="default" />
     <meta name="mobile-web-app-capable" content="yes" />
-    <link rel="icon" href="/favicon.ico" sizes="any" />
-    <link rel="icon" type="image/png" sizes="64x64" href="/img/favicon-64.png" />
-    <link rel="apple-touch-icon" href="/img/apple-touch-icon.png" />
+    <link rel="icon" href="/favicon.ico?v=2026-09-27a" sizes="any" />
+    <link rel="icon" type="image/png" sizes="64x64" href="/img/favicon-64.png?v=2026-09-27a" />
+    <link rel="apple-touch-icon" href="/img/apple-touch-icon.png?v=2026-09-27a" />
     <link rel="manifest" href="/manifest.webmanifest" />
     <title>inbuxa</title>
   </head>

web/public/manifest.webmanifest

@@ -51,17 +51,17 @@
   "theme_color": "#0f766e",
   "icons": [
     {
-      "src": "img/icon-192.png",
+      "src": "img/icon-192.png?v=2026-09-27a",
       "sizes": "192x192",
       "type": "image/png"
     },
     {
-      "src": "img/icon-512.png",
+      "src": "img/icon-512.png?v=2026-09-27a",
       "sizes": "512x512",
       "type": "image/png"
     },
     {
-      "src": "img/icon-maskable.png",
+      "src": "img/icon-maskable.png?v=2026-09-27a",
       "sizes": "192x192",
       "type": "image/png",
       "purpose": "maskable"

web/public/sw.js

@@ -18,7 +18,9 @@ const VERSION = "ihasmail-v2";
  * eventually would.
  */
 const BASE = new URL("./", self.location).pathname.replace(/\/$/, "");
-const SHELL = [`${BASE}/manifest.webmanifest`, `${BASE}/img/logo.png`, `${BASE}/img/icon-192.png`, `${BASE}/favicon.ico`];
+// The brand images' version; the same value as BRAND_V in src/lib/brand.ts.
+const BRAND_V = "2026-09-27a";
+const SHELL = [`${BASE}/manifest.webmanifest`, `${BASE}/img/logo.png?v=${BRAND_V}`, `${BASE}/img/icon-192.png?v=${BRAND_V}`, `${BASE}/favicon.ico?v=${BRAND_V}`];
 
 /*
  * Only the app page may be kept as the app page.
@@ -482,7 +484,7 @@ self.addEventListener("push", (event) => {
       // or a payload too large to carry the message. Say something true
       // rather than inventing a sender.
       await self.registration.showNotification(strings.newMail, {
-        icon: `${BASE}/img/icon-192.png`, badge: `${BASE}/img/favicon-64.png`, tag: "ihasmail-mail", data: { url: `${BASE}/mail` },
+        icon: `${BASE}/img/icon-192.png?v=${BRAND_V}`, badge: `${BASE}/img/favicon-64.png?v=${BRAND_V}`, tag: "ihasmail-mail", data: { url: `${BASE}/mail` },
       });
       return;
     }
@@ -492,8 +494,8 @@ self.addEventListener("push", (event) => {
       const { title, body, preview } = textOf(email, strings);
       await self.registration.showNotification(title, {
         body: preview ? `${body}\n${preview}` : body,
-        icon: `${BASE}/img/icon-192.png`,
-        badge: `${BASE}/img/favicon-64.png`,
+        icon: `${BASE}/img/icon-192.png?v=${BRAND_V}`,
+        badge: `${BASE}/img/favicon-64.png?v=${BRAND_V}`,
         tag: `ihasmail-${email.id || body}`,
         // Only where there is a message to act on: a payload without an id can
         // be shown but not archived, and a button that cannot work should not
@@ -537,8 +539,8 @@ async function runAction(action, data) {
   } catch {
     await self.registration.showNotification(data.title || "ihasmail", {
       body: data.failed || "Could not do that — open ihasmail and try again",
-      icon: `${BASE}/img/icon-192.png`,
-      badge: `${BASE}/img/favicon-64.png`,
+      icon: `${BASE}/img/icon-192.png?v=${BRAND_V}`,
+      badge: `${BASE}/img/favicon-64.png?v=${BRAND_V}`,
       tag: `ihasmail-failed-${id}`,
       data: { url: data.url },
     });

web/src/App.tsx

@@ -1,7 +1,7 @@
-import { Fragment, lazy, Suspense, useEffect, useState } from "react";
+import { Fragment, lazy, Suspense, useEffect, useRef, useState } from "react";
 import { Route, Switch, Redirect, useLocation, Router } from "wouter";
 import { useSession } from "@/store/session";
-import { useMail } from "@/store/mail";
+import { notifyOwnWhileAway, ownAccountAway, useMail } from "@/store/mail";
 import { scheduleSupported, useScheduled } from "@/store/scheduled";
 import { useContacts } from "@/store/contacts";
 import { useCalendar } from "@/store/calendar";
@@ -119,6 +119,7 @@ export function App() {
 
 function AuthedApp() {
   const accountId = useSession((s) => s.accountId);
+  const viewing = useSession((s) => s.viewing);
   const [location] = useLocation();
 
   /*
@@ -230,6 +231,9 @@ function AuthedApp() {
         timer = null;
         for (const [a, types] of pending) {
           if (a === useMail.getState().accountId) void useMail.getState().applyChanges(types);
+          // inbuxa AL-7: the reader's own mail, while a delegated account
+          // is in view, is still announced
+          if (a === ownAccountAway() && types.has("Email")) void notifyOwnWhileAway();
           if (a === useContacts.getState().accountId) useContacts.getState().applyChanges(types);
           if (a === useCalendar.getState().accountId) useCalendar.getState().applyChanges(types);
           if (a === useFiles.getState().accountId) useFiles.getState().applyChanges(types);
@@ -253,16 +257,65 @@ function AuthedApp() {
     };
   }, [accountId]);
 
+  /*
+   * inbuxa AL-7: a delegated account, the whole of it, when it comes into
+   * view, and the reader's own when it goes back. Push carries nothing for an account only
+   * shared with the reader, so while one is open it is polled.
+   */
+  const viewedOnce = useRef(false);
+  useEffect(() => {
+    if (!viewedOnce.current) {
+      viewedOnce.current = true;
+      if (!viewing) return;
+    }
+    const mail = useMail.getState();
+    void mail.loadMailboxes();
+    void mail.loadIdentities();
+    // The whole account follows: calendar, contacts and files too
+    void useCalendar.getState().init();
+    void useContacts.getState().init();
+    void useFiles.getState().init();
+    if (!viewing) return;
+    const poll = window.setInterval(() => {
+      if (document.visibilityState === "visible") {
+        void useMail.getState().applyChanges(new Set(["Email", "Mailbox"]));
+      }
+    }, 60_000);
+    return () => window.clearInterval(poll);
+  }, [viewing]);
+
+  // inbuxa AL-7: a delegation given or taken away while the app is open shows
+  // up when the reader comes back to it, without signing in again
+  useEffect(() => {
+    let last = 0;
+    const onVisible = () => {
+      if (document.visibilityState !== "visible" || Date.now() - last < 60_000) return;
+      last = Date.now();
+      void useSession.getState().refresh();
+    };
+    document.addEventListener("visibilitychange", onVisible);
+    return () => document.removeEventListener("visibilitychange", onVisible);
+  }, []);
+
+  const delegationEnded = useSession((s) => s.delegationEnded);
+  useEffect(() => {
+    if (!delegationEnded) return;
+    toast.show(t("You no longer have access to {name}. Back to your own mail.", { name: delegationEnded }));
+    useSession.getState().clearDelegationEnded();
+  }, [delegationEnded]);
+
   // Unread badge in title/favicon
   const inboxUnread = useMail((s) => {
     const id = s.roleId("inbox");
     return id ? (s.mailboxes[id]?.unreadEmails ?? 0) : 0;
   });
   const appName = useSession((s) => s.session?.ihasmail?.appName) || DEFAULT_APP_NAME;
+  // inbuxa AL-7: a locked account in view is named, with a padlock, in the tab
+  const viewingName = useSession((s) => (s.viewing ? s.session?.accounts[s.viewing]?.name : undefined));
   useEffect(() => {
-    setBaseTitle(appName);
+    setBaseTitle(viewingName ? `🔒 ${viewingName} · ${appName}` : appName);
     setUnreadBadge(inboxUnread);
-  }, [inboxUnread, appName]);
+  }, [inboxUnread, appName, viewingName]);
 
   /*
    * Leave the service worker its briefing.
@@ -276,8 +329,11 @@ function AuthedApp() {
   const archiveId = useMail((s) => s.roleId("archive"));
   const languageVersion = useLanguageVersion();
   useEffect(() => {
+    // inbuxa AL-7: the worker acts on the reader's own mail; while a
+    // delegated account is in view, the archive folder here is its
+    if (viewing) return;
     void publishWorkerFacts(accountId, archiveId);
-  }, [accountId, archiveId, languageVersion]);
+  }, [accountId, archiveId, languageVersion, viewing]);
 
   // Request notification permission lazily when enabled
   const notif = useSettings((s) => s.settings.desktopNotifications);

web/src/jmap/__tests__/legacy-partly-off.test.ts

@@ -0,0 +1,42 @@
+import { describe, expect, it } from "vitest";
+import { INBUXA_CAP, legacyProtocolsPartlyOff } from "../client";
+import { parseTenantLegacy } from "@/lib/admin/adminLegacyProtocols";
+import type { JmapSession } from "../types";
+
+/**
+ * INBUXA can switch IMAP, POP3 and ManageSieve off one at a time. The session
+ * lists what is still allowed (`legacyAllowed`); the webmail names what isn't,
+ * only while some but not all are off, and never from a server that doesn't
+ * say.
+ */
+describe("legacyProtocolsPartlyOff", () => {
+  const session = (cap: Record<string, unknown> | undefined) =>
+    ({
+      accounts: { a: { name: "[email protected]", accountCapabilities: cap ? { [INBUXA_CAP]: cap } : {} } },
+    }) as unknown as JmapSession;
+
+  it("names what is off when only some are", () => {
+    const s = session({ legacyProtocols: "enabled", legacyAllowed: ["imap", "manageSieve", "submission"] });
+    expect(legacyProtocolsPartlyOff(s, "a")).toEqual(["POP3"]);
+    const two = session({ legacyProtocols: "enabled", legacyAllowed: ["pop3", "submission"] });
+    expect(legacyProtocolsPartlyOff(two, "a")).toEqual(["IMAP", "ManageSieve"]);
+  });
+
+  it("is empty with none off, all off, or an older server", () => {
+    const all = ["imap", "pop3", "manageSieve", "submission"];
+    expect(legacyProtocolsPartlyOff(session({ legacyProtocols: "enabled", legacyAllowed: all }), "a")).toEqual([]);
+    expect(legacyProtocolsPartlyOff(session({ legacyProtocols: "disabled", legacyAllowed: [] }), "a")).toEqual([]);
+    expect(legacyProtocolsPartlyOff(session({ legacyProtocols: "enabled" }), "a")).toEqual([]);
+    expect(legacyProtocolsPartlyOff(null, "a")).toEqual([]);
+  });
+});
+
+describe("parseTenantLegacy", () => {
+  it("reads a tenant with only some off, and an older server's one switch", () => {
+    expect(parseTenantLegacy({ legacyProtocols: "enabled", pop3: "disabled" }).partlyOff).toEqual(["POP3"]);
+    const all = parseTenantLegacy({ legacyProtocols: "disabled", imap: "disabled", pop3: "disabled" });
+    expect(all.off).toBe(true);
+    expect(all.partlyOff).toEqual([]);
+    expect(parseTenantLegacy({ legacyProtocols: "enabled" }).partlyOff).toEqual([]);
+  });
+});

web/src/jmap/client.ts

@@ -37,6 +37,24 @@ export function legacyProtocolsOff(session: JmapSession | null, accountId: Id |
   return cap?.legacyProtocols === "disabled";
 }
 
+/** The protocols the server can switch off one at a time, as it names them. */
+const SWITCHED = ["imap", "pop3", "manageSieve"] as const;
+const PROTOCOL_NAMES: Record<string, string> = { imap: "IMAP", pop3: "POP3", manageSieve: "ManageSieve" };
+
+/**
+ * Which of IMAP, POP3 and ManageSieve are off for this account, by name, when
+ * only some are (INBUXA legacy-protocols, one switch per protocol). Empty when
+ * none are, when all are (see `legacyProtocolsOff`), and from a server that
+ * doesn't say which (`legacyAllowed`).
+ */
+export function legacyProtocolsPartlyOff(session: JmapSession | null, accountId: Id | null): string[] {
+  if (!session || !accountId || legacyProtocolsOff(session, accountId)) return [];
+  const cap = session.accounts[accountId]?.accountCapabilities?.[INBUXA_CAP] as { legacyAllowed?: unknown } | undefined;
+  if (!Array.isArray(cap?.legacyAllowed)) return [];
+  const allowed = cap.legacyAllowed;
+  return SWITCHED.filter((p) => !allowed.includes(p)).map((p) => PROTOCOL_NAMES[p] ?? p);
+}
+
 export class JmapMethodError extends Error {
   constructor(
     public readonly method: string,

web/src/lib/__tests__/languages.test.ts

@@ -29,15 +29,10 @@ describe("resolveUiLanguage", () => {
     expect(resolveUiLanguage("xx-XX")).toBe("en");
   });
 
-  it("carries the Beta flag until a person has signed the language off", () => {
-    // Not a completeness measure. A catalog can be word-for-word finished
-    // and still read like a machine wrote it, which is what this marks.
-    // Every shipped language except English is unreviewed, and stays marked
-    // until a person says otherwise.
-    for (const l of UI_LANGUAGES) {
-      if (l.tag === "en") expect(l.beta).toBeUndefined();
-      else expect(l.beta).toBe(true);
-    }
+  it("marks no language Beta", () => {
+    // inbuxa: every shipped language is offered without the Beta mark
+    // (John, 2026-09-27); only Dutch has been read by a native speaker.
+    for (const l of UI_LANGUAGES) expect(l.beta).toBeUndefined();
   });
 
   it("honors one that is", () => {

web/src/lib/admin/__tests__/adminLegacyProtocols.test.ts

@@ -3,8 +3,8 @@ import { CONFIRM_PHRASE, impactEntries, parseTenantLegacy, phraseMatches } from
 
 describe("a tenant's legacy mail protocols switch, as the server sends it", () => {
   it("reads the switch, and tells an older server from nobody", () => {
-    expect(parseTenantLegacy({ legacyProtocols: "disabled", recentLegacyUse: [] })).toEqual({ off: true, recent: [] });
-    expect(parseTenantLegacy({ legacyProtocols: "enabled" })).toEqual({ off: false, recent: null });
+    expect(parseTenantLegacy({ legacyProtocols: "disabled", recentLegacyUse: [] })).toEqual({ off: true, partlyOff: [], recent: [] });
+    expect(parseTenantLegacy({ legacyProtocols: "enabled" })).toEqual({ off: false, partlyOff: [], recent: null });
   });
 
   it("puts each account on the panel once, with every protocol and its latest use", () => {

web/src/lib/admin/adminLegacyProtocols.ts

@@ -34,7 +34,10 @@ export interface RecentUse {
 }
 
 export interface TenantLegacy {
+  /** All of IMAP, POP3 and ManageSieve off: the kill-all's state. */
   off: boolean;
+  /** When only some are off, which, by name; set one at a time in the console. */
+  partlyOff: string[];
   /** Null from a server too old to say who uses legacy apps -- not the same as nobody. */
   recent: RecentUse[] | null;
 }
@@ -49,8 +52,13 @@ function parseRecent(raw: unknown): RecentUse[] | null {
   });
 }
 
+const PROTOCOL_NAMES: [string, string][] = [["imap", "IMAP"], ["pop3", "POP3"], ["manageSieve", "ManageSieve"]];
+
 export function parseTenantLegacy(raw: Record<string, unknown>): TenantLegacy {
-  return { off: raw.legacyProtocols === "disabled", recent: parseRecent(raw.recentLegacyUse) };
+  const off = raw.legacyProtocols === "disabled";
+  // An older server sends only legacyProtocols, which stands for all three.
+  const partlyOff = off ? [] : PROTOCOL_NAMES.filter(([key]) => raw[key] === "disabled").map(([, name]) => name);
+  return { off, partlyOff, recent: parseRecent(raw.recentLegacyUse) };
 }
 
 /** The tenant's switch, or null where the server has none (not INBUXA, or too old). */

web/src/lib/brand.ts

@@ -1,4 +1,5 @@
 import { useSession } from "@/store/session";
+import { withBase } from "@/lib/basePath";
 
 /**
  * What this instance calls itself, when nothing has said otherwise yet.
@@ -36,3 +37,25 @@ export function useAppName(): string {
 export function currentAppName(): string {
   return useSession.getState().session?.ihasmail?.appName?.trim() || DEFAULT_APP_NAME;
 }
+
+/**
+ * The brand images' version, carried as `?v=` on every URL that names one.
+ *
+ * The images live in `public/img` under fixed names and are served with a
+ * browser cache of hours, so replacing one (the mark changed on 2026-09-27)
+ * left returning visitors on the old picture until their copy expired -- and
+ * the favicon and an installed app's icon hold on longer still. A new value
+ * here is a new URL everywhere at once.
+ *
+ * Date-stamped with a letter for a second change the same day, never a
+ * counter, for the reason the sites give for ASSET_V: a value that could have
+ * been requested before may already be cached, with old bytes behind it.
+ * `index.html`, `public/manifest.webmanifest` and `public/sw.js` can't import
+ * this, so they carry the same value written out; keep the four in step.
+ */
+export const BRAND_V = "2026-09-27a";
+
+/** A brand image's URL under the mount, versioned: `brandImage("/img/logo.png")`. */
+export function brandImage(path: string): string {
+  return withBase(`${path}?v=${BRAND_V}`);
+}

web/src/lib/delegation.ts

@@ -0,0 +1,67 @@
+/**
+ * Locked accounts handed to the reader (inbuxa audit-hold-lock spec, AL-7).
+ *
+ * The server marks one in the account's `urn:inbuxa:jmap` capability, as
+ * `delegation: {locked, access, sendAs, until}`. Only that mark makes an
+ * account switchable: a server advertises every capability on any shared
+ * account, so "it has mail" proves nothing about what was handed over.
+ */
+
+import type { Id, JmapSession } from "@/jmap/types";
+
+export type DelegationAccess = "read" | "organize" | "full";
+
+export interface Delegation {
+  locked: boolean;
+  access: DelegationAccess;
+  sendAs: boolean;
+  /** UTC date the delegation ends, if it does. */
+  until: string | null;
+}
+
+export interface DelegatedAccount {
+  id: Id;
+  name: string;
+  delegation: Delegation;
+}
+
+const INBUXA = "urn:inbuxa:jmap";
+
+type SessionLike = Pick<JmapSession, "accounts">;
+
+export function delegationOf(session: SessionLike | null, accountId: Id | null): Delegation | null {
+  if (!session || !accountId) return null;
+  const account = session.accounts[accountId];
+  if (!account || account.isPersonal) return null;
+  const raw = (account.accountCapabilities?.[INBUXA] as { delegation?: Partial<Delegation> } | undefined)?.delegation;
+  if (!raw || raw.locked !== true) return null;
+  const access: DelegationAccess = raw.access === "organize" || raw.access === "full" ? raw.access : "read";
+  return {
+    locked: true,
+    access,
+    sendAs: raw.sendAs === true && access !== "read",
+    until: typeof raw.until === "string" ? raw.until : null,
+  };
+}
+
+/** Every locked account handed to the reader, by name. */
+export function delegatedAccounts(session: SessionLike | null): DelegatedAccount[] {
+  if (!session) return [];
+  return Object.entries(session.accounts)
+    .map(([id, account]) => {
+      const delegation = delegationOf(session, id);
+      return delegation ? { id, name: account.name, delegation } : null;
+    })
+    .filter((a): a is DelegatedAccount => a !== null)
+    .sort((a, b) => a.name.localeCompare(b.name));
+}
+
+/** Whether the reader may change anything in the account (AL-6). */
+export function mayWrite(delegation: Delegation | null): boolean {
+  return !delegation || delegation.access !== "read";
+}
+
+/** Whether the reader may delete in the account (AL-6). */
+export function mayDestroy(delegation: Delegation | null): boolean {
+  return !delegation || delegation.access === "full";
+}

web/src/lib/languages.ts

@@ -35,17 +35,19 @@ export interface UiLanguage {
   beta?: boolean;
 }
 
+// inbuxa: no language is marked Beta (John, 2026-09-27). The flag and its
+// settings note stay, so public ihasmail's changes to them still apply.
 export const UI_LANGUAGES: readonly UiLanguage[] = [
   { tag: "en", name: "English" },
-  { tag: "de", name: "Deutsch", beta: true },
-  { tag: "es", name: "Español", beta: true },
-  { tag: "fr", name: "Français", beta: true },
-  { tag: "nl", name: "Nederlands", beta: true },
-  { tag: "pt-BR", name: "Português (Brasil)", beta: true },
-  { tag: "ja", name: "日本語", beta: true },
-  { tag: "ru", name: "Русский", beta: true },
-  { tag: "uk", name: "Українська", beta: true },
-  { tag: "zh-Hans", name: "简体中文", beta: true },
+  { tag: "de", name: "Deutsch" },
+  { tag: "es", name: "Español" },
+  { tag: "fr", name: "Français" },
+  { tag: "nl", name: "Nederlands" },
+  { tag: "pt-BR", name: "Português (Brasil)" },
+  { tag: "ja", name: "日本語" },
+  { tag: "ru", name: "Русский" },
+  { tag: "uk", name: "Українська" },
+  { tag: "zh-Hans", name: "简体中文" },
 ];
 
 /** Where to report a bad translation. Beta languages depend on it. */

web/src/lib/mail/remoteImages.ts

@@ -0,0 +1,65 @@
+import { unproxiedImageUrl } from "@/lib/text/html";
+import type { ImagePolicy } from "@/store/settings";
+
+/**
+ * Whether a message's remote images may be fetched.
+ *
+ * The reader's decision, in one place, because the composer has to make the
+ * same one. Quoting a message into a reply renders it again — and a quote that
+ * fetched what the reader had declined would report the message read, and the
+ * address live, to whoever was counting. The tracking pixel does not care
+ * which window it loaded in.
+ */
+export function remoteImagesAllowed(opts: {
+  from: string | null | undefined;
+  policy: ImagePolicy;
+  trusted: string[];
+  inContacts: boolean;
+  /** The reader pressed "Show images" on this message. */
+  shown: boolean;
+}): boolean {
+  if (opts.shown || opts.policy === "always") return true;
+  if (opts.trusted.includes((opts.from ?? "").toLowerCase())) return true;
+  return opts.policy === "contacts" && opts.inContacts;
+}
+
+/**
+ * Point proxied images back at their own addresses, on the way out.
+ *
+ * Reading a message fetches its remote images through this server, so the
+ * sender learns nothing about the reader. Those URLs belong to this
+ * deployment, so a quote that kept them would reach the recipient as images
+ * only this server can serve -- broken for them, and a beacon back here for
+ * anyone who could load them (#412).
+ */
+export function unproxyImages(html: string): string {
+  if (!html.includes("/api/image?url=")) return html;
+  const doc = new DOMParser().parseFromString(html, "text/html");
+  for (const img of Array.from(doc.querySelectorAll("img[src]"))) {
+    const real = unproxiedImageUrl(img.getAttribute("src") ?? "");
+    if (real) img.setAttribute("src", real);
+  }
+  return doc.body.innerHTML;
+}
+
+/**
+ * Put back the addresses of images that were blocked when the message was
+ * quoted, on the way out.
+ *
+ * Blocking keeps the original URL on the element (`data-ihm-remote`), so
+ * nothing was lost by not fetching it. The copy that leaves here should be the
+ * quote as its sender wrote it: the recipient's client decides for itself
+ * whether to load those images, the same as it would have with any other
+ * client's reply.
+ */
+export function restoreBlockedImages(html: string): string {
+  if (!html.includes("data-ihm-blocked")) return html;
+  const doc = new DOMParser().parseFromString(html, "text/html");
+  for (const img of Array.from(doc.querySelectorAll("img[data-ihm-blocked]"))) {
+    const url = img.getAttribute("data-ihm-remote");
+    if (url) img.setAttribute("src", url);
+    img.removeAttribute("data-ihm-blocked");
+    img.removeAttribute("data-ihm-remote");
+  }
+  return doc.body.innerHTML;
+}

web/src/lib/mailbox/__tests__/folderOrder.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { canPlaceFolder, compareFolders, neighbour, placeFolder, siblingsOf } from "../folderOrder";
+import { canPlaceFolder, compareFolders, neighbour, placeFolder, siblingsOf, treeOrder } from "../folderOrder";
 import type { Id, Mailbox } from "@/jmap/types";
 
 const RIGHTS = { mayRename: true, mayCreateChild: true } as Mailbox["myRights"];
@@ -119,3 +119,23 @@ describe("neighbour", () => {
     expect(neighbour(hidden, "alpha", "up", (m) => m.isSubscribed)).toEqual({ targetId: "junk", placement: "before" });
   });
 });
+
+describe("treeOrder", () => {
+  const ids = (all: Record<Id, Mailbox>) => treeOrder(all).map((m) => m.id);
+
+  it("lists the tree the way the sidebar does, each folder followed by its subfolders", () => {
+    expect(ids(fresh)).toEqual(["inbox", "drafts", "sent", "junk", "trash", "alpha", "work", "clients", "zeta"]);
+  });
+
+  it("follows a saved order rather than A–Z", () => {
+    // #1 on GitLab: the move-to picker kept the old order after the sidebar changed.
+    const ordered = apply(fresh, { zeta: { sortOrder: 10 }, sent: { sortOrder: 20 }, alpha: { sortOrder: 30 }, drafts: { sortOrder: 40 }, junk: { sortOrder: 50 }, trash: { sortOrder: 60 }, work: { sortOrder: 70 } });
+    expect(ids(ordered)).toEqual(["inbox", "zeta", "sent", "alpha", "drafts", "junk", "trash", "work", "clients"]);
+  });
+
+  it("still lists a folder the walk from the top can't reach", () => {
+    const looped = apply(fresh, { work: { parentId: "clients" } });
+    expect(ids(looped)).toHaveLength(Object.keys(looped).length);
+    expect(ids(looped)).toEqual(expect.arrayContaining(["work", "clients"]));
+  });
+});

web/src/lib/mailbox/folderOrder.ts

@@ -25,6 +25,37 @@ function roleRank(m: Mailbox): number {
   return m.role && m.role in ROLE_ORDER ? ROLE_ORDER[m.role]! : Number.MAX_SAFE_INTEGER;
 }
 
+/**
+ * Every folder, parents before their children and siblings in
+ * `compareFolders` order: the sidebar's order with every folder expanded.
+ * Lists that show all folders at once, like the move-to picker, use this so a
+ * folder sits where the user dragged it rather than where A–Z would put it.
+ *
+ * A folder the walk from the top never reaches (a parent loop the server
+ * should not allow) is appended rather than dropped, so it can still be
+ * picked.
+ */
+export function treeOrder(mailboxes: Record<Id, Mailbox>): Mailbox[] {
+  const byParent = new Map<Id | null, Mailbox[]>();
+  for (const m of Object.values(mailboxes)) {
+    const p = m.parentId && mailboxes[m.parentId] ? m.parentId : null;
+    byParent.set(p, [...(byParent.get(p) ?? []), m]);
+  }
+  for (const list of byParent.values()) list.sort(compareFolders);
+  const out: Mailbox[] = [];
+  const seen = new Set<Id>();
+  const walk = (parent: Id | null) => {
+    for (const m of byParent.get(parent) ?? []) {
+      if (seen.has(m.id)) continue;
+      seen.add(m.id);
+      out.push(m);
+      walk(m.id);
+    }
+  };
+  walk(null);
+  return out.concat(Object.values(mailboxes).filter((m) => !seen.has(m.id)).sort(compareFolders));
+}
+
 /** Every folder under `parentId` (null: the top level), in list order. */
 export function siblingsOf(mailboxes: Record<Id, Mailbox>, parentId: Id | null): Mailbox[] {
   return Object.values(mailboxes)

web/src/lib/notify/notify.ts

@@ -1,4 +1,4 @@
-import { withBase } from "../basePath";
+import { brandImage } from "@/lib/brand";
 
 let baseTitle = "inbuxa";
 let faviconCanvas: HTMLCanvasElement | null = null;
@@ -40,13 +40,13 @@ export function setUnreadBadge(count: number): void {
     if (!link) return;
     if (!baseFavicon) {
       baseFavicon = new Image();
-      baseFavicon.src = withBase("/img/favicon-64.png");
+      baseFavicon.src = brandImage("/img/favicon-64.png");
       baseFavicon.onload = () => setUnreadBadge(count);
       return;
     }
     if (!baseFavicon.complete) return;
     if (count <= 0) {
-      link.href = withBase("/img/favicon-64.png");
+      link.href = brandImage("/img/favicon-64.png");
       return;
     }
     faviconCanvas ??= document.createElement("canvas");
@@ -95,7 +95,7 @@ export function showNotification(title: string, opts: NotificationOptions & { on
   if (!("Notification" in window) || Notification.permission !== "granted") return;
   if (document.visibilityState === "visible" && document.hasFocus()) return;
   const { onClick, ...options } = opts;
-  const full = { icon: withBase("/img/icon-192.png"), badge: withBase("/img/favicon-64.png"), ...options };
+  const full = { icon: brandImage("/img/icon-192.png"), badge: brandImage("/img/favicon-64.png"), ...options };
   const viaWorker = navigator.serviceWorker?.controller ? navigator.serviceWorker.ready : null;
   if (viaWorker) {
     void viaWorker.then((reg) => reg.showNotification(title, full)).catch(() => undefined);

web/src/lib/notify/webpushEnable.ts

@@ -10,7 +10,7 @@ import { withBase } from "../basePath";
 import { SW_CACHE_NAME } from "../sw/swCache";
 import { isDeviceTrusted } from "@/lib/storage";
 import { useSession } from "@/store/session";
-import { useMail } from "@/store/mail";
+import { ownInboxId } from "@/store/mail";
 import {
   applicationServerKey,
   createSubscription,
@@ -153,7 +153,8 @@ async function registerThisBrowser(key: string): Promise<void> {
   }
 
   if (mine.length) await destroySubscriptions(mine.map((s) => s.id));
-  const payload = subscriptionPayload(sub, useSession.getState().ownAccountFor(CAP.mail), useMail.getState().roleId("inbox"));
+  // inbuxa AL-7: the reader's own inbox, never a delegated account's in view
+  const payload = subscriptionPayload(sub, useSession.getState().ownAccountFor(CAP.mail), ownInboxId());
   try {
     await createSubscription(payload);
   } catch (err) {

web/src/lib/source.ts

@@ -8,4 +8,4 @@
  * ihasmail-inbuxa: INBUXA runs a modified ihasmail, so the offer is INBUXA's
  * fork and not the project it came from.
  */
-export const DEFAULT_SOURCE_URL = "https://git.coffeylabs.org/inbuxa/ihasmail-inbuxa";
+export const DEFAULT_SOURCE_URL = "https://git.coffeylabs.org/inbuxa/inbuxa-webmail";

web/src/lib/text/html.ts

@@ -1,5 +1,5 @@
 import DOMPurify from "dompurify";
-import { withBase } from "@/lib/basePath";
+import { BASE_PATH, withBase } from "@/lib/basePath";
 
 export interface SanitizeOptions {
   /** Map of Content-ID (without angle brackets) → URL for inline images. */
@@ -158,6 +158,23 @@ export function proxiedImageUrl(url: string): string {
   return withBase(`/api/image?url=${encodeURIComponent(url)}`);
 }
 
+/**
+ * The address a proxied image really points at, or null if this is not one.
+ *
+ * A proxied URL is this server's, so it is right for reading a message and
+ * wrong for sending one: a quote left this way would hand the recipient
+ * images that only load from inside this deployment (#412).
+ */
+export function unproxiedImageUrl(src: string): string | null {
+  const path = `${BASE_PATH}/api/image?url=`;
+  if (!src.startsWith(path)) return null;
+  try {
+    return decodeURIComponent(src.slice(path.length)) || null;
+  } catch {
+    return null; // Malformed escape: leave it alone rather than mangle it.
+  }
+}
+
 export function sanitizeEmailHtml(input: string, opts: SanitizeOptions = {}): SanitizeResult {
   ensureHooks();
   let bodyStyle = "";

web/src/locales/de.ts

@@ -1406,6 +1406,8 @@ export const catalog: Catalog = {
     "Collapse all": "Alle einklappen",
     "Expand all": "Alle ausklappen",
     "Send now instead": "Stattdessen jetzt senden",
+    "This message is rich text": "Diese Nachricht ist formatierter Text",
+    "This message is plain text": "Diese Nachricht ist Nur-Text",
     "Switch to plain text": "Zu Nur-Text wechseln",
     "Switch to rich text": "Zu formatiertem Text wechseln",
     "{used} of {total} used": "{used} von {total} belegt",
@@ -1752,6 +1754,28 @@ export const catalog: Catalog = {
     // ── Spam filter: the language model's opinion (inbuxa) ──────────
     "Language model's opinion": "Einschätzung des Sprachmodells",
     "One of several signals the spam filter weighed": "Eines von mehreren Signalen, die der Spamfilter berücksichtigt hat",
+    // inbuxa: legacy mail protocols, one switch per protocol
+    "Your organization has turned off {protocols} for mail apps. Mail apps that use it can't connect to this account; others still can.": "Ihre Organisation hat {protocols} für Mail-Apps ausgeschaltet. Mail-Apps, die das nutzen, können sich nicht mit diesem Konto verbinden; andere schon.",
+    "Some legacy mail protocols are off for your organization: {protocols}.": "Einige ältere Mailprotokolle sind für Ihre Organisation ausgeschaltet: {protocols}.",
+    "Some are off for {tenant}: {protocols}. Switch them one at a time in the administration console.": "Einige sind für {tenant} aus: {protocols}. In der Verwaltungskonsole lassen sie sich einzeln ein- und ausschalten.",
+    // inbuxa: deleting a person is the console's (audit-hold-lock spec)
+    "Deleting, locking and legal holds are done in the administration console, which records why and keeps what a hold covers.": "Löschen, Sperren und rechtliche Aufbewahrungspflichten werden in der Verwaltungskonsole erledigt, die den Grund festhält und bewahrt, was eine Aufbewahrungspflicht umfasst.",
+    "Open in the console": "In der Konsole öffnen",
+    // inbuxa AL-7, AL-8: a locked account handed to the reader
+    "You no longer have access to {name}. Back to your own mail.": "Sie haben keinen Zugriff mehr auf {name}. Zurück zu Ihren eigenen E-Mails.",
+    "You can't send from {name}. It was handed to you to read, not to send as.": "Sie können nicht als {name} senden. Das Konto wurde Ihnen zum Lesen übergeben, nicht zum Senden.",
+    "This account was handed to you to read. Nothing in it can be changed.": "Dieses Konto wurde Ihnen zum Lesen übergeben. Darin kann nichts geändert werden.",
+    "You can file and move mail in this account, but not delete it.": "Sie können E-Mails in diesem Konto ablegen und verschieben, aber nicht löschen.",
+    "Read only": "Nur lesen",
+    "Read and organize": "Lesen und ordnen",
+    "Full access": "Voller Zugriff",
+    "Locked account:": "Gesperrtes Konto:",
+    "You can send as this account": "Sie können als dieses Konto senden",
+    "Back to my mail": "Zurück zu meinen E-Mails",
+    "Send or close the message you're writing first.": "Senden oder schließen Sie zuerst die Nachricht, die Sie gerade schreiben.",
+    "Mail to show": "E-Mails anzeigen von",
+    "My mail": "Meine E-Mails",
+    "Locked account": "Gesperrtes Konto",
   },
   plurals: {
     // ── Administration: legacy mail protocols (INBUXA) ──────────────

web/src/locales/es.ts

@@ -1379,6 +1379,8 @@ export const catalog: Catalog = {
     "Collapse all": "Contraer todo",
     "Expand all": "Expandir todo",
     "Send now instead": "Enviar ahora, sin programar",
+    "This message is rich text": "Este mensaje es texto enriquecido",
+    "This message is plain text": "Este mensaje es texto sin formato",
     "Switch to plain text": "Cambiar a texto sin formato",
     "Switch to rich text": "Cambiar a texto enriquecido",
     "{used} of {total} used": "{used} de {total} usados",
@@ -1725,6 +1727,28 @@ export const catalog: Catalog = {
     // ── Spam filter: the language model's opinion (inbuxa) ──────────
     "Language model's opinion": "Opinión del modelo de lenguaje",
     "One of several signals the spam filter weighed": "Una de varias señales que el filtro de spam ha tenido en cuenta",
+    // inbuxa: legacy mail protocols, one switch per protocol
+    "Your organization has turned off {protocols} for mail apps. Mail apps that use it can't connect to this account; others still can.": "Su organización ha desactivado {protocols} para las aplicaciones de correo. Las que lo usan no pueden conectarse a esta cuenta; las demás sí.",
+    "Some legacy mail protocols are off for your organization: {protocols}.": "Algunos protocolos de correo heredados están desactivados para su organización: {protocols}.",
+    "Some are off for {tenant}: {protocols}. Switch them one at a time in the administration console.": "Algunos están desactivados para {tenant}: {protocols}. Actívelos o desactívelos uno a uno en la consola de administración.",
+    // inbuxa: deleting a person is the console's (audit-hold-lock spec)
+    "Deleting, locking and legal holds are done in the administration console, which records why and keeps what a hold covers.": "Eliminar, bloquear y las retenciones legales se gestionan en la consola de administración, que registra el motivo y conserva lo que cubre una retención.",
+    "Open in the console": "Abrir en la consola",
+    // inbuxa AL-7, AL-8: a locked account handed to the reader
+    "You no longer have access to {name}. Back to your own mail.": "Ya no tiene acceso a {name}. Vuelve a su propio correo.",
+    "You can't send from {name}. It was handed to you to read, not to send as.": "No puede enviar desde {name}. Se le entregó para leerla, no para enviar en su nombre.",
+    "This account was handed to you to read. Nothing in it can be changed.": "Esta cuenta se le entregó para leerla. No se puede cambiar nada en ella.",
+    "You can file and move mail in this account, but not delete it.": "Puede archivar y mover el correo de esta cuenta, pero no eliminarlo.",
+    "Read only": "Solo lectura",
+    "Read and organize": "Leer y organizar",
+    "Full access": "Acceso completo",
+    "Locked account:": "Cuenta bloqueada:",
+    "You can send as this account": "Puede enviar como esta cuenta",
+    "Back to my mail": "Volver a mi correo",
+    "Send or close the message you're writing first.": "Envíe o cierre primero el mensaje que está escribiendo.",
+    "Mail to show": "Correo que mostrar",
+    "My mail": "Mi correo",
+    "Locked account": "Cuenta bloqueada",
   },
   plurals: {
     // ── Administration: legacy mail protocols (INBUXA) ──────────────

web/src/locales/fr.ts

@@ -1384,6 +1384,8 @@ export const catalog: Catalog = {
     "Collapse all": "Tout réduire",
     "Expand all": "Tout développer",
     "Send now instead": "Envoyer tout de suite",
+    "This message is rich text": "Ce message est en texte enrichi",
+    "This message is plain text": "Ce message est en texte brut",
     "Switch to plain text": "Passer en texte brut",
     "Switch to rich text": "Passer en texte enrichi",
     "{used} of {total} used": "{used} sur {total} utilisés",
@@ -1730,6 +1732,28 @@ export const catalog: Catalog = {
     // ── Spam filter: the language model's opinion (inbuxa) ──────────
     "Language model's opinion": "Avis du modèle de langage",
     "One of several signals the spam filter weighed": "Un signal parmi d'autres pris en compte par le filtre antispam",
+    // inbuxa: legacy mail protocols, one switch per protocol
+    "Your organization has turned off {protocols} for mail apps. Mail apps that use it can't connect to this account; others still can.": "Votre organisation a désactivé {protocols} pour les applications de messagerie. Celles qui l’utilisent ne peuvent pas se connecter à ce compte ; les autres le peuvent toujours.",
+    "Some legacy mail protocols are off for your organization: {protocols}.": "Certains protocoles de messagerie historiques sont désactivés pour votre organisation : {protocols}.",
+    "Some are off for {tenant}: {protocols}. Switch them one at a time in the administration console.": "Certains sont désactivés pour {tenant} : {protocols}. Activez-les ou désactivez-les un par un dans la console d’administration.",
+    // inbuxa: deleting a person is the console's (audit-hold-lock spec)
+    "Deleting, locking and legal holds are done in the administration console, which records why and keeps what a hold covers.": "La suppression, le verrouillage et les conservations légales se font dans la console d’administration, qui enregistre le motif et conserve ce qu’une conservation couvre.",
+    "Open in the console": "Ouvrir dans la console",
+    // inbuxa AL-7, AL-8: a locked account handed to the reader
+    "You no longer have access to {name}. Back to your own mail.": "Vous n’avez plus accès à {name}. Retour à votre propre courrier.",
+    "You can't send from {name}. It was handed to you to read, not to send as.": "Vous ne pouvez pas envoyer depuis {name}. Ce compte vous a été confié pour le lire, pas pour envoyer en son nom.",
+    "This account was handed to you to read. Nothing in it can be changed.": "Ce compte vous a été confié pour le lire. Rien ne peut y être modifié.",
+    "You can file and move mail in this account, but not delete it.": "Vous pouvez classer et déplacer le courrier de ce compte, mais pas le supprimer.",
+    "Read only": "Lecture seule",
+    "Read and organize": "Lecture et classement",
+    "Full access": "Accès complet",
+    "Locked account:": "Compte verrouillé :",
+    "You can send as this account": "Vous pouvez envoyer au nom de ce compte",
+    "Back to my mail": "Retour à mon courrier",
+    "Send or close the message you're writing first.": "Envoyez ou fermez d’abord le message que vous rédigez.",
+    "Mail to show": "Courrier à afficher",
+    "My mail": "Mon courrier",
+    "Locked account": "Compte verrouillé",
   },
   plurals: {
     // ── Administration: legacy mail protocols (INBUXA) ──────────────

web/src/locales/ja.ts

@@ -1387,6 +1387,8 @@ export const catalog: Catalog = {
     "Collapse all": "すべて折りたたむ",
     "Expand all": "すべて展開",
     "Send now instead": "予約をやめて今すぐ送信",
+    "This message is rich text": "このメールはリッチテキストです",
+    "This message is plain text": "このメールはプレーンテキストです",
     "Switch to plain text": "プレーンテキストに切り替え",
     "Switch to rich text": "リッチテキストに切り替え",
     "{used} of {total} used": "{total} 中 {used} を使用",
@@ -1733,6 +1735,28 @@ export const catalog: Catalog = {
     // ── Spam filter: the language model's opinion (inbuxa) ──────────
     "Language model's opinion": "言語モデルの見解",
     "One of several signals the spam filter weighed": "迷惑メールフィルターが考慮した複数の判断材料のひとつ",
+    // inbuxa: legacy mail protocols, one switch per protocol
+    "Your organization has turned off {protocols} for mail apps. Mail apps that use it can't connect to this account; others still can.": "組織ではメールアプリ向けの {protocols} がオフになっています。これを使うメールアプリはこのアカウントに接続できませんが、ほかのアプリは接続できます。",
+    "Some legacy mail protocols are off for your organization: {protocols}.": "組織では一部の従来のメールプロトコルがオフになっています: {protocols}。",
+    "Some are off for {tenant}: {protocols}. Switch them one at a time in the administration console.": "{tenant} では一部がオフです: {protocols}。管理コンソールで 1 つずつ切り替えてください。",
+    // inbuxa: deleting a person is the console's (audit-hold-lock spec)
+    "Deleting, locking and legal holds are done in the administration console, which records why and keeps what a hold covers.": "削除、ロック、訴訟ホールドは管理コンソールで行います。コンソールでは理由が記録され、ホールドの対象は保持されます。",
+    "Open in the console": "コンソールで開く",
+    // inbuxa AL-7, AL-8: a locked account handed to the reader
+    "You no longer have access to {name}. Back to your own mail.": "{name} にアクセスできなくなりました。自分のメールに戻ります。",
+    "You can't send from {name}. It was handed to you to read, not to send as.": "{name} から送信することはできません。このアカウントは閲覧のために委任されています。",
+    "This account was handed to you to read. Nothing in it can be changed.": "このアカウントは閲覧用に委任されています。内容を変更することはできません。",
+    "You can file and move mail in this account, but not delete it.": "このアカウントのメールは整理・移動できますが、削除はできません。",
+    "Read only": "閲覧のみ",
+    "Read and organize": "閲覧と整理",
+    "Full access": "フルアクセス",
+    "Locked account:": "ロックされたアカウント:",
+    "You can send as this account": "このアカウントとして送信できます",
+    "Back to my mail": "自分のメールに戻る",
+    "Send or close the message you're writing first.": "作成中のメッセージを先に送信するか閉じてください。",
+    "Mail to show": "表示するメール",
+    "My mail": "自分のメール",
+    "Locked account": "ロックされたアカウント",
   },
   plurals: {
     // ── Administration: legacy mail protocols (INBUXA) ──────────────

web/src/locales/nl.ts

@@ -1,13 +1,16 @@
 import type { Catalog } from "@/lib/i18n";
 
 /**
- * Dutch — generated by AI, and not reviewed by a native speaker.
+ * Dutch — generated by AI, then read and corrected by a native speaker.
  *
- * Same standing as German and French: written against the terminology Dutch
- * mail clients already use rather than invented, marked Beta in the picker,
- * and carrying a report link that is the review process until somebody who
- * speaks Dutch signs it off. A missing string renders its English source, so
- * deleting a bad entry is a valid fix.
+ * Michael (mbjboon82, https://git.coffeylabs.org/mbjboon82; also
+ * mbjboon-netizen) reviewed the whole catalog, this one and permissions/nl.ts,
+ * and signed it off in September 2026, so Dutch is the first language out of
+ * Beta. The Dutch wording is his; where it differs from what an earlier draft
+ * or a style guide would choose, his call stands. The reviewer's notes below
+ * are kept where they were left. A missing string still renders its English
+ * source, and strings added after the review have not been read by a Dutch
+ * speaker yet.
  *
  * ── Decisions this file is consistent about ──────────────────────────────
  * --- Native speaker note: i would keep the more formal "u" and "uw" ---
@@ -441,7 +444,7 @@ export const catalog: Catalog = {
     "Move up": "Omhoog",
     "Move down": "Omlaag",
     "Drag to reorder": "Sleep om te herschikken",
-    "Right-click for options": "Rechtsklik voor opties",
+    "Right-click for options": "Rechtermuisknop voor opties",
 
     // ── Mail ───────────────────────────────────────────────────────────
     "Mail": "E-mail",
@@ -628,7 +631,7 @@ export const catalog: Catalog = {
     "Working hours": "Werktijden",
     "Working hours start": "Werktijd begint",
     "Working hours end": "Werktijd eindigt",
-    "Color categories": "Kleurcategorieën",
+    "Color categories": "Kleur categorieën",
     "Category": "Categorie",
     "No category": "Geen categorie",
     "New category": "Nieuwe categorie",
@@ -811,10 +814,10 @@ export const catalog: Catalog = {
     "Huge": "Zeer groot",
     "Sidebar": "Zijbalk",
     "Show labels in the sidebar": "Labels in de zijbalk tonen",
-    "Collapse sidebar to icons": "Zijbalk inklappen tot pictogrammen",
+    "Collapse sidebar to icons": "Zijbalk inklappen en toon alleen pictogrammen",
     "Apply the theme to messages too": "Thema ook op berichten toepassen",
-    "Apply it even to mail that styles itself": "Pas dit ook toe op e-mail met eigen vormgeving",
-    "Most marketing and receipt mail sets a color somewhere, so the setting above leaves nearly all of it on a white card. With this on, the theme is forced over the sender's own colors: backgrounds they laid the message on are dropped, while buttons and colored banners are kept so their text stays readable. Some mail will not survive it intact, which is why it is separate.": "Bijna alle reclame- en bonmail zet ergens een kleur, waardoor de instelling hierboven vrijwel alles op een witte kaart laat staan. Met deze optie wordt het thema over de kleuren van de afzender heen gelegd: achtergronden waarop het bericht is geplaatst vervallen, terwijl knoppen en gekleurde banners blijven staan zodat hun tekst leesbaar blijft. Sommige berichten overleven dat niet ongeschonden, en daarom is dit een aparte instelling.",
+    "Apply it even to mail that styles itself": "Pas dit ook toe op e-mails met eigen vormgeving",
+    "Most marketing and receipt mail sets a color somewhere, so the setting above leaves nearly all of it on a white card. With this on, the theme is forced over the sender's own colors: backgrounds they laid the message on are dropped, while buttons and colored banners are kept so their text stays readable. Some mail will not survive it intact, which is why it is separate.": "De meeste marketing- en ontvangst-/bevestigingsmails stellen ergens een kleur in, waardoor de instelling hierboven vrijwel alles op een witte kaart laat staan. Met deze optie wordt het thema over de kleuren van de afzender heen gelegd: achtergronden waarop het bericht is geplaatst vervallen, terwijl knoppen en gekleurde banners blijven staan zodat hun tekst leesbaar blijft. Sommige e-mails zullen hierdoor niet helemaal intact blijven. Daarom staat deze optie apart.",
     "Swiping": "Vegen",
     "Swipe left": "Naar links vegen",
     "Swipe right": "Naar rechts vegen",
@@ -822,7 +825,7 @@ export const catalog: Catalog = {
     "Export settings": "Instellingen exporteren",
     "Import settings": "Instellingen importeren",
     "Settings imported": "Instellingen geïmporteerd",
-    "Invalid settings file": "Ongeldig instellingenbestand",
+    "Invalid settings file": "Instellingenbestand is ongeldig",
     "Reset to defaults": "Standaardwaarden herstellen",
     "Default mail app": "Standaard e-mailprogramma",
     "Documentation": "Documentatie",
@@ -835,7 +838,7 @@ export const catalog: Catalog = {
     "Account": "Account",
     "Max upload": "Maximale upload",
     "{size} MB": "{size} MB",
-    "KB": "kB",
+    "KB": "KB",
     "Image privacy proxy": "Privacyproxy voor afbeeldingen",
     "enabled": "ingeschakeld",
     "disabled": "uitgeschakeld",
@@ -844,7 +847,7 @@ export const catalog: Catalog = {
     "hidden": "verborgen",
     "connected": "verbonden",
     "reconnecting…": "opnieuw verbinden…",
-    "AGPL-3.0 source": "AGPL-3.0-broncode",
+    "AGPL-3.0 source": "AGPL-3.0 broncode",
 
     // ── Identities, templates, filters ─────────────────────────────────
     "Identities & signatures": "Identiteiten en handtekeningen",
@@ -868,9 +871,9 @@ export const catalog: Catalog = {
     "Insert template": "Sjabloon invoegen",
     "Template text…": "Sjabloontekst…",
     "Subject: {subject}": "Onderwerp: {subject}",
-    "Filters & rules": "Filters en regels",
+    "Filters & rules": "Filters en filterregels",
     "Filters unavailable": "Filters niet beschikbaar",
-    "Rules": "Regels",
+    "Rules": "Filterregels",
     "Rule name": "Naam van de regel",
     "New rule": "Nieuwe regel",
     "Delete rule": "Regel verwijderen",
@@ -893,7 +896,7 @@ export const catalog: Catalog = {
     "does not exist": "bestaat niet",
     "is larger than": "is groter dan",
     "is smaller than": "is kleiner dan",
-    "Stop processing more rules": "Stoppen met verdere regels",
+    "Stop processing more rules": "Geen verdere filterregels verwerken",
     "keep copy": "kopie bewaren",
     "Forward to": "Doorsturen naar",
     "Reject with message": "Weigeren met bericht",
@@ -904,8 +907,8 @@ export const catalog: Catalog = {
     "Delete script": "Script verwijderen",
     "Sieve source": "Sieve-broncode",
     "Preview generated Sieve script": "Gegenereerd Sieve-script bekijken",
-    "Start with rules": "Beginnen met regels",
-    "Switch to rules?": "Overschakelen naar regels?",
+    "Start with rules": "Beginnen met filterregels",
+    "Switch to rules?": "Overschakelen naar filterregels?",
     "Create filter": "Filter maken",
     "Filter messages like this": "Berichten zoals dit filteren",
     "Filter messages like this…": "Berichten zoals dit filteren…",
@@ -926,7 +929,7 @@ export const catalog: Catalog = {
     "Code from your authenticator": "Code uit uw authenticator-app",
     "Two-factor authentication": "Tweefactorauthenticatie",
     "Turn off two-factor authentication": "Tweefactorauthenticatie uitschakelen",
-    "Your password alone will be enough to sign in again.": "Uw wachtwoord alleen volstaat dan weer om in te loggen.",
+    "Your password alone will be enough to sign in again.": "Met alleen uw wachtwoord kunt u opnieuw inloggen.",
     "App passwords": "App-wachtwoorden",
     "Your organization allows only {app} and JMAP apps, so phone and desktop mail apps can't connect to this account.": "Uw organisatie staat alleen {app} en JMAP-apps toe, dus mail-apps op telefoon en computer kunnen geen verbinding maken met dit account.",
     "New app password for": "Nieuw app-wachtwoord voor",
@@ -951,19 +954,19 @@ export const catalog: Catalog = {
     "Type": "Type",
     "Email or username": "E-mail of gebruikersnaam",
     "Use your usual address as the username.": "Gebruik uw gebruikelijke adres als gebruikersnaam.",
-    "Fast, friendly webmail. Your mailbox, your way.": "Snelle, prettige webmail. Uw postbus, op uw manier.",
+    "Fast, friendly webmail. Your mailbox, your way.": "Snelle, prettige webmail. Uw postvak, op uw manier.",
 
     "Notifications": "Meldingen",
     "Notifications are blocked in your browser settings.": "Meldingen zijn geblokkeerd in uw browserinstellingen.",
     "Not supported in this browser.": "Niet ondersteund in deze browser.",
     "Desktop notifications while {app} is open": "Systeemmeldingen terwijl {app} open is",
     "Notify me even when {app} is closed": "Ook melden wanneer {app} gesloten is",
-    "Play a sound for new mail": "Geluid afspelen bij nieuwe post",
+    "Play a sound for new mail": "Geluid afspelen bij nieuwe e-mail",
     "Test notification": "Testmelding",
     "Background notifications are on": "Achtergrondmeldingen staan aan",
-    "The tab title and favicon always show your unread Inbox count.": "De tabbladtitel en het favicon tonen altijd het aantal ongelezen berichten in Postvak IN.",
+    "The tab title and favicon always show your unread Inbox count.": "De titel van het tabblad en het favicon tonen altijd het aantal ongelezen berichten in Postvak IN.",
     "Live updates are delivered via JMAP push ({state}).": "Live-updates komen binnen via JMAP-push ({state}).",
-    "Shows a system notification when new mail arrives in your Inbox while the tab is in the background.": "Toont een systeemmelding wanneer er nieuwe post in Postvak IN aankomt terwijl het tabblad op de achtergrond staat.",
+    "Shows a system notification when new mail arrives in your Inbox while the tab is in the background.": "Toont een systeemmelding wanneer er een nieuwe e-mail in Postvak IN aankomt terwijl het tabblad op de achtergrond staat.",
 
     // ── Editor, search, shortcuts, misc ────────────────────────────────
     "Formatting": "Opmaak",
@@ -1027,20 +1030,20 @@ export const catalog: Catalog = {
     "Images are stored in your Files (folder “ihasmail”) and embedded when you send.": "Afbeeldingen worden opgeslagen in uw bestanden (map “ihasmail”) en bij verzending ingesloten.",
     "Thanks for your message. I'm away until … and will reply when I'm back.": "Bedankt voor uw bericht. Ik ben afwezig tot … en reageer zodra ik terug ben.",
     "Automatically reply to people who email you while you're away. Each sender gets at most one reply.": "Automatisch antwoorden aan mensen die u mailen terwijl u weg bent. Elke afzender krijgt hoogstens één antwoord.",
-    "Sort incoming mail automatically. Rules run on the server (Sieve), so they work for every client you use.": "Inkomende post automatisch sorteren. De regels draaien op de server (Sieve) en gelden dus voor elke client die u gebruikt.",
+    "Sort incoming mail automatically. Rules run on the server (Sieve), so they work for every client you use.": "Inkomende e-mails automatisch sorteren. De filterregels staan op de server (Sieve) en gelden dus voor elke client die u gebruikt.",
     "Canned responses you can insert into any message from the composer's template button.": "Kant-en-klare antwoorden die u via de sjabloonknop in elk bericht kunt invoegen.",
-    "Create a rule to move newsletters to a folder, flag important senders, or forward mail.": "Maak een regel om nieuwsbrieven naar een map te verplaatsen, belangrijke afzenders te markeren of post door te sturen.",
+    "Create a rule to move newsletters to a folder, flag important senders, or forward mail.": "Maak een filterregel om nieuwsbrieven naar een map te verplaatsen, belangrijke afzenders te markeren of een e-mail door te sturen.",
     "Advanced: manage raw Sieve scripts. Only one script can be active at a time.": "Geavanceerd: Sieve-scripts rechtstreeks beheren. Er kan maar één script tegelijk actief zijn.",
     "Only part of your filter script arrived.": "Slechts een deel van uw filterscript is aangekomen.",
     "Your active script “{name}” was written by hand.": "Uw actieve script “{name}” is met de hand geschreven.",
-    "Another script (“{name}”) is active. Saving rules here will activate the “ihasmail” script instead.": "Een ander script (“{name}”) is actief. Als u hier regels opslaat, wordt in plaats daarvan het script “ihasmail” geactiveerd.",
+    "Another script (“{name}”) is active. Saving rules here will activate the “ihasmail” script instead.": "Een ander script (“{name}”) is actief. Als u hier filterregels opslaat, wordt in plaats daarvan het script “ihasmail” geactiveerd.",
     "“{name}” will be deactivated (not deleted) and a new “ihasmail” script will take over.": "“{name}” wordt gedeactiveerd (niet verwijderd) en een nieuw script “ihasmail” neemt het over.",
     "Sieve filtering is not available for this account.": "Sieve-filtering is niet beschikbaar voor dit account.",
     "Sieve filtering is not enabled for this account.": "Sieve-filtering is niet ingeschakeld voor dit account.",
     "Vacation responses are not available for this account.": "Afwezigheidsantwoorden zijn niet beschikbaar voor dit account.",
-    "This account does not have the JMAP calendars capability.": "Dit account beschikt niet over de JMAP-agendafunctie.",
-    "This account does not have the JMAP contacts capability.": "Dit account beschikt niet over de JMAP-contactenfunctie.",
-    "This account does not have the JMAP file storage capability.": "Dit account beschikt niet over de JMAP-bestandsopslagfunctie.",
+    "This account does not have the JMAP calendars capability.": "Dit account beschikt niet over de JMAP-agenda functie.",
+    "This account does not have the JMAP contacts capability.": "Dit account beschikt niet over de JMAP-contacten functie.",
+    "This account does not have the JMAP file storage capability.": "Dit account beschikt niet over de JMAP-bestandsopslag functie.",
 
     // ── Labels held in constants, translated where they render ─────────
     "Add": "Toevoegen",
@@ -1099,62 +1102,62 @@ export const catalog: Catalog = {
     "share sheet\u0004Share…": "Delen…",
     "folder": "map",
     "“{name}” moved into “{parent}”": "“{name}” is verplaatst naar “{parent}”",
-    "“{name}” moved to the top level": "“{name}” is naar het hoogste niveau verplaatst",
+    "“{name}” moved to the top level": "“{name}” is naar het hoofdniveau verplaatst",
     "Move “{name}” to…": "“{name}” verplaatsen naar…",
-    "Top level": "Hoogste niveau",
+    "Top level": "Hoofdniveau",
     "Could not move “{name}”: {reason}": "Kon “{name}” niet verplaatsen: {reason}",
     "Delete “{name}”?": "“{name}” verwijderen?",
     "Rename folder": "Map hernoemen",
     "Search: {query}": "Zoeken: {query}",
     "No conversation selected": "Geen gesprek geselecteerd",
     "No message selected": "Geen bericht geselecteerd",
-    "Drop here for the top level": "Hier neerzetten voor het hoogste niveau",
+    "Drop here for the top level": "Hier neerzetten voor het hoofdniveau",
 
     // ── Longer prose ───────────────────────────────────────────────────
     "Search mail  (from:, to:, subject:, has:attachment, is:unread, in:, before:, after:)": "In e-mail zoeken  (from:, to:, subject:, has:attachment, is:unread, in:, before:, after:)",
-    "Settings → Filters & rules": "Instellingen → Filters en regels",
-    "Open the Mail view to see all shortcuts.": "Open de E-mailweergave om alle sneltoetsen te zien.",
+    "Settings → Filters & rules": "Instellingen → Filters en filterregels",
+    "Open the Mail view to see all shortcuts.": "Open de e-mailweergave om alle sneltoetsen te zien.",
     "Gmail-style shortcuts are always on. Press {key} anywhere to see this list.": "Sneltoetsen in Gmail-stijl staan altijd aan. Druk overal op {key} om deze lijst te zien.",
     "Select a conversation to read it here · Press {key} for shortcuts": "Selecteer een gesprek om het hier te lezen · {key} voor sneltoetsen",
     "Select a message to read it here · Press {key} for shortcuts": "Selecteer een bericht om het hier te lezen · {key} voor sneltoetsen",
     "Tip: press {key} on a conversation to apply labels. Search with {operator}.": "Tip: druk op {key} bij een gesprek om labels toe te wijzen. Zoek met {operator}.",
     "Defaults for the calendar views and new events.": "Standaardwaarden voor de agendaweergaven en nieuwe afspraken.",
     "Replies will go to this address instead of the From address": "Antwoorden gaan naar dit adres in plaats van naar het afzenderadres",
-    "Replies to mail sent from this identity go here instead of the From address.": "Antwoorden op post die vanaf deze identiteit is verzonden, komen hier aan in plaats van bij het afzenderadres.",
-    "New identities must use an address this account is allowed to send from (aliases configured on the server).": "Een nieuwe identiteit moet een adres gebruiken waarvandaan dit account mag verzenden (aliassen die op de server zijn ingesteld).",
-    "Not offered when composing. It still receives mail, and you can still send from it by showing it again.": "Wordt niet aangeboden bij het opstellen. Het adres ontvangt nog steeds post, en u kunt er weer vanaf verzenden door het opnieuw te tonen.",
+    "Replies to mail sent from this identity go here instead of the From address.": "Antwoorden op e-mails die vanaf deze identiteit is verzonden, komen hier aan in plaats van bij het afzenderadres.",
+    "New identities must use an address this account is allowed to send from (aliases configured on the server).": "Nieuwe identiteiten moeten een adres gebruiken waar dit account vanaf mag verzenden (aliassen die op de server zijn ingesteld).",
+    "Not offered when composing. It still receives mail, and you can still send from it by showing it again.": "Wordt niet aangeboden bij het opstellen. Het adres ontvangt nog steeds e-mails, en u kunt er weer vanaf verzenden door het opnieuw te tonen.",
     "Each identity is a sender address with its own name, Reply-To and signature. The default identity is preselected when you compose; set a Reply-To when replies should go somewhere other than the From address.": "Elke identiteit is een afzenderadres met een eigen naam, antwoordadres en handtekening. De standaardidentiteit is voorgeselecteerd bij het opstellen; stel een antwoordadres in wanneer antwoorden ergens anders heen moeten dan naar het afzenderadres.",
-    "This signature is larger than the server's {limit}-byte limit. {app} will keep the full version in your Files and store a short text fallback on the server \u2014 other mail clients will see the plain-text version.": "Deze handtekening is groter dan de limiet van {limit} bytes van de server. {app} bewaart de volledige versie in uw Bestanden en zet een korte tekstversie op de server \u2014 andere e-mailprogramma's zien de platte-tekstversie.",
-    "Outlook-style categories you can assign to events from the right-click menu or the event editor. The category name is stored on the event, so it syncs to other clients.": "Categorieën in Outlook-stijl die u via het rechtsklikmenu of de afsprakeneditor aan afspraken kunt toewijzen. De categorienaam wordt in de afspraak opgeslagen en synchroniseert dus met andere clients.",
+    "This signature is larger than the server's {limit}-byte limit. {app} will keep the full version in your Files and store a short text fallback on the server \u2014 other mail clients will see the plain-text version.": "Deze handtekening is groter dan de limiet van {limit} bytes van de server. {app} bewaart de volledige versie in uw bestanden en zet een korte tekstversie op de server \u2014 andere e-mailprogramma's zien de platte-tekstversie.",
+    "Outlook-style categories you can assign to events from the right-click menu or the event editor. The category name is stored on the event, so it syncs to other clients.": "Categorieën in Outlook-stijl die u via het rechtermuisknop-menu of de afsprakeneditor aan afspraken kunt toewijzen. De categorienaam wordt in de afspraak opgeslagen en synchroniseert met andere clients.",
     "Plain-text mail already follows the theme. With this on, HTML mail that brings no colors of its own does as well, instead of sitting on a white card. Messages that style themselves are left exactly as the sender designed them.": "Platte-tekstberichten volgen het thema al. Met deze optie doen HTML-berichten zonder eigen kleuren dat ook, in plaats van op een witte achtergrond te staan. Berichten met een eigen vormgeving blijven precies zoals de afzender ze heeft ontworpen.",
-    "This is separate from {setting} in General, which decides how dates, times and numbers are written. You can read an English interface with German dates, or the other way round.": "Dit staat los van {setting} onder Algemeen, waar wordt bepaald hoe datums, tijden en getallen worden geschreven. U kunt een Engelse interface met Nederlandse datums lezen, of andersom.",
-    "On a touchscreen, drag a message sideways to act on it. Each direction can do one thing, or nothing. These follow your account, so a phone and a tablet agree; a mouse ignores them and keeps dragging messages into folders instead.": "Sleep op een aanraakscherm een bericht opzij om er iets mee te doen. Elke richting kan één ding doen, of niets. Deze instelling volgt uw account, zodat telefoon en tablet overeenkomen; met een muis wordt ze genegeerd en blijft slepen naar mappen werken.",
+    "This is separate from {setting} in General, which decides how dates, times and numbers are written. You can read an English interface with German dates, or the other way round.": "Dit staat los van {setting} onder Algemeen, waar wordt bepaald hoe datums, tijden en getallen worden geschreven. U kunt bijvoorbeeld een Engelse interface met Nederlandse datums kiezen, of andersom.",
+    "On a touchscreen, drag a message sideways to act on it. Each direction can do one thing, or nothing. These follow your account, so a phone and a tablet agree; a mouse ignores them and keeps dragging messages into folders instead.": "Veeg op een touchscreen een bericht opzij om er een actie op uit te voeren. Elke richting kan een eigen actie uitvoeren, of helemaal niets doen. Deze instellingen worden aan uw account gekoppeld, zodat uw telefoon en tablet dezelfde instellingen gebruiken. Met een muis worden deze instellingen genegeerd en kunt u berichten gewoon naar mappen slepen.",
     "This screen has no touchscreen, so nothing here changes what it does. Your phone or tablet will pick these up.": "Dit scherm heeft geen aanraakscherm, dus hier verandert niets. Uw telefoon of tablet neemt deze instellingen over.",
-    "Holding a message selects it, and holding a folder opens its menu. Pull the top of the message list down to check for new mail.": "Een bericht ingedrukt houden selecteert het, een map ingedrukt houden opent het menu. Trek de bovenkant van de berichtenlijst omlaag om nieuwe post op te halen.",
-    "A receipt tells whoever asked that this address is live and when the message was read, and the sender chooses where it goes — so there is no automatic option. Bulk mail, mailing lists and anything marked auto-submitted are never offered one at all.": "Een bevestiging vertelt de aanvrager dat dit adres actief is en wanneer het bericht is gelezen, en de afzender bepaalt waar die heen gaat — daarom is er geen automatische optie. Bij bulkpost, mailinglijsten en alles wat als automatisch verzonden is gemarkeerd, wordt er nooit een aangeboden.",
-    "This browser cannot register apps for {scheme} links. Safari, in particular, has no such API \u2014 you can still make {app} the default from your operating system if you install it as an app.": "Deze browser kan geen programma's registreren voor {scheme}-links. Safari heeft daar in het bijzonder geen voorziening voor \u2014 u kunt {app} nog steeds als standaard instellen via uw besturingssysteem als u het als app installeert.",
+    "Holding a message selects it, and holding a folder opens its menu. Pull the top of the message list down to check for new mail.": "Houd een bericht ingedrukt om het te selecteren en houd een map ingedrukt om het menu ervan te openen. Trek de bovenkant van de berichtenlijst omlaag om nieuwe e-mails op te halen.",
+    "A receipt tells whoever asked that this address is live and when the message was read, and the sender chooses where it goes — so there is no automatic option. Bulk mail, mailing lists and anything marked auto-submitted are never offered one at all.": "Een bevestiging vertelt de aanvrager dat dit adres actief is en wanneer het bericht is gelezen, en de afzender bepaalt waar die heen gaat — daarom is er geen automatische optie. Bulkmail, mailinglijsten en alles wat als automatisch verzonden is gemarkeerd, krijgen nooit deze optie aangeboden.",
+    "This browser cannot register apps for {scheme} links. Safari, in particular, has no such API \u2014 you can still make {app} the default from your operating system if you install it as an app.": "Deze browser kan geen programma's registreren voor {scheme}-links. Safari in het bijzonder heeft daar geen voorziening voor \u2014 u kunt {app} nog steeds als standaard instellen via uw besturingssysteem als u het als een app installeert.",
     "Registering for {scheme} links requires a secure (HTTPS) connection.": "Registreren voor {scheme}-links vereist een beveiligde (HTTPS-)verbinding.",
     "Open {scheme} links \u2014 in web pages, documents and other apps \u2014 in {app} instead of a desktop mail client. Your browser will ask you to confirm, and you can change it later in its own settings (Chrome: Settings \u203a Privacy and security \u203a Site settings \u203a Protocol handlers; Firefox: Settings \u203a General \u203a Applications).": "{scheme}-links \u2014 op webpagina's, in documenten en in andere programma's \u2014 openen in {app} in plaats van in een lokaal e-mailprogramma. Uw browser vraagt om bevestiging, en u kunt dit later wijzigen in zijn eigen instellingen (Chrome: Instellingen \u203a Privacy en beveiliging \u203a Site-instellingen \u203a Protocol-handlers; Firefox: Instellingen \u203a Algemeen \u203a Programma's).",
     "Requested in this browser. Whether it took effect is up to the browser — check its settings if mail links still open elsewhere.": "Aangevraagd in deze browser. Of het effect heeft gehad, bepaalt de browser — controleer zijn instellingen als e-mail links nog elders openen.",
     "For a system-wide default, install {app} as an app first (in Chrome: the install icon in the address bar). Your operating system can then offer {app} directly wherever it asks which mail app to use.": "Installeer {app} eerst als app voor een systeembrede standaard (in Chrome: het installatiepictogram in de adresbalk). Uw besturingssysteem kan {app} dan overal direct aanbieden waar het vraagt welk e-mailprogramma gebruikt moet worden.",
     "Needs a browser with the Push API and a mail server that publishes a push key.": "Vereist een browser met de Push-API en een mailserver die een push-sleutel publiceert.",
-    "Your mail server delivers these straight to your browser, so they arrive with no {app} tab open, naming the sender and subject. Your browser still has to be running \u2014 if you quit it completely, notifications wait and arrive when you open it again.": "Uw mailserver levert deze rechtstreeks bij uw browser af, dus ze komen aan zonder geopend {app}-tabblad, met afzender en onderwerp erbij. Uw browser moet wel draaien \u2014 sluit u hem helemaal af, dan wachten de meldingen en komen ze binnen zodra u hem weer opent.",
-    "Your mail server can wake this browser, but will not include the sender or subject. Your browser still has to be running.": "Uw mailserver kan deze browser wekken, maar vermeldt geen afzender of onderwerp. Uw browser moet wel draaien.",
-    "This is what a new-mail notification looks like.": "Zo ziet een melding van nieuwe post eruit.",
+    "Your mail server delivers these straight to your browser, so they arrive with no {app} tab open, naming the sender and subject. Your browser still has to be running \u2014 if you quit it completely, notifications wait and arrive when you open it again.": "Uw mailserver levert deze rechtstreeks bij uw browser af, dus ze komen aan zonder geopend {app}-tabblad, met afzender en onderwerp erbij. Uw browser moet wel open staan \u2014 sluit u hem helemaal af, dan wachten de meldingen en komen ze binnen zodra u hem weer opent.",
+    "Your mail server can wake this browser, but will not include the sender or subject. Your browser still has to be running.": "Uw mailserver kan deze browser activeren, maar vermeldt daarbij geen afzender of onderwerp. Uw browser moet wel open staan.",
+    "This is what a new-mail notification looks like.": "Zo ziet een melding van nieuwe e-mails eruit.",
     "You're signed in as {user}. Your password is never stored in the browser; the server keeps it encrypted per-session for talking to the mail server.": "U bent ingelogd als {user}. Uw wachtwoord wordt nooit in de browser opgeslagen; de server bewaart het versleuteld per sessie om met de mailserver te communiceren.",
     "App passwords are managed by your mail administrator.": "App-wachtwoorden worden beheerd door uw mailbeheerder.",
-    "Changing your password signs out your other webmail sessions. Any app passwords keep working.": "Als u uw wachtwoord wijzigt, worden uw andere webmailsessies uitgelogd. App-wachtwoorden blijven werken.",
+    "Changing your password signs out your other webmail sessions. Any app passwords keep working.": "Als u uw wachtwoord wijzigt, worden uw andere webmailsessies afgemeld. App-wachtwoorden blijven werken.",
     "This account has two-factor authentication on. {app} can't sign you in with a code yet, so signing in on another device needs an app password \u2014 or you can turn two-factor authentication off here.": "Voor dit account staat tweefactorauthenticatie aan. {app} kan u nog niet met een code inloggen, dus inloggen op een ander apparaat vereist een app-wachtwoord \u2014 of u schakelt tweefactorauthenticatie hier uit.",
-    "A separate password for a mail app or device, which you can revoke on its own. App passwords skip two-factor codes, so they keep working in apps that can't ask for one.": "Een apart wachtwoord voor een e-mailprogramma of apparaat, dat u afzonderlijk kunt intrekken. App-wachtwoorden slaan tweefactorcodes over en blijven dus werken in programma's die er geen kunnen vragen.",
+    "A separate password for a mail app or device, which you can revoke on its own. App passwords skip two-factor codes, so they keep working in apps that can't ask for one.": "Een apart wachtwoord voor een e-mail app of apparaat, dat u afzonderlijk kunt intrekken. App-wachtwoorden omzeilen tweestapsverificatie, zodat ze blijven werken in apps die hier niet om kunnen vragen.",
     "Copy it into {name} now — it isn't shown again.": "Neem het nu over in {name} — het wordt niet opnieuw getoond.",
-    "No other users found in the directory, so nobody new can be added. Sharing already in place is listed below and can still be removed.": "Geen andere gebruikers gevonden in de directory, dus er kan niemand nieuws worden toegevoegd. Bestaande gedeelde items staan hieronder en kunnen nog worden verwijderd.",
-    "Stalwart does not publish its version number to mail clients, so {app} reports the edition where the server gives one. {app} requires 0.16 or newer, and sign-in refuses anything older.": "Stalwart geeft zijn versienummer niet door aan e-mailprogramma's, dus {app} noemt de editie als de server die opgeeft. {app} vereist 0.16 of nieuwer; inloggen weigert alles wat ouder is.",
-    "It {damage}, so the rules in it can't be shown or edited — saving what did arrive would write it back over the rest. Reload the page to try again. Your rules are still on the server; nothing here has changed them.": "Het {damage}, dus de regels erin kunnen niet worden getoond of bewerkt — wat wél is aangekomen opslaan zou de rest overschrijven. Laad de pagina opnieuw om het nog eens te proberen. Uw regels staan nog op de server; hier is er niets aan veranderd.",
-    "The visual rule editor only manages scripts it created. You can edit the script in the {tab} tab, or start fresh with rules (the existing script will be kept but deactivated).": "De visuele regeleditor beheert alleen scripts die hij zelf heeft gemaakt. U kunt het script bewerken op het tabblad {tab}, of opnieuw beginnen met regels (het bestaande script blijft bewaard maar wordt gedeactiveerd).",
-    "Your filter script {damage}, so only part of it arrived. Adding a rule would write that part back over the whole thing. Reload the page and try again.": "Uw filterscript {damage}, dus slechts een deel is aangekomen. Een regel toevoegen zou dat deel over het geheel heen schrijven. Laad de pagina opnieuw en probeer het nog eens.",
-    "Your filter script couldn't be read just now, so adding a rule would risk overwriting it. Reload the page and try again.": "Uw filterscript kon zojuist niet worden gelezen; een regel toevoegen zou het kunnen overschrijven. Laad de pagina opnieuw en probeer het nog eens.",
-    "Your active Sieve script was written by hand, so rules can't be added automatically. Open {where} to edit the script or switch to managed rules.": "Uw actieve Sieve-script is met de hand geschreven, dus regels kunnen niet automatisch worden toegevoegd. Open {where} om het script te bewerken of over te stappen op beheerde regels.",
-    "Only languages {app} has been translated into appear here, so this list grows as translations land rather than ahead of them \u2014 a language offered without strings behind it would leave the page claiming to be in a language it is not.": "Hier verschijnen alleen talen waarin {app} is vertaald; de lijst groeit dus mee met de vertalingen en niet erop vooruit \u2014 een taal die wordt aangeboden zonder teksten erachter zou de pagina laten beweren dat ze in een taal is die ze niet is.",
+    "No other users found in the directory, so nobody new can be added. Sharing already in place is listed below and can still be removed.": "Er zijn geen andere gebruikers in de directory gevonden, dus er kunnen geen nieuwe gebruikers worden toegevoegd. Hieronder ziet u de bestaande gedeelde items. U kunt deze nog steeds verwijderen.",
+    "Stalwart does not publish its version number to mail clients, so {app} reports the edition where the server gives one. {app} requires 0.16 or newer, and sign-in refuses anything older.": "Stalwart geeft zijn versienummer niet door aan e-mailprogramma's, dus {app} noemt de editie als de server die opgeeft. {app} vereist 0.16 of nieuwer; inloggen weigert alle oudere versies.",
+    "It {damage}, so the rules in it can't be shown or edited — saving what did arrive would write it back over the rest. Reload the page to try again. Your rules are still on the server; nothing here has changed them.": "Het {damage}, waardoor de filterregels hierin niet kunnen worden weergegeven of bewerkt. Als u opslaat wat wel is binnengekomen, wordt de rest overschreven. Laad de pagina opnieuw om het nogmaals te proberen. Uw filterregels staan nog steeds op de server; hier is niets aan gewijzigd.",
+    "The visual rule editor only manages scripts it created. You can edit the script in the {tab} tab, or start fresh with rules (the existing script will be kept but deactivated).": "De visuele filterregel-editor beheert alleen scripts die hij zelf heeft gemaakt. U kunt het script bewerken op het tabblad {tab}, of opnieuw beginnen met filterregels (het bestaande script blijft bewaard maar wordt gedeactiveerd).",
+    "Your filter script {damage}, so only part of it arrived. Adding a rule would write that part back over the whole thing. Reload the page and try again.": "Uw filterregel-script {damage}, dus slechts een deel is aangekomen. Als u een filterregel toevoegt, wordt dat deel over het volledige script heen geschreven. Laad de pagina opnieuw en probeer het nogmaals.",
+    "Your filter script couldn't be read just now, so adding a rule would risk overwriting it. Reload the page and try again.": "Uw filterregel-script kon niet worden gelezen; een regel toevoegen zou het kunnen overschrijven. Laad de pagina opnieuw en probeer het nog eens.",
+    "Your active Sieve script was written by hand, so rules can't be added automatically. Open {where} to edit the script or switch to managed rules.": "Uw actieve Sieve-script is met de hand geschreven, dus filterregels kunnen niet automatisch worden toegevoegd. Open {where} om het script te bewerken of over te stappen op beheerde filterregels.",
+    "Only languages {app} has been translated into appear here, so this list grows as translations land rather than ahead of them \u2014 a language offered without strings behind it would leave the page claiming to be in a language it is not.": "Hier verschijnen alleen de talen waarin {app} is vertaald; de lijst wordt uitgebreid zodra vertalingen beschikbaar komen, in plaats van vooraf \u2014 een aangeboden taal zonder bijbehorende vertalingen zou ervoor zorgen dat de pagina beweert in een taal te zijn die niet beschikbaar is.",
     "tell us about it": "laat het ons weten",
     "This translation was generated by AI and has not been checked by a native speaker, so it is marked Beta until somebody who speaks it signs it off. Anything that reads wrongly is worth reporting — {report}.": "Deze vertaling is door AI gemaakt en niet gecontroleerd door iemand met Nederlands als moedertaal; ze is daarom als Beta gemarkeerd tot iemand haar goedkeurt. Alles wat verkeerd klinkt, is een melding waard — {report}.",
     "{app}'s own version is the date of the commit it was built from, followed by where that commit came from: {example} was built from a commit dated the 30th of August 2026 that arrived through pull request 129. A commit that did not come through one carries its short SHA instead \u2014 {sha}. The version deliberately says nothing about Stalwart; what this build needs from the server is the line above.": "De eigen versie van {app} is de datum van de commit waaruit het is gebouwd, gevolgd door waar die commit vandaan kwam: {example} is gebouwd uit een commit van 30 augustus 2026 die via pull request 129 binnenkwam. Een commit die niet via zo'n verzoek kwam, draagt in plaats daarvan zijn korte SHA \u2014 {sha}. De versie zegt bewust niets over Stalwart; wat deze build van de server nodig heeft, staat op de regel hierboven.",
@@ -1376,6 +1379,8 @@ export const catalog: Catalog = {
     "Collapse all": "Alles samenvouwen",
     "Expand all": "Alles uitvouwen",
     "Send now instead": "Toch nu verzenden",
+    "This message is rich text": "Dit bericht is opgemaakte tekst",
+    "This message is plain text": "Dit bericht is platte tekst",
     "Switch to plain text": "Overschakelen naar platte tekst",
     "Switch to rich text": "Overschakelen naar opgemaakte tekst",
     "{used} of {total} used": "{used} van {total} gebruikt",
@@ -1722,6 +1727,28 @@ export const catalog: Catalog = {
     // ── Spam filter: the language model's opinion (inbuxa) ──────────
     "Language model's opinion": "Oordeel van het taalmodel",
     "One of several signals the spam filter weighed": "Een van meerdere signalen die het spamfilter heeft meegewogen",
+    // inbuxa: legacy mail protocols, one switch per protocol
+    "Your organization has turned off {protocols} for mail apps. Mail apps that use it can't connect to this account; others still can.": "Uw organisatie heeft {protocols} uitgeschakeld voor mail-apps. Mail-apps die dat gebruiken, kunnen geen verbinding maken met dit account; andere nog wel.",
+    "Some legacy mail protocols are off for your organization: {protocols}.": "Sommige verouderde mailprotocollen zijn uitgeschakeld voor uw organisatie: {protocols}.",
+    "Some are off for {tenant}: {protocols}. Switch them one at a time in the administration console.": "Sommige zijn uit voor {tenant}: {protocols}. In de beheerconsole zijn ze één voor één aan en uit te zetten.",
+    // inbuxa: deleting a person is the console's (audit-hold-lock spec)
+    "Deleting, locking and legal holds are done in the administration console, which records why and keeps what a hold covers.": "Verwijderen, vergrendelen en juridische bewaarplichten gebeuren in de beheerconsole, die de reden vastlegt en bewaart wat onder een bewaarplicht valt.",
+    "Open in the console": "Openen in de console",
+    // inbuxa AL-7, AL-8: a locked account handed to the reader
+    "You no longer have access to {name}. Back to your own mail.": "U hebt geen toegang meer tot {name}. Terug naar uw eigen mail.",
+    "You can't send from {name}. It was handed to you to read, not to send as.": "U kunt niet verzenden vanuit {name}. Het account is u gegeven om te lezen, niet om namens te verzenden.",
+    "This account was handed to you to read. Nothing in it can be changed.": "Dit account is u gegeven om te lezen. Er kan niets in worden gewijzigd.",
+    "You can file and move mail in this account, but not delete it.": "U kunt mail in dit account ordenen en verplaatsen, maar niet verwijderen.",
+    "Read only": "Alleen lezen",
+    "Read and organize": "Lezen en ordenen",
+    "Full access": "Volledige toegang",
+    "Locked account:": "Vergrendeld account:",
+    "You can send as this account": "U kunt namens dit account verzenden",
+    "Back to my mail": "Terug naar mijn mail",
+    "Send or close the message you're writing first.": "Verzend of sluit eerst het bericht dat u schrijft.",
+    "Mail to show": "Mail tonen van",
+    "My mail": "Mijn mail",
+    "Locked account": "Vergrendeld account",
   },
   plurals: {
     // ── Administration: legacy mail protocols (INBUXA) ──────────────

web/src/locales/permissions/nl.ts

@@ -1,71 +1,80 @@
 import type { PermissionCatalog } from "@/lib/permissionLabels";
 
-/** Stalwart 0.16.22's permission labels in Dutch, keyed by permission name. Checked against source.json. */
+/**
+ * Stalwart 0.16.22's permission labels in Dutch, keyed by permission name. Checked against source.json.
+ * Reviewed and corrected by Michael (mbjboon82, also mbjboon-netizen), a native speaker, in September 2026: https://git.coffeylabs.org/mbjboon82
+ */
+
+// Dutch speaker note: For example “Cluster Nodes Management” is a bit difficult to translate naturally into Dutch.
+// “Nodes” is plural, so the Dutch term should also be plural: “Clusterknooppunten”.
+// A literal translation such as “Clusterknooppuntbeheer” sounds awkward and also loses the natural plural form.
+// For a menu item, “Clusterknooppunten” is much more natural, or “Clusterknooppunten beheren” if the action needs to be explicit.
+
 export const permissionCatalog: PermissionCatalog = {
   categories: {
-    "AI models Management": "AI-modelbeheer",
-    "API keys Management": "API-sleutelbeheer",
-    "Accounts Management": "Accountbeheer",
+    "AI models Management": "AI-modellen beheren",
+    "API keys Management": "API-sleutels beheren",
+    "Accounts Management": "Accounts beheren",
     "Action": "Actie",
-    "Actions Management": "Actiebeheer",
-    "Addresses Management": "Adresbeheer",
-    "Alerts Management": "Waarschuwingsbeheer",
-    "App passwords Management": "App-wachtwoordbeheer",
-    "Applications Management": "Applicatiebeheer",
-    "Archived items Management": "Beheer van gearchiveerde items",
+    "Actions Management": "Acties beheren",
+    "Addresses Management": "Adressen beheren",
+    "Alerts Management": "Waarschuwingen beheren",
+    "App passwords Management": "App-wachtwoorden beheren",
+    "Applications Management": "Applicaties beheren",
+    "Archived items Management": "Gearchiveerde items beheren",
     "Calendar": "Agenda",
-    "Certificates Management": "Certificaatbeheer",
-    "Cluster nodes Management": "Clusterknooppuntbeheer",
-    "DNS servers Management": "DNS-serverbeheer",
-    "Directories Management": "Adreslijstbeheer",
-    "Domains Management": "Domeinbeheer",
+    "Certificates Management": "Certificaten beheren",
+    "Cluster nodes Management": "Clusterknooppunten beheren",
+    "DNS servers Management": "DNS-servers beheren",
+    "Directories Management": "Adreslijsten beheren",
+    "Domains Management": "Domeinen beheren",
     "Email": "E-mail",
-    "Events Management": "Gebeurtenisbeheer",
-    "Extensions Management": "Extensiebeheer",
-    "Hooks Management": "Hookbeheer",
+    "Events Management": "Gebeurtenissen beheren",
+    "Extensions Management": "Extensies beheren",
+    "Hooks Management": "Hooks beheren",
     "IMAP": "IMAP",
     "JMAP": "JMAP",
-    "Keys Management": "Sleutelbeheer",
-    "Listeners Management": "Listenerbeheer",
-    "Lists Management": "Lijstbeheer",
-    "Log entries Management": "Logboekbeheer",
-    "Lookups Management": "Lookupbeheer",
-    "Mailing lists Management": "Mailinglijstbeheer",
+    "Keys Management": "Sleutels beheren",
+    "Listeners Management": "Listeners beheren",
+    "Lists Management": "Lijsten beheren",
+    "Log entries Management": "Logboeken beheren",
+    "Lookups Management": "Lookups beheren",
+    "Mailing lists Management": "Mailinglijsten beheren",
     "ManageSieve": "ManageSieve",
-    "Masked emails Management": "Beheer van gemaskeerde e-mailadressen",
-    "Messages Management": "Berichtbeheer",
-    "Metrics Management": "Statistiekbeheer",
-    "Milters Management": "Milterbeheer",
-    "OAuth clients Management": "OAuth-clientbeheer",
+    "Masked emails Management": "Gemaskeerde e-mailadressen beheren",
+    "Messages Management": "Berichten beheren",
+    "Metrics Management": "Statistieken beheren",
+    "Milters Management": "Milters beheren",
+    "OAuth clients Management": "OAuth-clients beheren",
     "POP3": "POP3",
-    "Providers Management": "Providerbeheer",
-    "Public keys Management": "Beheer van openbare sleutels",
-    "Queues Management": "Wachtrijbeheer",
-    "Quotas Management": "Quotabeheer",
-    "Reports Management": "Rapportbeheer",
-    "Roles Management": "Rolbeheer",
-    "Routes Management": "Routebeheer",
-    "Rules Management": "Regelbeheer",
-    "Samples Management": "Voorbeeldbeheer",
-    "Schedules Management": "Schemabeheer",
-    "Scripts Management": "Scriptbeheer",
-    "Servers Management": "Serverbeheer",
+    "Providers Management": "Providers beheren",
+    "Public keys Management": "Openbare sleutels beheren",
+    "Queues Management": "Wachtrijen beheren",
+    "Quotas Management": "Quotas beheren",
+    "Reports Management": "Rapporten beheren",
+    "Roles Management": "Rollen beheren",
+    "Routes Management": "Routes beheren",
+    "Rules Management": "Filterregels beheren",
+    "Samples Management": "Voorbeelden beheren",
+    "Schedules Management": "Schema's beheren",
+    "Scripts Management": "Scripts beheren",
+    "Servers Management": "Servers beheren",
     "Settings": "Instellingen",
-    "Signatures Management": "Handtekeningbeheer",
-    "Strategies Management": "Strategiebeheer",
-    "Tags Management": "Tagbeheer",
+    "Signatures Management": "Handtekeningen beheren",
+    "Strategies Management": "Strategieën beheren",
+    "Tags Management": "Tags beheren",
     "Task": "Taak",
-    "Tasks Management": "Takenbeheer",
-    "Tenants Management": "Tenantbeheer",
-    "Throttles Management": "Beheer van snelheidsbeperkingen",
-    "Tracers Management": "Tracerbeheer",
-    "Traces Management": "Tracebeheer",
+    "Tasks Management": "Taken beheren",
+    "Tenants Management": "Tenants beheren",
+    "Throttles Management": "Snelheidsbeperkingen beheren",
+    "Tracers Management": "Tracers beheren",
+    "Traces Management": "Traces beheren",
     "WebDAV": "WebDAV",
-    "Webhooks Management": "Webhookbeheer",
+    "Webhooks Management": "Webhooks beheren",
   },
   labels: {
     authenticate: "Inloggen op de server",
-    authenticateWithAlias: "Inloggen met e-mailaliasadressen",
+    authenticateWithAlias: "Inloggen met e-mailalias-adressen",
     interactAi: "AI-modellen gebruiken",
     impersonate: "Namens een andere gebruiker handelen",
     unlimitedRequests: "Snelheidslimieten voor verzoeken omzeilen",
@@ -283,23 +292,23 @@ export const permissionCatalog: PermissionCatalog = {
     oAuthClientOverride: "Registratievereisten voor OAuth-clients omzeilen",
     liveTracing: "Realtime traces van servergebeurtenissen bekijken",
     liveMetrics: "Realtime prestatiestatistieken van de server bekijken",
-    liveDeliveryTest: "Test-e-mails verzenden om de bezorgconfiguratie te controleren",
+    liveDeliveryTest: "Test e-mails verzenden om de bezorgconfiguratie te controleren",
     scimAccess: "Gebruikers en groepen inrichten via het SCIM-eindpunt",
     sysAccountGet: "Accounts ophalen",
     sysAccountCreate: "Accounts aanmaken",
     sysAccountUpdate: "Accounts bijwerken",
     sysAccountDestroy: "Accounts verwijderen",
     sysAccountQuery: "Accounts opvragen",
-    sysAccountPasswordGet: "Wachtwoordinstellingen van accounts ophalen",
-    sysAccountPasswordUpdate: "Wachtwoordinstellingen van accounts bijwerken",
-    sysAccountSettingsGet: "Accountinstellingen ophalen",
-    sysAccountSettingsUpdate: "Accountinstellingen bijwerken",
+    sysAccountPasswordGet: "Wachtwoord instellingen van accounts ophalen",
+    sysAccountPasswordUpdate: "Wachtwoord instellingen van accounts bijwerken",
+    sysAccountSettingsGet: "Account instellingen ophalen",
+    sysAccountSettingsUpdate: "Account instellingen bijwerken",
     sysAcmeProviderGet: "Providers ophalen",
     sysAcmeProviderCreate: "Providers aanmaken",
     sysAcmeProviderUpdate: "Providers bijwerken",
     sysAcmeProviderDestroy: "Providers verwijderen",
     sysAcmeProviderQuery: "Providers opvragen",
-    actionReloadSettings: "Opnieuw laden: serverinstellingen",
+    actionReloadSettings: "Opnieuw laden: server instellingen",
     actionReloadTlsCertificates: "Opnieuw laden: TLS-certificaten",
     actionReloadLookupStores: "Opnieuw laden: lookup-opslag",
     actionReloadBlockedIps: "Opnieuw laden: lijst met geblokkeerde IP's",
@@ -315,8 +324,8 @@ export const permissionCatalog: PermissionCatalog = {
     sysActionUpdate: "Acties bijwerken",
     sysActionDestroy: "Acties verwijderen",
     sysActionQuery: "Acties opvragen",
-    sysAddressBookGet: "Adresboekinstellingen ophalen",
-    sysAddressBookUpdate: "Adresboekinstellingen bijwerken",
+    sysAddressBookGet: "Adresboek instellingen ophalen",
+    sysAddressBookUpdate: "Adresboek instellingen bijwerken",
     sysAiModelGet: "AI-modellen ophalen",
     sysAiModelCreate: "AI-modellen aanmaken",
     sysAiModelUpdate: "AI-modellen bijwerken",
@@ -357,23 +366,23 @@ export const permissionCatalog: PermissionCatalog = {
     sysArfExternalReportUpdate: "Rapporten bijwerken",
     sysArfExternalReportDestroy: "Rapporten verwijderen",
     sysArfExternalReportQuery: "Rapporten opvragen",
-    sysAsnGet: "ASN-instellingen ophalen",
-    sysAsnUpdate: "ASN-instellingen bijwerken",
-    sysAuthenticationGet: "Authenticatie-instellingen ophalen",
-    sysAuthenticationUpdate: "Authenticatie-instellingen bijwerken",
-    sysBlobStoreGet: "Blob-opslaginstellingen ophalen",
-    sysBlobStoreUpdate: "Blob-opslaginstellingen bijwerken",
+    sysAsnGet: "ASN instellingen ophalen",
+    sysAsnUpdate: "ASN instellingen bijwerken",
+    sysAuthenticationGet: "Authenticatie instellingen ophalen",
+    sysAuthenticationUpdate: "Authenticatie instellingen bijwerken",
+    sysBlobStoreGet: "Blob-opslag instellingen ophalen",
+    sysBlobStoreUpdate: "Blob-opslag instellingen bijwerken",
     sysBlockedIpGet: "Adressen ophalen",
     sysBlockedIpCreate: "Adressen aanmaken",
     sysBlockedIpUpdate: "Adressen bijwerken",
     sysBlockedIpDestroy: "Adressen verwijderen",
     sysBlockedIpQuery: "Adressen opvragen",
-    sysBootstrapGet: "Bootstrap-instellingen ophalen",
-    sysBootstrapUpdate: "Bootstrap-instellingen bijwerken",
-    sysCacheGet: "Cache-instellingen ophalen",
-    sysCacheUpdate: "Cache-instellingen bijwerken",
-    sysCalendarGet: "Agenda-instellingen ophalen",
-    sysCalendarUpdate: "Agenda-instellingen bijwerken",
+    sysBootstrapGet: "Bootstrap instellingen ophalen",
+    sysBootstrapUpdate: "Bootstrap instellingen bijwerken",
+    sysCacheGet: "Cache instellingen ophalen",
+    sysCacheUpdate: "Cache instellingen bijwerken",
+    sysCalendarGet: "Agenda instellingen ophalen",
+    sysCalendarUpdate: "Agenda instellingen bijwerken",
     sysCalendarAlarmGet: "Instellingen voor agendaherinneringen ophalen",
     sysCalendarAlarmUpdate: "Instellingen voor agendaherinneringen bijwerken",
     sysCalendarSchedulingGet: "Instellingen voor agendaplanning ophalen",
@@ -393,19 +402,19 @@ export const permissionCatalog: PermissionCatalog = {
     sysClusterRoleUpdate: "Rollen bijwerken",
     sysClusterRoleDestroy: "Rollen verwijderen",
     sysClusterRoleQuery: "Rollen opvragen",
-    sysCoordinatorGet: "Coördinatorinstellingen ophalen",
-    sysCoordinatorUpdate: "Coördinatorinstellingen bijwerken",
+    sysCoordinatorGet: "Coördinator instellingen ophalen",
+    sysCoordinatorUpdate: "Coördinator instellingen bijwerken",
     sysDataRetentionGet: "Instellingen voor gegevensbewaring ophalen",
     sysDataRetentionUpdate: "Instellingen voor gegevensbewaring bijwerken",
-    sysDataStoreGet: "Gegevensopslaginstellingen ophalen",
-    sysDataStoreUpdate: "Gegevensopslaginstellingen bijwerken",
+    sysDataStoreGet: "Gegevensopslag instellingen ophalen",
+    sysDataStoreUpdate: "Gegevensopslag instellingen bijwerken",
     sysDirectoryGet: "Adreslijsten ophalen",
     sysDirectoryCreate: "Adreslijsten aanmaken",
     sysDirectoryUpdate: "Adreslijsten bijwerken",
     sysDirectoryDestroy: "Adreslijsten verwijderen",
     sysDirectoryQuery: "Adreslijsten opvragen",
-    sysDkimReportSettingsGet: "DKIM-rapportinstellingen ophalen",
-    sysDkimReportSettingsUpdate: "DKIM-rapportinstellingen bijwerken",
+    sysDkimReportSettingsGet: "DKIM-rapport instellingen ophalen",
+    sysDkimReportSettingsUpdate: "DKIM-rapport instellingen bijwerken",
     sysDkimSignatureGet: "Handtekeningen ophalen",
     sysDkimSignatureCreate: "Handtekeningen aanmaken",
     sysDkimSignatureUpdate: "Handtekeningen bijwerken",
@@ -421,10 +430,10 @@ export const permissionCatalog: PermissionCatalog = {
     sysDmarcInternalReportUpdate: "Rapporten bijwerken",
     sysDmarcInternalReportDestroy: "Rapporten verwijderen",
     sysDmarcInternalReportQuery: "Rapporten opvragen",
-    sysDmarcReportSettingsGet: "DMARC-rapportinstellingen ophalen",
-    sysDmarcReportSettingsUpdate: "DMARC-rapportinstellingen bijwerken",
-    sysDnsResolverGet: "DNS-resolverinstellingen ophalen",
-    sysDnsResolverUpdate: "DNS-resolverinstellingen bijwerken",
+    sysDmarcReportSettingsGet: "DMARC-rapport instellingen ophalen",
+    sysDmarcReportSettingsUpdate: "DMARC-rapport instellingen bijwerken",
+    sysDnsResolverGet: "DNS-resolver instellingen ophalen",
+    sysDnsResolverUpdate: "DNS-resolver instellingen bijwerken",
     sysDnsServerGet: "DNS-servers ophalen",
     sysDnsServerCreate: "DNS-servers aanmaken",
     sysDnsServerUpdate: "DNS-servers bijwerken",
@@ -435,34 +444,34 @@ export const permissionCatalog: PermissionCatalog = {
     sysDomainUpdate: "Domeinen bijwerken",
     sysDomainDestroy: "Domeinen verwijderen",
     sysDomainQuery: "Domeinen opvragen",
-    sysDsnReportSettingsGet: "DSN-rapportinstellingen ophalen",
-    sysDsnReportSettingsUpdate: "DSN-rapportinstellingen bijwerken",
-    sysEmailGet: "E-mailinstellingen ophalen",
-    sysEmailUpdate: "E-mailinstellingen bijwerken",
-    sysEnterpriseGet: "Enterprise-instellingen ophalen",
-    sysEnterpriseUpdate: "Enterprise-instellingen bijwerken",
+    sysDsnReportSettingsGet: "DSN-rapport instellingen ophalen",
+    sysDsnReportSettingsUpdate: "DSN-rapport instellingen bijwerken",
+    sysEmailGet: "E-mail instellingen ophalen",
+    sysEmailUpdate: "E-mail instellingen bijwerken",
+    sysEnterpriseGet: "Enterprise instellingen ophalen",
+    sysEnterpriseUpdate: "Enterprise instellingen bijwerken",
     sysEventTracingLevelGet: "Gebeurtenissen ophalen",
     sysEventTracingLevelCreate: "Gebeurtenissen aanmaken",
     sysEventTracingLevelUpdate: "Gebeurtenissen bijwerken",
     sysEventTracingLevelDestroy: "Gebeurtenissen verwijderen",
     sysEventTracingLevelQuery: "Gebeurtenissen opvragen",
-    sysFileStorageGet: "Bestandsopslaginstellingen ophalen",
-    sysFileStorageUpdate: "Bestandsopslaginstellingen bijwerken",
-    sysHttpGet: "HTTP-instellingen ophalen",
-    sysHttpUpdate: "HTTP-instellingen bijwerken",
-    sysHttpFormGet: "HTTP-formulierinstellingen ophalen",
-    sysHttpFormUpdate: "HTTP-formulierinstellingen bijwerken",
+    sysFileStorageGet: "Bestandsopslag instellingen ophalen",
+    sysFileStorageUpdate: "Bestandsopslag instellingen bijwerken",
+    sysHttpGet: "HTTP instellingen ophalen",
+    sysHttpUpdate: "HTTP instellingen bijwerken",
+    sysHttpFormGet: "HTTP-formulier instellingen ophalen",
+    sysHttpFormUpdate: "HTTP-formulier instellingen bijwerken",
     sysHttpLookupGet: "Lijsten ophalen",
     sysHttpLookupCreate: "Lijsten aanmaken",
     sysHttpLookupUpdate: "Lijsten bijwerken",
     sysHttpLookupDestroy: "Lijsten verwijderen",
     sysHttpLookupQuery: "Lijsten opvragen",
-    sysImapGet: "IMAP-instellingen ophalen",
-    sysImapUpdate: "IMAP-instellingen bijwerken",
+    sysImapGet: "IMAP instellingen ophalen",
+    sysImapUpdate: "IMAP instellingen bijwerken",
     sysInMemoryStoreGet: "Instellingen voor in-memory-opslag ophalen",
     sysInMemoryStoreUpdate: "Instellingen voor in-memory-opslag bijwerken",
-    sysJmapGet: "JMAP-instellingen ophalen",
-    sysJmapUpdate: "JMAP-instellingen bijwerken",
+    sysJmapGet: "JMAP instellingen ophalen",
+    sysJmapUpdate: "JMAP instellingen bijwerken",
     sysLogGet: "Logboekvermeldingen ophalen",
     sysLogCreate: "Logboekvermeldingen aanmaken",
     sysLogUpdate: "Logboekvermeldingen bijwerken",
@@ -493,8 +502,8 @@ export const permissionCatalog: PermissionCatalog = {
     sysMetricUpdate: "Statistieken bijwerken",
     sysMetricDestroy: "Statistieken verwijderen",
     sysMetricQuery: "Statistieken opvragen",
-    sysMetricsGet: "Statistiekinstellingen ophalen",
-    sysMetricsUpdate: "Statistiekinstellingen bijwerken",
+    sysMetricsGet: "Statistiek instellingen ophalen",
+    sysMetricsUpdate: "Statistiek instellingen bijwerken",
     sysMetricsStoreGet: "Instellingen voor statistiekopslag ophalen",
     sysMetricsStoreUpdate: "Instellingen voor statistiekopslag bijwerken",
     sysMtaConnectionStrategyGet: "Strategieën ophalen",
@@ -507,8 +516,8 @@ export const permissionCatalog: PermissionCatalog = {
     sysMtaDeliveryScheduleUpdate: "Schema's bijwerken",
     sysMtaDeliveryScheduleDestroy: "Schema's verwijderen",
     sysMtaDeliveryScheduleQuery: "Schema's opvragen",
-    sysMtaExtensionsGet: "MTA-extensie-instellingen ophalen",
-    sysMtaExtensionsUpdate: "MTA-extensie-instellingen bijwerken",
+    sysMtaExtensionsGet: "MTA-extensie instellingen ophalen",
+    sysMtaExtensionsUpdate: "MTA-extensie instellingen bijwerken",
     sysMtaHookGet: "Hooks ophalen",
     sysMtaHookCreate: "Hooks aanmaken",
     sysMtaHookUpdate: "Hooks bijwerken",
@@ -555,8 +564,8 @@ export const permissionCatalog: PermissionCatalog = {
     sysMtaStageMailUpdate: "Instellingen voor MTA-fase MAIL bijwerken",
     sysMtaStageRcptGet: "Instellingen voor MTA-fase RCPT ophalen",
     sysMtaStageRcptUpdate: "Instellingen voor MTA-fase RCPT bijwerken",
-    sysMtaStsGet: "MTA-STS-instellingen ophalen",
-    sysMtaStsUpdate: "MTA-STS-instellingen bijwerken",
+    sysMtaStsGet: "MTA-STS instellingen ophalen",
+    sysMtaStsUpdate: "MTA-STS instellingen bijwerken",
     sysMtaTlsStrategyGet: "Strategieën ophalen",
     sysMtaTlsStrategyCreate: "Strategieën aanmaken",
     sysMtaTlsStrategyUpdate: "Strategieën bijwerken",
@@ -577,8 +586,8 @@ export const permissionCatalog: PermissionCatalog = {
     sysOAuthClientUpdate: "OAuth-clients bijwerken",
     sysOAuthClientDestroy: "OAuth-clients verwijderen",
     sysOAuthClientQuery: "OAuth-clients opvragen",
-    sysOidcProviderGet: "OIDC-providerinstellingen ophalen",
-    sysOidcProviderUpdate: "OIDC-providerinstellingen bijwerken",
+    sysOidcProviderGet: "OIDC-provider instellingen ophalen",
+    sysOidcProviderUpdate: "OIDC-provider instellingen bijwerken",
     sysPublicKeyGet: "Openbare sleutels ophalen",
     sysPublicKeyCreate: "Openbare sleutels aanmaken",
     sysPublicKeyUpdate: "Openbare sleutels bijwerken",
@@ -589,19 +598,19 @@ export const permissionCatalog: PermissionCatalog = {
     sysQueuedMessageUpdate: "Berichten bijwerken",
     sysQueuedMessageDestroy: "Berichten verwijderen",
     sysQueuedMessageQuery: "Berichten opvragen",
-    sysReportSettingsGet: "Rapportinstellingen ophalen",
-    sysReportSettingsUpdate: "Rapportinstellingen bijwerken",
+    sysReportSettingsGet: "Rapport instellingen ophalen",
+    sysReportSettingsUpdate: "Rapport instellingen bijwerken",
     sysRoleGet: "Rollen ophalen",
     sysRoleCreate: "Rollen aanmaken",
     sysRoleUpdate: "Rollen bijwerken",
     sysRoleDestroy: "Rollen verwijderen",
     sysRoleQuery: "Rollen opvragen",
-    sysSearchGet: "Zoekinstellingen ophalen",
-    sysSearchUpdate: "Zoekinstellingen bijwerken",
+    sysSearchGet: "Zoek instellingen ophalen",
+    sysSearchUpdate: "Zoek instellingen bijwerken",
     sysSearchStoreGet: "Instellingen voor zoekopslag ophalen",
     sysSearchStoreUpdate: "Instellingen voor zoekopslag bijwerken",
-    sysSecurityGet: "Beveiligingsinstellingen ophalen",
-    sysSecurityUpdate: "Beveiligingsinstellingen bijwerken",
+    sysSecurityGet: "Beveiliging instellingen ophalen",
+    sysSecurityUpdate: "Beveiliging instellingen bijwerken",
     sysSenderAuthGet: "Instellingen voor afzenderauthenticatie ophalen",
     sysSenderAuthUpdate: "Instellingen voor afzenderauthenticatie bijwerken",
     sysSharingGet: "Instellingen voor delen ophalen",
@@ -634,17 +643,17 @@ export const permissionCatalog: PermissionCatalog = {
     sysSpamFileExtensionUpdate: "Extensies bijwerken",
     sysSpamFileExtensionDestroy: "Extensies verwijderen",
     sysSpamFileExtensionQuery: "Extensies opvragen",
-    sysSpamLlmGet: "Spam-LLM-instellingen ophalen",
-    sysSpamLlmUpdate: "Spam-LLM-instellingen bijwerken",
-    sysSpamPyzorGet: "Spam-Pyzor-instellingen ophalen",
-    sysSpamPyzorUpdate: "Spam-Pyzor-instellingen bijwerken",
+    sysSpamLlmGet: "Spam-LLM instellingen ophalen",
+    sysSpamLlmUpdate: "Spam-LLM instellingen bijwerken",
+    sysSpamPyzorGet: "Spam-Pyzor instellingen ophalen",
+    sysSpamPyzorUpdate: "Spam-Pyzor instellingen bijwerken",
     sysSpamRuleGet: "Regels ophalen",
     sysSpamRuleCreate: "Regels aanmaken",
     sysSpamRuleUpdate: "Regels bijwerken",
     sysSpamRuleDestroy: "Regels verwijderen",
     sysSpamRuleQuery: "Regels opvragen",
-    sysSpamSettingsGet: "Spaminstellingen ophalen",
-    sysSpamSettingsUpdate: "Spaminstellingen bijwerken",
+    sysSpamSettingsGet: "Spam instellingen ophalen",
+    sysSpamSettingsUpdate: "Spam instellingen bijwerken",
     sysSpamTagGet: "Tags ophalen",
     sysSpamTagCreate: "Tags aanmaken",
     sysSpamTagUpdate: "Tags bijwerken",
@@ -655,15 +664,15 @@ export const permissionCatalog: PermissionCatalog = {
     sysSpamTrainingSampleUpdate: "Voorbeelden bijwerken",
     sysSpamTrainingSampleDestroy: "Voorbeelden verwijderen",
     sysSpamTrainingSampleQuery: "Voorbeelden opvragen",
-    sysSpfReportSettingsGet: "SPF-rapportinstellingen ophalen",
-    sysSpfReportSettingsUpdate: "SPF-rapportinstellingen bijwerken",
+    sysSpfReportSettingsGet: "SPF-rapport instellingen ophalen",
+    sysSpfReportSettingsUpdate: "SPF-rapport instellingen bijwerken",
     sysStoreLookupGet: "Lookups ophalen",
     sysStoreLookupCreate: "Lookups aanmaken",
     sysStoreLookupUpdate: "Lookups bijwerken",
     sysStoreLookupDestroy: "Lookups verwijderen",
     sysStoreLookupQuery: "Lookups opvragen",
-    sysSystemSettingsGet: "Systeeminstellingen ophalen",
-    sysSystemSettingsUpdate: "Systeeminstellingen bijwerken",
+    sysSystemSettingsGet: "Systeem instellingen ophalen",
+    sysSystemSettingsUpdate: "Systeem instellingen bijwerken",
     taskIndexDocument: "Document indexeren",
     taskUnindexDocument: "Document uit de index verwijderen",
     taskIndexTrace: "Telemetrietrace indexeren",
@@ -704,8 +713,8 @@ export const permissionCatalog: PermissionCatalog = {
     sysTlsInternalReportUpdate: "Rapporten bijwerken",
     sysTlsInternalReportDestroy: "Rapporten verwijderen",
     sysTlsInternalReportQuery: "Rapporten opvragen",
-    sysTlsReportSettingsGet: "TLS-rapportinstellingen ophalen",
-    sysTlsReportSettingsUpdate: "TLS-rapportinstellingen bijwerken",
+    sysTlsReportSettingsGet: "TLS-rapport instellingen ophalen",
+    sysTlsReportSettingsUpdate: "TLS-rapport instellingen bijwerken",
     sysTraceGet: "Traces ophalen",
     sysTraceCreate: "Traces aanmaken",
     sysTraceUpdate: "Traces bijwerken",
@@ -718,8 +727,8 @@ export const permissionCatalog: PermissionCatalog = {
     sysTracerQuery: "Tracers opvragen",
     sysTracingStoreGet: "Instellingen voor tracing-opslag ophalen",
     sysTracingStoreUpdate: "Instellingen voor tracing-opslag bijwerken",
-    sysWebDavGet: "WebDAV-instellingen ophalen",
-    sysWebDavUpdate: "WebDAV-instellingen bijwerken",
+    sysWebDavGet: "WebDAV instellingen ophalen",
+    sysWebDavUpdate: "WebDAV instellingen bijwerken",
     sysWebHookGet: "Webhooks ophalen",
     sysWebHookCreate: "Webhooks aanmaken",
     sysWebHookUpdate: "Webhooks bijwerken",

web/src/locales/pt-BR.ts

@@ -1382,6 +1382,8 @@ export const catalog: Catalog = {
     "Collapse all": "Recolher tudo",
     "Expand all": "Expandir tudo",
     "Send now instead": "Enviar agora mesmo",
+    "This message is rich text": "Esta mensagem está em texto formatado",
+    "This message is plain text": "Esta mensagem está em texto simples",
     "Switch to plain text": "Mudar para texto simples",
     "Switch to rich text": "Mudar para texto formatado",
     "{used} of {total} used": "{used} de {total} usados",
@@ -1728,6 +1730,28 @@ export const catalog: Catalog = {
     // ── Spam filter: the language model's opinion (inbuxa) ──────────
     "Language model's opinion": "Opinião do modelo de linguagem",
     "One of several signals the spam filter weighed": "Um dos vários sinais considerados pelo filtro de spam",
+    // inbuxa: legacy mail protocols, one switch per protocol
+    "Your organization has turned off {protocols} for mail apps. Mail apps that use it can't connect to this account; others still can.": "Sua organização desativou {protocols} para aplicativos de e-mail. Os que usam isso não conseguem se conectar a esta conta; os outros ainda conseguem.",
+    "Some legacy mail protocols are off for your organization: {protocols}.": "Alguns protocolos de e-mail legados estão desativados para sua organização: {protocols}.",
+    "Some are off for {tenant}: {protocols}. Switch them one at a time in the administration console.": "Alguns estão desativados para {tenant}: {protocols}. Ative ou desative um de cada vez no console de administração.",
+    // inbuxa: deleting a person is the console's (audit-hold-lock spec)
+    "Deleting, locking and legal holds are done in the administration console, which records why and keeps what a hold covers.": "Excluir, bloquear e retenções legais são feitos no console de administração, que registra o motivo e preserva o que uma retenção abrange.",
+    "Open in the console": "Abrir no console",
+    // inbuxa AL-7, AL-8: a locked account handed to the reader
+    "You no longer have access to {name}. Back to your own mail.": "Você não tem mais acesso a {name}. De volta ao seu próprio e-mail.",
+    "You can't send from {name}. It was handed to you to read, not to send as.": "Você não pode enviar de {name}. A conta foi entregue a você para leitura, não para enviar em nome dela.",
+    "This account was handed to you to read. Nothing in it can be changed.": "Esta conta foi entregue a você para leitura. Nada nela pode ser alterado.",
+    "You can file and move mail in this account, but not delete it.": "Você pode arquivar e mover e-mails nesta conta, mas não excluí-los.",
+    "Read only": "Somente leitura",
+    "Read and organize": "Ler e organizar",
+    "Full access": "Acesso total",
+    "Locked account:": "Conta bloqueada:",
+    "You can send as this account": "Você pode enviar como esta conta",
+    "Back to my mail": "Voltar ao meu e-mail",
+    "Send or close the message you're writing first.": "Envie ou feche primeiro a mensagem que está escrevendo.",
+    "Mail to show": "E-mail a exibir",
+    "My mail": "Meu e-mail",
+    "Locked account": "Conta bloqueada",
   },
   plurals: {
     // ── Administration: legacy mail protocols (INBUXA) ──────────────

web/src/locales/ru.ts

@@ -1381,6 +1381,8 @@ export const catalog: Catalog = {
     "Collapse all": "Свернуть все",
     "Expand all": "Развернуть все",
     "Send now instead": "Отправить сейчас",
+    "This message is rich text": "Это письмо в формате HTML",
+    "This message is plain text": "Это письмо в виде простого текста",
     "Switch to plain text": "Переключиться на обычный текст",
     "Switch to rich text": "Переключиться на форматированный текст",
     "{used} of {total} used": "Использовано {used} из {total}",
@@ -1727,6 +1729,28 @@ export const catalog: Catalog = {
     // ── Spam filter: the language model's opinion (inbuxa) ──────────
     "Language model's opinion": "Мнение языковой модели",
     "One of several signals the spam filter weighed": "Один из нескольких признаков, которые учёл спам-фильтр",
+    // inbuxa: legacy mail protocols, one switch per protocol
+    "Your organization has turned off {protocols} for mail apps. Mail apps that use it can't connect to this account; others still can.": "Ваша организация отключила {protocols} для почтовых приложений. Приложения, которые его используют, не могут подключиться к этому аккаунту; остальные могут.",
+    "Some legacy mail protocols are off for your organization: {protocols}.": "Некоторые устаревшие почтовые протоколы отключены для вашей организации: {protocols}.",
+    "Some are off for {tenant}: {protocols}. Switch them one at a time in the administration console.": "Для {tenant} отключены некоторые: {protocols}. Включайте и отключайте их по одному в консоли администрирования.",
+    // inbuxa: deleting a person is the console's (audit-hold-lock spec)
+    "Deleting, locking and legal holds are done in the administration console, which records why and keeps what a hold covers.": "Удаление, блокировка и юридическое удержание выполняются в консоли администрирования: она записывает причину и сохраняет всё, что охватывает удержание.",
+    "Open in the console": "Открыть в консоли",
+    // inbuxa AL-7, AL-8: a locked account handed to the reader
+    "You no longer have access to {name}. Back to your own mail.": "У вас больше нет доступа к {name}. Возвращаемся к вашей почте.",
+    "You can't send from {name}. It was handed to you to read, not to send as.": "Вы не можете отправлять письма от имени {name}. Учётная запись передана вам для чтения, а не для отправки.",
+    "This account was handed to you to read. Nothing in it can be changed.": "Эта учётная запись передана вам для чтения. Изменить в ней ничего нельзя.",
+    "You can file and move mail in this account, but not delete it.": "В этой учётной записи вы можете раскладывать и перемещать письма, но не удалять их.",
+    "Read only": "Только чтение",
+    "Read and organize": "Чтение и упорядочивание",
+    "Full access": "Полный доступ",
+    "Locked account:": "Заблокированная учётная запись:",
+    "You can send as this account": "Вы можете отправлять от имени этой учётной записи",
+    "Back to my mail": "Вернуться к моей почте",
+    "Send or close the message you're writing first.": "Сначала отправьте или закройте письмо, которое пишете.",
+    "Mail to show": "Какую почту показать",
+    "My mail": "Моя почта",
+    "Locked account": "Заблокированная учётная запись",
   },
   plurals: {
     // ── Administration: legacy mail protocols (INBUXA) ──────────────

web/src/locales/uk.ts

@@ -1375,6 +1375,8 @@ export const catalog: Catalog = {
     "Collapse all": "Згорнути все",
     "Expand all": "Розгорнути все",
     "Send now instead": "Надіслати зараз",
+    "This message is rich text": "Цей лист у форматі HTML",
+    "This message is plain text": "Цей лист у вигляді простого тексту",
     "Switch to plain text": "Перейти на звичайний текст",
     "Switch to rich text": "Перейти на форматований текст",
     "{used} of {total} used": "Використано {used} з {total}",
@@ -1721,6 +1723,28 @@ export const catalog: Catalog = {
     // ── Spam filter: the language model's opinion (inbuxa) ──────────
     "Language model's opinion": "Думка мовної моделі",
     "One of several signals the spam filter weighed": "Одна з кількох ознак, які врахував спам-фільтр",
+    // inbuxa: legacy mail protocols, one switch per protocol
+    "Your organization has turned off {protocols} for mail apps. Mail apps that use it can't connect to this account; others still can.": "Ваша організація вимкнула {protocols} для поштових програм. Програми, які його використовують, не можуть підключитися до цього облікового запису; інші можуть.",
+    "Some legacy mail protocols are off for your organization: {protocols}.": "Деякі застарілі поштові протоколи вимкнено для вашої організації: {protocols}.",
+    "Some are off for {tenant}: {protocols}. Switch them one at a time in the administration console.": "Для {tenant} вимкнено деякі: {protocols}. Вмикайте й вимикайте їх по одному в консолі адміністрування.",
+    // inbuxa: deleting a person is the console's (audit-hold-lock spec)
+    "Deleting, locking and legal holds are done in the administration console, which records why and keeps what a hold covers.": "Видалення, блокування та юридичне утримання виконуються в консолі адміністрування: вона записує причину й зберігає все, що охоплює утримання.",
+    "Open in the console": "Відкрити в консолі",
+    // inbuxa AL-7, AL-8: a locked account handed to the reader
+    "You no longer have access to {name}. Back to your own mail.": "У вас більше немає доступу до {name}. Повертаємося до вашої пошти.",
+    "You can't send from {name}. It was handed to you to read, not to send as.": "Ви не можете надсилати листи від імені {name}. Обліковий запис передано вам для читання, а не для надсилання.",
+    "This account was handed to you to read. Nothing in it can be changed.": "Цей обліковий запис передано вам для читання. Змінити в ньому нічого не можна.",
+    "You can file and move mail in this account, but not delete it.": "У цьому обліковому записі ви можете впорядковувати й переміщувати листи, але не видаляти їх.",
+    "Read only": "Лише читання",
+    "Read and organize": "Читання й упорядкування",
+    "Full access": "Повний доступ",
+    "Locked account:": "Заблокований обліковий запис:",
+    "You can send as this account": "Ви можете надсилати від імені цього облікового запису",
+    "Back to my mail": "Повернутися до моєї пошти",
+    "Send or close the message you're writing first.": "Спочатку надішліть або закрийте лист, який пишете.",
+    "Mail to show": "Яку пошту показати",
+    "My mail": "Моя пошта",
+    "Locked account": "Заблокований обліковий запис",
   },
   plurals: {
     // ── Administration: legacy mail protocols (INBUXA) ──────────────

web/src/locales/zh-Hans.ts

@@ -1386,6 +1386,8 @@ export const catalog: Catalog = {
     "Collapse all": "全部折叠",
     "Expand all": "全部展开",
     "Send now instead": "改为立即发送",
+    "This message is rich text": "这封邮件是富文本",
+    "This message is plain text": "这封邮件是纯文本",
     "Switch to plain text": "切换为纯文本",
     "Switch to rich text": "切换为富文本",
     "{used} of {total} used": "已使用 {used}，共 {total}",
@@ -1732,6 +1734,28 @@ export const catalog: Catalog = {
     // ── Spam filter: the language model's opinion (inbuxa) ──────────
     "Language model's opinion": "语言模型的判断",
     "One of several signals the spam filter weighed": "垃圾邮件过滤考虑的多个信号之一",
+    // inbuxa: legacy mail protocols, one switch per protocol
+    "Your organization has turned off {protocols} for mail apps. Mail apps that use it can't connect to this account; others still can.": "您的组织已为邮件应用关闭 {protocols}。使用它的邮件应用无法连接到此账户；其他应用仍可连接。",
+    "Some legacy mail protocols are off for your organization: {protocols}.": "您的组织已关闭部分传统邮件协议：{protocols}。",
+    "Some are off for {tenant}: {protocols}. Switch them one at a time in the administration console.": "{tenant} 已关闭部分协议：{protocols}。请在管理控制台中逐个开启或关闭。",
+    // inbuxa: deleting a person is the console's (audit-hold-lock spec)
+    "Deleting, locking and legal holds are done in the administration console, which records why and keeps what a hold covers.": "删除、锁定和法律保留均在管理控制台中进行，控制台会记录原因，并保留保留范围内的内容。",
+    "Open in the console": "在控制台中打开",
+    // inbuxa AL-7, AL-8: a locked account handed to the reader
+    "You no longer have access to {name}. Back to your own mail.": "您已无法访问 {name}。已返回您自己的邮件。",
+    "You can't send from {name}. It was handed to you to read, not to send as.": "您不能从 {name} 发送邮件。该账户交给您是为了阅读，而不是代其发送。",
+    "This account was handed to you to read. Nothing in it can be changed.": "该账户交给您用于阅读，其中的任何内容都不能更改。",
+    "You can file and move mail in this account, but not delete it.": "您可以在此账户中整理和移动邮件，但不能删除。",
+    "Read only": "只读",
+    "Read and organize": "阅读并整理",
+    "Full access": "完全访问",
+    "Locked account:": "已锁定的账户：",
+    "You can send as this account": "您可以以此账户的身份发送",
+    "Back to my mail": "返回我的邮件",
+    "Send or close the message you're writing first.": "请先发送或关闭您正在撰写的邮件。",
+    "Mail to show": "要显示的邮件",
+    "My mail": "我的邮件",
+    "Locked account": "已锁定的账户",
   },
   plurals: {
     // ── Administration: legacy mail protocols (INBUXA) ──────────────

web/src/store/__tests__/compose-dlp.test.ts

@@ -0,0 +1,39 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Coffey Labs
+ *
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+// inbuxa: DLP on send: the override travels with the submission, and the
+// server's refusals are told apart from other errors.
+import { describe, expect, it } from "vitest";
+import { buildSubmission, dlpRefusalOf } from "../compose";
+
+const base = {
+  identityId: "i1",
+  fromEmail: "[email protected]",
+  emailRef: "#m",
+  rcpts: [{ email: "[email protected]" }],
+  sentId: "sent",
+  draftsId: "drafts",
+  scheduledId: null,
+  sendAt: null,
+};
+
+describe("DLP on send", () => {
+  it("sends the override reason only when there is one", () => {
+    expect(buildSubmission(base).create["inbuxa:dlpOverride"]).toBeUndefined();
+    expect(buildSubmission({ ...base, dlpOverride: "  " }).create["inbuxa:dlpOverride"]).toBeUndefined();
+    expect(buildSubmission({ ...base, dlpOverride: " Client asked " }).create["inbuxa:dlpOverride"]).toEqual({ reason: "Client asked" });
+  });
+
+  it("recognizes the server's refusals", () => {
+    expect(dlpRefusalOf({ type: "inbuxa:dlpWarning", rules: [{ name: "Cards", notice: "Looks like a card." }] })).toEqual({
+      kind: "warning",
+      rules: [{ name: "Cards", notice: "Looks like a card." }],
+    });
+    expect(dlpRefusalOf({ type: "inbuxa:dlpBlocked" })).toEqual({ kind: "blocked", rules: [] });
+    expect(dlpRefusalOf({ type: "forbiddenToSend" })).toBeNull();
+    expect(dlpRefusalOf(undefined)).toBeNull();
+  });
+});

web/src/store/__tests__/compose-email.test.ts

@@ -18,7 +18,7 @@ function draft(over: Partial<Draft> = {}): Draft {
     requestReceipt: false, priority: "normal",
     showCc: false, showBcc: false, showReplyTo: false,
     minimized: false, maximized: false, dirty: false, savedAt: null,
-    saving: false, sending: false, error: null, signatureHtml: "", replyMode: null, sendAt: null,
+    saving: false, sending: false, error: null, signatureHtml: "", replyMode: null, quoteHtml: "", quoteText: "", formatOffer: null, sendAt: null,
     ...over,
   };
 }

web/src/store/__tests__/delegated-accounts.test.ts

@@ -0,0 +1,147 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { CAP, client } from "@/jmap/client";
+import type { JmapSession } from "@/jmap/types";
+import { useSession } from "@/store/session";
+import { useMail } from "@/store/mail";
+import { composeBlocked, useCompose } from "@/store/compose";
+import { delegatedAccounts, delegationOf, mayDestroy, mayWrite } from "@/lib/delegation";
+
+/**
+ * inbuxa AL-7: a locked account handed to the reader shows in place of their
+ * own mail, and only mail follows it; the reader never loses their own
+ * account, and a delegation taken away takes them back.
+ */
+
+const delegated = (access: string, sendAs = false) => ({
+  name: "[email protected]",
+  isPersonal: false,
+  isReadOnly: access === "read",
+  accountCapabilities: {
+    [CAP.mail]: {},
+    [CAP.calendars]: {},
+    [CAP.contacts]: {},
+    [CAP.filenode]: {},
+    "urn:inbuxa:jmap": { delegation: { locked: true, access, sendAs, until: null } },
+  },
+});
+
+const sessionWith = (locked: Record<string, unknown> | null) =>
+  ({
+    capabilities: { [CAP.core]: { maxCallsInRequest: 16, maxObjectsInGet: 500 }, [CAP.mail]: {} },
+    accounts: {
+      own: {
+        name: "[email protected]",
+        isPersonal: true,
+        accountCapabilities: { [CAP.mail]: {}, [CAP.calendars]: {}, [CAP.contacts]: {}, [CAP.filenode]: {} },
+      },
+      shared: { name: "[email protected]", isPersonal: false, accountCapabilities: { [CAP.mail]: {} } },
+      ...(locked ? { locked } : {}),
+    },
+    primaryAccounts: { [CAP.mail]: "own", [CAP.calendars]: "own", [CAP.contacts]: "own", [CAP.filenode]: "own" },
+    state: "s",
+  }) as unknown as JmapSession;
+
+let nextSession: JmapSession;
+
+beforeEach(() => {
+  nextSession = sessionWith(delegated("read"));
+  vi.stubGlobal(
+    "fetch",
+    vi.fn(async (url: string, init?: RequestInit) => {
+      if (String(url).includes("/api/auth/session")) {
+        return { ok: true, status: 200, json: async () => nextSession } as Response;
+      }
+      const { methodCalls } = JSON.parse((init?.body as string) ?? "{}") as { methodCalls: [string, Record<string, unknown>, string][] };
+      const methodResponses = methodCalls.map(([name, args, id]) => [name, { accountId: args.accountId, state: "1", list: [], notFound: [] }, id]);
+      return { ok: true, status: 200, json: async () => ({ methodResponses, sessionState: "s" }) } as Response;
+    }),
+  );
+  const session = sessionWith(delegated("read"));
+  client.session = session;
+  useSession.setState({ status: "authenticated", session, accountId: "own", viewing: null, delegationEnded: null });
+  useCompose.setState({ drafts: [] });
+});
+
+afterEach(() => {
+  useSession.setState({ viewing: null });
+  vi.unstubAllGlobals();
+});
+
+describe("delegation", () => {
+  it("is read only from the session's mark, never from a shared account's capabilities", () => {
+    const session = sessionWith(delegated("organize", true));
+    expect(delegationOf(session, "locked")).toEqual({ locked: true, access: "organize", sendAs: true, until: null });
+    expect(delegationOf(session, "shared")).toBeNull();
+    expect(delegationOf(session, "own")).toBeNull();
+    expect(delegatedAccounts(session).map((a) => a.id)).toEqual(["locked"]);
+  });
+
+  it("never lets a read delegate send, whatever the server says", () => {
+    const session = sessionWith(delegated("read", true));
+    expect(delegationOf(session, "locked")?.sendAs).toBe(false);
+  });
+
+  it("says what each level may do", () => {
+    const read = delegationOf(sessionWith(delegated("read")), "locked");
+    const organize = delegationOf(sessionWith(delegated("organize")), "locked");
+    expect(mayWrite(read)).toBe(false);
+    expect(mayWrite(organize)).toBe(true);
+    expect(mayDestroy(organize)).toBe(false);
+    expect(mayWrite(null) && mayDestroy(null)).toBe(true);
+  });
+});
+
+describe("viewing a locked account", () => {
+  it("moves only the mail store; the session's own account stays", () => {
+    useSession.getState().view("locked");
+    expect(useMail.getState().accountId).toBe("locked");
+    expect(useSession.getState().accountId).toBe("own");
+    expect(useSession.getState().ownAccountFor(CAP.mail)).toBe("own");
+    useSession.getState().view(null);
+    expect(useMail.getState().accountId).toBe("own");
+  });
+
+  it("brings the whole account: calendar, contacts and files, never the reader's settings", () => {
+    const s = () => useSession.getState();
+    expect(s().viewAccountFor(CAP.calendars)).toBe("own");
+    s().view("locked");
+    for (const cap of [CAP.calendars, CAP.contacts, CAP.filenode]) {
+      expect(s().viewAccountFor(cap)).toBe("locked");
+    }
+    // Settings live in the reader's own Files, whatever is in view
+    expect(s().ownAccountFor(CAP.filenode)).toBe("own");
+    s().view(null);
+    expect(s().viewAccountFor(CAP.contacts)).toBe("own");
+  });
+
+  it("refuses an account that isn't delegated", () => {
+    useSession.getState().view("shared");
+    expect(useSession.getState().viewing).toBeNull();
+    expect(useMail.getState().accountId).toBe("own");
+  });
+
+  it("goes back to the reader's own mail when the delegation ends", async () => {
+    useSession.getState().view("locked");
+    nextSession = sessionWith(null);
+    await useSession.getState().refresh();
+    expect(useSession.getState().viewing).toBeNull();
+    expect(useSession.getState().delegationEnded).toBe("[email protected]");
+    expect(useMail.getState().accountId).toBe("own");
+  });
+
+  it("blocks writing mail where the delegate can't send", () => {
+    expect(composeBlocked()).toBeNull();
+    useSession.getState().view("locked");
+    expect(composeBlocked()).toMatch(/[email protected]/);
+    expect(useCompose.getState().open()).toBe("");
+    expect(useCompose.getState().drafts).toHaveLength(0);
+  });
+
+  it("lets a send-as delegate write", () => {
+    const session = sessionWith(delegated("full", true));
+    client.session = session;
+    useSession.setState({ session });
+    useSession.getState().view("locked");
+    expect(composeBlocked()).toBeNull();
+  });
+});

web/src/store/__tests__/quote-image-policy.test.ts

@@ -0,0 +1,98 @@
+import { beforeEach, describe, expect, it } from "vitest";
+import { buildEmailObject, useCompose } from "@/store/compose";
+import { useMail } from "@/store/mail";
+import { useContacts } from "@/store/contacts";
+import { DEFAULT_SETTINGS, useSettings } from "@/store/settings";
+import type { Email, EmailAddress, Identity } from "@/jmap/types";
+
+/*
+ * Remote images in a quoted message (#410).
+ *
+ * Quoting renders the message a second time. The reply was fetching every
+ * remote image in it, whatever the reader had decided — so replying to a
+ * message whose images had been left blocked told the tracker the mail was
+ * read and the address live. The composer is a window like any other.
+ */
+
+const PIXEL = "https://tracker.example/open.gif?id=42";
+
+const MESSAGE = {
+  id: "m1", messageId: ["<[email protected]>"], subject: "Sale", references: [], inReplyTo: [], keywords: {},
+  attachments: [], receivedAt: "2026-09-04T10:00:00Z", mailboxIds: {},
+  from: [{ name: "Shop", email: "[email protected]" }], to: [{ name: "John", email: "[email protected]" }], cc: [],
+  htmlBody: [{ partId: "2", type: "text/html" }],
+  textBody: [{ partId: "1", type: "text/plain" }],
+  bodyValues: {
+    "1": { value: "Sale on now", isEncodingProblem: false, isTruncated: false },
+    "2": { value: `<p>Sale on now</p><img src="${PIXEL}" width="1" height="1">`, isEncodingProblem: false, isTruncated: false },
+  },
+} as unknown as Email;
+
+const IDENTITIES = [{ id: "i1", name: "John", email: "[email protected]", replyTo: null }] as unknown as Identity[];
+
+/**
+ * Whether the draft will actually load the image. Allowed images go through
+ * the server's proxy where the deployment has one (#412), so the address is
+ * escaped inside an `/api/image` URL rather than sitting in `src` as it is.
+ */
+const fetched = (html: string) => html.includes(`/api/image?url=${encodeURIComponent(PIXEL)}`) || html.includes(`src="${PIXEL}"`);
+
+function replyDraft() {
+  useMail.setState({
+    accountId: "a1",
+    identities: IDENTITIES as never,
+    getEmails: (async () => [MESSAGE]) as never,
+    defaultIdentity: (() => IDENTITIES[0]) as never,
+    loadIdentities: (async () => IDENTITIES) as never,
+    roleId: (() => null) as never,
+  });
+  return useCompose.getState().reply(MESSAGE, "reply").then((key) => useCompose.getState().drafts.find((d) => d.key === key)!);
+}
+
+beforeEach(() => {
+  useCompose.setState({ drafts: [], activeKey: null, pendingSends: {} });
+  useMail.setState({ imagesShown: {} });
+  useContacts.setState({ loaded: false } as never);
+  useSettings.setState({ settings: { ...DEFAULT_SETTINGS, imagePolicy: "ask", composeFormat: "html" } });
+});
+
+describe("quoting a message whose images were not allowed", () => {
+  it("does not put a fetchable address in the draft", async () => {
+    const d = await replyDraft();
+    expect(d.html).not.toContain(PIXEL.split("?")[0]! + '"');
+    expect(d.html).toContain("data-ihm-blocked");
+    // The src is what the browser would fetch; nothing else in the draft is.
+    expect(/<img[^>]+src="https:/.test(d.html)).toBe(false);
+  });
+
+  it("keeps the address, so the sent copy is the quote as it was written", async () => {
+    const d = await replyDraft();
+    expect(d.html).toContain(PIXEL);
+    const email = await buildEmailObject({ ...d, to: [{ name: null, email: "[email protected]" }] as EmailAddress[] }, { forSend: true });
+    const sent = JSON.stringify(email);
+    expect(sent).toContain(PIXEL);
+    expect(sent).not.toContain("data-ihm-blocked");
+  });
+
+  it("fetches them once the reader has shown images on that message", async () => {
+    useMail.setState({ imagesShown: { m1: true } });
+    const d = await replyDraft();
+    expect(fetched(d.html)).toBe(true);
+    expect(d.html).not.toContain("data-ihm-blocked");
+  });
+
+  it("fetches them when the policy is to show images always", async () => {
+    useSettings.setState((s) => ({ settings: { ...s.settings, imagePolicy: "always" } }));
+    expect(fetched((await replyDraft()).html)).toBe(true);
+  });
+
+  it("fetches them from a sender the reader trusts", async () => {
+    useSettings.setState((s) => ({ settings: { ...s.settings, trustedImageSenders: ["[email protected]"] } }));
+    expect(fetched((await replyDraft()).html)).toBe(true);
+  });
+
+  it("leaves them blocked for a stranger when the policy is contacts only", async () => {
+    useSettings.setState((s) => ({ settings: { ...s.settings, imagePolicy: "contacts" } }));
+    expect((await replyDraft()).html).toContain("data-ihm-blocked");
+  });
+});

web/src/store/__tests__/quote-image-proxy.test.ts

@@ -0,0 +1,99 @@
+import { beforeEach, describe, expect, it } from "vitest";
+import { buildEmailObject, useCompose } from "@/store/compose";
+import { useMail } from "@/store/mail";
+import { useContacts } from "@/store/contacts";
+import { useSession } from "@/store/session";
+import { DEFAULT_SETTINGS, useSettings } from "@/store/settings";
+import { unproxyImages } from "@/lib/mail/remoteImages";
+import type { Email, EmailAddress, Identity } from "@/jmap/types";
+
+/*
+ * Remote images in a quote go through this server, and come back out pointing
+ * at their own addresses (#412).
+ *
+ * Reading a message proxies its images so the sender learns nothing about the
+ * reader. Quoting fetched them directly, which handed the same pixel the
+ * reader's IP and user agent. Proxying the quote is only half of it: those
+ * URLs belong to this deployment, so the copy that is sent has to carry the
+ * originals or the recipient gets images only this server can serve.
+ */
+
+const IMAGE = "https://cdn.example/banner.png?id=7";
+
+const MESSAGE = {
+  id: "m1", messageId: ["<[email protected]>"], subject: "Sale", references: [], inReplyTo: [], keywords: {},
+  attachments: [], receivedAt: "2026-09-04T10:00:00Z", mailboxIds: {},
+  from: [{ name: "Shop", email: "[email protected]" }], to: [{ name: "John", email: "[email protected]" }], cc: [],
+  htmlBody: [{ partId: "2", type: "text/html" }],
+  textBody: [{ partId: "1", type: "text/plain" }],
+  bodyValues: {
+    "1": { value: "Sale on now", isEncodingProblem: false, isTruncated: false },
+    "2": { value: `<p>Sale</p><img src="${IMAGE}">`, isEncodingProblem: false, isTruncated: false },
+  },
+} as unknown as Email;
+
+const IDENTITIES = [{ id: "i1", name: "John", email: "[email protected]", replyTo: null }] as unknown as Identity[];
+
+function draftFor(mode: "reply" | "forward") {
+  useMail.setState({
+    accountId: "a1",
+    identities: IDENTITIES as never,
+    getEmails: (async () => [MESSAGE]) as never,
+    defaultIdentity: (() => IDENTITIES[0]) as never,
+    loadIdentities: (async () => IDENTITIES) as never,
+    roleId: (() => null) as never,
+  });
+  return useCompose.getState().reply(MESSAGE, mode).then((key) => useCompose.getState().drafts.find((d) => d.key === key)!);
+}
+
+const proxy = (on: boolean) => useSession.setState({ session: { ihasmail: { imageProxy: on } } } as never);
+
+beforeEach(() => {
+  useCompose.setState({ drafts: [], activeKey: null, pendingSends: {} });
+  useMail.setState({ imagesShown: {} });
+  useContacts.setState({ loaded: false } as never);
+  // Images allowed, so the question is only how they are fetched.
+  useSettings.setState({ settings: { ...DEFAULT_SETTINGS, imagePolicy: "always", composeFormat: "html" } });
+  proxy(true);
+});
+
+describe("images in a quote, while the reply is being written", () => {
+  it("are fetched through this server, as reading the message does", async () => {
+    const d = await draftFor("reply");
+    expect(d.html).toContain("/api/image?url=");
+    expect(d.html).not.toContain(`src="${IMAGE}"`);
+  });
+
+  it("are fetched directly where the deployment has no proxy", async () => {
+    proxy(false);
+    const d = await draftFor("reply");
+    expect(d.html).toContain(`src="${IMAGE}"`);
+    expect(d.html).not.toContain("/api/image?url=");
+  });
+
+  it("go through it on a forward too", async () => {
+    expect((await draftFor("forward")).html).toContain("/api/image?url=");
+  });
+});
+
+describe("the copy that is sent", () => {
+  it("points at the image's own address, not at this server", async () => {
+    const d = await draftFor("reply");
+    const sent = JSON.stringify(await buildEmailObject({ ...d, to: [{ name: null, email: "[email protected]" }] as EmailAddress[] }, { forSend: true }));
+    expect(sent).toContain(IMAGE.replace(/&/g, "&"));
+    expect(sent).not.toContain("/api/image?url=");
+  });
+
+  it("restores a signature or template image that used the proxy as well", () => {
+    const logo = "https://cdn.example/logo.png";
+    const html = `<p>Regards</p><img src="/api/image?url=${encodeURIComponent(logo)}"><img src="cid:x@1">`;
+    const out = unproxyImages(html);
+    expect(out).toContain(`src="${logo}"`);
+    expect(out).toContain('src="cid:x@1"');
+  });
+
+  it("leaves everything else alone", () => {
+    const html = '<img src="cid:logo@1"><img src="blob:http://localhost/abc"><a href="/api/image?url=x">link</a>';
+    expect(unproxyImages(html)).toBe(html);
+  });
+});

web/src/store/__tests__/reply-addressing.test.ts

@@ -153,6 +153,30 @@ describe("a message of mine with nobody obvious to reply to", () => {
     const d = await draftFor({ ...MINE, to: [ME], cc: [] } as Email, "reply");
     expect(addrs(d.to)).toEqual([ME.email]);
   });
+
+  it("answers the Reply-To rather than my own desk when nobody else is on it", async () => {
+    /*
+     * A contact form: the site mails itself, From and To both its own address,
+     * and the person who filled the form in is in Reply-To. From alone makes
+     * this look like mine, and the fallback used to reply to me (#415).
+     */
+    const form = { ...MINE, to: [ME], cc: [], replyTo: [{ name: "Michael", email: "[email protected]" }] } as Email;
+    const d = await draftFor(form, "reply");
+    expect(addrs(d.to)).toEqual(["[email protected]"]);
+  });
+
+  it("does the same on a reply all, without cc-ing myself", async () => {
+    const form = { ...MINE, to: [ME], cc: [], replyTo: [{ name: "Michael", email: "[email protected]" }] } as Email;
+    const d = await draftFor(form, "replyAll");
+    expect(addrs(d.to)).toEqual(["[email protected]"]);
+    expect(d.cc).toEqual([]);
+  });
+
+  it("still prefers somebody I actually wrote to over my own Reply-To", async () => {
+    // The Cc is a person; the Reply-To is where answers to me belong.
+    const d = await draftFor({ ...MINE, to: [ME], replyTo: [{ name: null, email: "[email protected]" }] } as Email, "reply");
+    expect(addrs(d.to)).toEqual([BOB.email]);
+  });
 });
 
 describe("forwarding", () => {

web/src/store/__tests__/reply-format-offer.test.ts

@@ -0,0 +1,124 @@
+import { beforeEach, describe, expect, it } from "vitest";
+import { useCompose } from "@/store/compose";
+import { useMail } from "@/store/mail";
+import { DEFAULT_SETTINGS, useSettings } from "@/store/settings";
+import type { Email, Identity } from "@/jmap/types";
+
+/*
+ * Offering to answer a message in the format it was written in (#407).
+ *
+ * The trap is `htmlBody`: RFC 8621 derives it, so a plain-text message has one
+ * too, holding its text/plain part. Reading that as "there is HTML" would
+ * offer a switch to rich text on every plain-text message, and never offer the
+ * switch to plain text where it is actually wanted.
+ */
+
+const base = {
+  messageId: ["<[email protected]>"], subject: "Numbers", references: [], inReplyTo: [],
+  keywords: {}, attachments: [], receivedAt: "2026-09-04T10:00:00Z", mailboxIds: {},
+  from: [{ name: "Ann", email: "[email protected]" }], to: [{ name: "John", email: "[email protected]" }], cc: [],
+};
+
+/** A real multipart/alternative: two parts, one of them text/html. */
+const RICH = {
+  ...base, id: "m1",
+  htmlBody: [{ partId: "2", type: "text/html" }],
+  textBody: [{ partId: "1", type: "text/plain" }],
+  bodyValues: { "1": { value: "hi", isEncodingProblem: false, isTruncated: false }, "2": { value: "<p>hi</p>", isEncodingProblem: false, isTruncated: false } },
+} as unknown as Email;
+
+/** Plain text, as Stalwart returns it: both lists name the same text/plain part. */
+const PLAIN = {
+  ...base, id: "m2",
+  htmlBody: [{ partId: "1", type: "text/plain" }],
+  textBody: [{ partId: "1", type: "text/plain" }],
+  bodyValues: { "1": { value: "hi", isEncodingProblem: false, isTruncated: false } },
+} as unknown as Email;
+
+const IDENTITIES = [{ id: "i1", name: "John", email: "[email protected]", replyTo: null }] as unknown as Identity[];
+
+function draftFor(email: Email, mode: "reply" | "replyAll" | "forward") {
+  useMail.setState({
+    accountId: "a1",
+    identities: IDENTITIES as never,
+    getEmails: (async () => [email]) as never,
+    defaultIdentity: (() => IDENTITIES[0]) as never,
+    loadIdentities: (async () => IDENTITIES) as never,
+    roleId: (() => null) as never,
+  });
+  return useCompose.getState().reply(email, mode).then((key) => useCompose.getState().drafts.find((d) => d.key === key)!);
+}
+
+const composeIn = (format: "html" | "text") => useSettings.setState({ settings: { ...DEFAULT_SETTINGS, composeFormat: format } });
+
+beforeEach(() => {
+  useCompose.setState({ drafts: [], activeKey: null });
+  useSettings.setState({ settings: { ...DEFAULT_SETTINGS } });
+});
+
+describe("answering a message written in the other format", () => {
+  it("offers rich text when a plain-text reply answers a rich message", async () => {
+    composeIn("text");
+    const d = await draftFor(RICH, "reply");
+    expect(d.format).toBe("text");
+    expect(d.formatOffer).toBe("html");
+  });
+
+  it("offers plain text when a rich reply answers a plain-text message", async () => {
+    composeIn("html");
+    const d = await draftFor(PLAIN, "reply");
+    expect(d.format).toBe("html");
+    expect(d.formatOffer).toBe("text");
+  });
+
+  it("offers nothing when the formats already agree", async () => {
+    composeIn("html");
+    expect((await draftFor(RICH, "reply")).formatOffer).toBeNull();
+    composeIn("text");
+    expect((await draftFor(PLAIN, "reply")).formatOffer).toBeNull();
+  });
+
+  it("reads the part's own type, not the derived htmlBody list", async () => {
+    // PLAIN has an htmlBody; it names the text/plain part. Offering a switch
+    // to rich text here would fire on every plain-text message there is.
+    composeIn("text");
+    expect((await draftFor(PLAIN, "reply")).formatOffer).toBeNull();
+  });
+
+  it("offers on a reply all and on a forward, where the same formatting is lost", async () => {
+    composeIn("text");
+    expect((await draftFor(RICH, "replyAll")).formatOffer).toBe("html");
+    expect((await draftFor(RICH, "forward")).formatOffer).toBe("html");
+  });
+
+  it("carries both bodies either way, so switching has something to switch to", async () => {
+    composeIn("text");
+    const d = await draftFor(RICH, "reply");
+    expect(d.text).toContain("hi");
+    expect(d.html).toContain("hi");
+  });
+
+  it("keeps the quoted message in both formats, so a switch can restore it", async () => {
+    composeIn("text");
+    const d = await draftFor(RICH, "reply");
+    // The HTML quote is the original's markup, not the text one converted.
+    expect(d.quoteHtml).toContain("<p>hi</p>");
+    expect(d.quoteHtml).toContain("ihm-quote");
+    expect(d.quoteText).toContain("Ann");
+    expect(d.text.endsWith(d.quoteText)).toBe(true);
+  });
+
+  it("quotes nothing on a message started from scratch", () => {
+    composeIn("text");
+    const key = useCompose.getState().open();
+    const d = useCompose.getState().drafts.find((x) => x.key === key)!;
+    expect(d.quoteHtml).toBe("");
+    expect(d.quoteText).toBe("");
+  });
+
+  it("makes no offer on a message started from scratch", () => {
+    composeIn("text");
+    const key = useCompose.getState().open();
+    expect(useCompose.getState().drafts.find((x) => x.key === key)!.formatOffer).toBeNull();
+  });
+});

web/src/store/calendar.ts

@@ -404,7 +404,8 @@ export const useCalendar = create<CalendarState>((set, get) => ({
 
   async init() {
     // The reader's own: a shared calendar is shown beside theirs, not instead.
-    const accountId = useSession.getState().ownAccountFor(CAP.calendars);
+    // inbuxa AL-7: or the locked account in view, the whole of it
+    const accountId = useSession.getState().viewAccountFor(CAP.calendars);
     const available = Boolean(accountId && client.hasCapability(CAP.calendars));
     if (accountId !== get().accountId) set({ accountId, calendars: {}, events: {}, ranges: {} });
     set({ available });
@@ -431,7 +432,7 @@ export const useCalendar = create<CalendarState>((set, get) => ({
    */
   async loadSharedCalendars() {
     const session = useSession.getState();
-    const own = session.ownAccountFor(CAP.calendars);
+    const own = session.viewAccountFor(CAP.calendars);
     const accounts = Object.entries(session.session?.accounts ?? {}).filter(([id, a]) => a.isPersonal === false && id !== own);
     // Every account at once, in one request, and listed in the session's order.
     const answers = await Promise.all(

web/src/store/compose.ts

@@ -4,7 +4,8 @@ import type { Email, EmailAddress, EmailBodyPart, Id, Identity, SetResponse } fr
 import { formatFullDate, uid } from "@/lib/format";
 import { formatAddress, parseMailto, sameAddress, uniqueAddresses } from "@/lib/address";
 import { escapeHtml, htmlToText, quoteText, replySubject, textToHtml } from "@/lib/text/text";
-import { sanitizeEmailHtml, sanitizeEditorHtml } from "@/lib/text/html";
+import { hasHtmlAlternative, sanitizeEmailHtml, sanitizeEditorHtml } from "@/lib/text/html";
+import { remoteImagesAllowed, restoreBlockedImages, unproxyImages } from "@/lib/mail/remoteImages";
 import { toast } from "@/ui/toast";
 import { useMail, FULL_PROPS, BODY_PROPS } from "./mail";
 import { useSession } from "./session";
@@ -13,9 +14,11 @@ import { formatScheduleTime, holdUntil } from "@/lib/schedule";
 import { t as translate } from "@/lib/i18n";
 import { BASE_PATH } from "@/lib/basePath";
 import { settings } from "./settings";
+import { useContacts } from "./contacts";
 import { emlFilename } from "@/lib/text/emlName";
 import { fillPlaceholders, type PlaceholderContext } from "@/lib/templatePlaceholders";
 import { shareBody, type SharedContent } from "@/lib/shareTarget";
+import { delegationOf } from "@/lib/delegation";
 
 export interface ComposeAttachment {
   id: string;
@@ -75,9 +78,54 @@ export interface Draft {
   /** Original identity signature HTML currently embedded, to replace on identity switch. */
   signatureHtml: string;
   replyMode: "reply" | "replyAll" | "forward" | null;
+  /**
+   * The quoted message as it was prepared in each format, kept so that
+   * switching format re-attaches the original rather than a conversion of
+   * whatever the other format flattened it into. Empty on a draft that quotes
+   * nothing.
+   */
+  quoteHtml: string;
+  quoteText: string;
+  /**
+   * The format the message being answered was written in, when it is not the
+   * one this draft opened in (#407). The composer offers the switch; answering
+   * it either way, or dismissing it, clears this.
+   */
+  formatOffer: "html" | "text" | null;
   mailboxIdOnSend?: Id | null;
   /** When set, hand the message to the server held until this instant. */
   sendAt: number | null;
+  /**
+   * The server's DLP rules refused the last send (inbuxa): a warning the
+   * sender may answer with a reason, or a block. The composer shows it.
+   */
+  dlp?: DlpRefusalInfo | null;
+  /** The reason to send despite a DLP warning, for the next send only. */
+  dlpOverride?: string | null;
+}
+
+export interface DlpRefusalInfo {
+  kind: "warning" | "blocked";
+  rules: { name: string; notice: string }[];
+}
+
+/**
+ * A send the server's DLP rules refused (inbuxa: `inbuxa:dlpWarning`,
+ * `inbuxa:dlpBlocked`): which rules, and what they say.
+ */
+export class DlpRefusal extends Error {
+  constructor(public info: DlpRefusalInfo) {
+    super(info.rules.map((r) => r.notice).join(" ") || translate("This message wasn't sent under the server's rules"));
+  }
+}
+
+/** The DLP refusal in a submission's set error, if it is one. */
+export function dlpRefusalOf(err: { type?: string; rules?: { name?: string; notice?: string }[] } | undefined): DlpRefusalInfo | null {
+  if (!err || (err.type !== "inbuxa:dlpWarning" && err.type !== "inbuxa:dlpBlocked")) return null;
+  return {
+    kind: err.type === "inbuxa:dlpWarning" ? "warning" : "blocked",
+    rules: (err.rules ?? []).map((r) => ({ name: r.name ?? "", notice: r.notice ?? "" })),
+  };
 }
 
 interface ComposeState {
@@ -145,11 +193,39 @@ function blankDraft(init: Partial<Draft> = {}): Draft {
     error: null,
     signatureHtml: "",
     replyMode: null,
+    quoteHtml: "",
+    quoteText: "",
+    formatOffer: null,
     sendAt: null,
     ...init,
   };
 }
 
+/**
+ * Whether this message's remote images may be fetched into a composer.
+ *
+ * The same question the reader answered, asked with the same inputs: the
+ * policy, the trusted senders, whether the sender is a contact, and whether
+ * the reader pressed "Show images" on this message.
+ */
+/** Whether this deployment fetches remote images through its own server. */
+function imageProxyOn(): boolean {
+  return useSession.getState().session?.ihasmail?.imageProxy ?? true;
+}
+
+function remoteImagesForMessage(email: Email): boolean {
+  const s = settings();
+  const from = email.from?.[0]?.email;
+  const contacts = useContacts.getState();
+  return remoteImagesAllowed({
+    from,
+    policy: s.imagePolicy,
+    trusted: s.trustedImageSenders,
+    inContacts: Boolean(from && contacts.loaded && contacts.lookupByEmail(from)),
+    shown: Boolean(useMail.getState().imagesShown[email.id]),
+  });
+}
+
 export function signatureBlock(identity: Identity | undefined, format: "html" | "text"): string {
   if (!identity) return "";
   if (format === "text") return identity.textSignature ? `\n\n-- \n${identity.textSignature}` : "";
@@ -170,12 +246,33 @@ function defaultIdentity(identities: Identity[], email?: Email | null): Identity
   return useMail.getState().defaultIdentity() ?? identities[0];
 }
 
+/**
+ * Why nothing can be written from the account in view, if it can't: a locked
+ * account handed to the reader without the right to send as it (inbuxa
+ * AL-8). Nothing is then saved to its Drafts either.
+ */
+export function composeBlocked(): string | null {
+  const s = useSession.getState();
+  if (!s.viewing) return null;
+  const delegation = delegationOf(s.session, s.viewing);
+  if (!delegation || delegation.sendAs) return null;
+  const name = s.session?.accounts[s.viewing]?.name ?? "";
+  return translate("You can't send from {name}. It was handed to you to read, not to send as.", { name });
+}
+
+function refuseCompose(): boolean {
+  const why = composeBlocked();
+  if (why) toast.show(why);
+  return why !== null;
+}
+
 export const useCompose = create<ComposeState>((set, get) => ({
   drafts: [],
   activeKey: null,
   pendingSends: {},
 
   open(init = {}) {
+    if (refuseCompose()) return "";
     const identities = useMail.getState().identities;
     const ident = init.identityId ? identities.find((i) => i.id === init.identityId) : useMail.getState().defaultIdentity();
     const d = blankDraft({ identityId: ident?.id ?? null, replyTo: ident?.replyTo ?? [], showReplyTo: Boolean(ident?.replyTo?.length), ...init });
@@ -201,6 +298,7 @@ export const useCompose = create<ComposeState>((set, get) => ({
    * signature from every message that started as a share.
    */
   openFromShare(share) {
+    if (refuseCompose()) return "";
     const body = shareBody(share);
     const key = get().open({ subject: share.title.trim() });
     if (body) {
@@ -212,6 +310,7 @@ export const useCompose = create<ComposeState>((set, get) => ({
   },
 
   async openDraftEmail(email) {
+    if (refuseCompose()) return "";
     const existing = get().drafts.find((d) => d.draftId === email.id);
     if (existing) {
       get().focus(existing.key);
@@ -243,7 +342,7 @@ export const useCompose = create<ComposeState>((set, get) => ({
       showCc: Boolean(full.cc?.length),
       showBcc: Boolean(full.bcc?.length),
       subject: full.subject ?? "",
-      html: html ? sanitizeEmailHtml(html, { cidMap, allowRemote: true, dropStyleBlocks: true }).html : textToHtml(text).replace(/\n/g, "<br>"),
+      html: html ? sanitizeEmailHtml(html, { cidMap, allowRemote: remoteImagesForMessage(full), proxyRemote: imageProxyOn(), dropStyleBlocks: true }).html : textToHtml(text).replace(/\n/g, "<br>"),
       text: text || (html ? htmlToText(html) : ""),
       format: html ? "html" : settings().composeFormat,
       attachments,
@@ -273,6 +372,7 @@ export const useCompose = create<ComposeState>((set, get) => ({
    * both are new without anything here asking for it.
    */
   async composeAsNew(email) {
+    if (refuseCompose()) return "";
     const mail = useMail.getState();
     const full = (await mail.getEmails([email.id], true))[0] ?? email;
     const identities = mail.identities.length ? mail.identities : await mail.loadIdentities();
@@ -309,7 +409,7 @@ export const useCompose = create<ComposeState>((set, get) => ({
       showCc: Boolean(full.cc?.length),
       showBcc: Boolean(full.bcc?.length),
       subject: full.subject ?? "",
-      html: html ? sanitizeEmailHtml(html, { cidMap, allowRemote: true, dropStyleBlocks: true }).html : textToHtml(text).replace(/\n/g, "<br>"),
+      html: html ? sanitizeEmailHtml(html, { cidMap, allowRemote: remoteImagesForMessage(full), proxyRemote: imageProxyOn(), dropStyleBlocks: true }).html : textToHtml(text).replace(/\n/g, "<br>"),
       text: text || (html ? htmlToText(html) : ""),
       format: html ? "html" : settings().composeFormat,
       attachments,
@@ -324,6 +424,7 @@ export const useCompose = create<ComposeState>((set, get) => ({
   },
 
   async reply(email, mode) {
+    if (refuseCompose()) return "";
     const mail = useMail.getState();
     const full = (await mail.getEmails([email.id], true))[0] ?? email;
     const identities = mail.identities.length ? mail.identities : await mail.loadIdentities();
@@ -366,6 +467,19 @@ export const useCompose = create<ComposeState>((set, get) => ({
         // Addressed only to myself, or only in Cc: there is still somebody this
         // is a reply to, and an empty To is not it.
         if (!to.length) { to = cc.length ? cc : withoutOwn(full.cc ?? []); cc = []; }
+        /*
+         * Nobody but me on the message, and a Reply-To pointing somewhere that
+         * is not mine: that address is who this is really from.
+         *
+         * A contact form is the shape of it -- From and To are both the site's
+         * own mailbox, and the person who filled the form in is in Reply-To.
+         * The address test above calls that mine, correctly as far as it goes,
+         * and the fallback then addressed the reply to my own desk (#415).
+         *
+         * After the Cc, not before it: a message I really did send carries my
+         * own Reply-To, and somebody I actually wrote to beats it.
+         */
+        if (!to.length) to = withoutOwn(full.replyTo ?? []);
         if (!to.length) to = uniqueAddresses([...(full.to ?? []), ...(full.cc ?? [])]);
       } else {
         to = uniqueAddresses(full.replyTo?.length ? full.replyTo : (full.from ?? []));
@@ -379,6 +493,13 @@ export const useCompose = create<ComposeState>((set, get) => ({
     const textPart = full.textBody?.[0];
     const origHtml = htmlPart?.partId ? (full.bodyValues?.[htmlPart.partId]?.value ?? "") : "";
     const origText = textPart?.partId ? (full.bodyValues?.[textPart.partId]?.value ?? "") : "";
+    /*
+     * What the message being answered was really written in. `htmlBody` is
+     * derived, so its presence proves nothing -- hasHtmlAlternative() reads the
+     * part's own type. Getting this wrong would offer every plain-text message
+     * a switch to rich text it does not need.
+     */
+    const origFormat = hasHtmlAlternative(htmlPart, origHtml) ? "html" : "text";
     const accountId = mail.accountId!;
     const attachments: ComposeAttachment[] = [];
     const cidMap: Record<string, string> = {};
@@ -389,9 +510,21 @@ export const useCompose = create<ComposeState>((set, get) => ({
         attachments.push({ id: uid("a"), name: a.name ?? "attachment", type: a.type, size: a.size, blobId: a.blobId, progress: 100, error: null, cid: a.cid ?? undefined, inline });
       }
     }
+    /*
+     * Quoting renders the message a second time, so the reader's decision
+     * about its remote images applies here too: a quote that fetched what
+     * they declined would report the message read to whoever was counting
+     * (#410). Blocked images keep their address and get it back on the way
+     * out, so the recipient's copy is the quote as its sender wrote it.
+     */
+    const allowRemote = remoteImagesForMessage(full);
+    // Fetched through this server while the reply is written, as reading the
+    // message does, and pointed back at their own addresses on the way out
+    // (#412).
+    const proxyRemote = imageProxyOn();
     // Inline images are shown via their blob URLs in the editor and converted back to cid: at send time.
     const quotedHtmlBody = origHtml
-      ? sanitizeEmailHtml(origHtml, { cidMap, allowRemote: true, proxyRemote: false, dropStyleBlocks: true }).html
+      ? sanitizeEmailHtml(origHtml, { cidMap, allowRemote, proxyRemote, dropStyleBlocks: true }).html
       : textToHtml(origText).replace(/\n/g, "<br>");
     const fromStr = escapeHtml((full.from ?? []).map(formatAddress).join(", "));
     const date = formatFullDate(full.receivedAt);
@@ -434,12 +567,16 @@ export const useCompose = create<ComposeState>((set, get) => ({
       relatedKeyword: mode === "forward" ? "$forwarded" : "$answered",
       signatureHtml: sigHtml,
       replyMode: mode,
+      quoteHtml,
+      quoteText: quoteTxt,
+      formatOffer: origFormat === s.composeFormat ? null : origFormat,
     });
     set((st) => ({ drafts: [...st.drafts, d], activeKey: d.key }));
     return d.key;
   },
 
   forwardAsAttachment(email) {
+    if (refuseCompose()) return "";
     const accountId = useMail.getState().accountId;
     const key = get().open({
       subject: replySubject(email.subject, "Fwd"),
@@ -617,9 +754,21 @@ export const useCompose = create<ComposeState>((set, get) => ({
         return { pendingSends: rest };
       });
       try {
-        await sendInternal(d, get);
-        toast.success(scheduling ? translate("Send scheduled for {when}", { when: formatScheduleTime(new Date(d.sendAt!)) }) : translate("Message sent"));
+        const sent = await sendInternal(d, get);
+        toast.success(
+          sent.held
+            ? translate("Held for review: it's sent once a reviewer releases it")
+            : scheduling
+              ? translate("Send scheduled for {when}", { when: formatScheduleTime(new Date(d.sendAt!)) })
+              : translate("Message sent"),
+        );
       } catch (err) {
+        // inbuxa: DLP refused it: the draft comes back with the rules' notices
+        if (err instanceof DlpRefusal) {
+          set((s) => ({ drafts: [...s.drafts, { ...d, sending: false, error: null, dlp: err.info, dlpOverride: null }], activeKey: d.key }));
+          toast.error(err.info.kind === "warning" ? translate("Not sent yet: check the warning") : translate("Not sent: blocked by the server's rules"));
+          return;
+        }
         toast.error(translate("Send failed: {error}", { error: (err as Error).message }), {
           action: { label: translate("Open draft"), onClick: () => set((s) => ({ drafts: [...s.drafts, { ...d, sending: false, error: (err as Error).message }], activeKey: d.key })) },
           duration: 15000,
@@ -754,7 +903,9 @@ export async function buildEmailObject(d: Draft, opts: { forSend: boolean; mailb
   if (!ident) throw new Error(translate("No sending identity available"));
   const from: EmailAddress = { name: ident.name || null, email: ident.email };
 
-  let html = d.format === "html" ? d.html : "";
+  // Images blocked when the message was quoted keep their address; the copy
+  // that leaves carries it, and the recipient's client decides for itself.
+  let html = d.format === "html" ? unproxyImages(restoreBlockedImages(d.html)) : "";
   const text = d.format === "html" ? htmlToText(d.html) : d.text;
 
   // Inline attachments shown via blob URLs in the editor → back to cid: references.
@@ -912,6 +1063,8 @@ export function buildSubmission(opts: {
   draftsId: Id | null;
   scheduledId: Id | null;
   sendAt: number | null;
+  /** inbuxa: the sender's reason to send despite a DLP warning. */
+  dlpOverride?: string | null;
 }): { create: Record<string, unknown>; onSuccessUpdateEmail: Record<string, unknown> } {
   const scheduled = opts.sendAt !== null;
   const mailFrom: Record<string, unknown> = { email: opts.fromEmail };
@@ -921,13 +1074,17 @@ export function buildSubmission(opts: {
   if (filedIn) onSuccess[`mailboxIds/${filedIn}`] = true;
   if (opts.draftsId && opts.draftsId !== filedIn) onSuccess[`mailboxIds/${opts.draftsId}`] = null;
   if (scheduled && opts.sentId && opts.sentId !== filedIn) onSuccess[`mailboxIds/${opts.sentId}`] = null;
-  return {
-    create: { identityId: opts.identityId, emailId: opts.emailRef, envelope: { mailFrom, rcptTo: opts.rcpts } },
-    onSuccessUpdateEmail: onSuccess,
-  };
+  const create: Record<string, unknown> = { identityId: opts.identityId, emailId: opts.emailRef, envelope: { mailFrom, rcptTo: opts.rcpts } };
+  if (opts.dlpOverride?.trim()) create["inbuxa:dlpOverride"] = { reason: opts.dlpOverride.trim() };
+  return { create, onSuccessUpdateEmail: onSuccess };
 }
 
-async function sendInternal(d: Draft, _get: () => ComposeState): Promise<void> {
+/** What the server said of a send: whether DLP held it for review (inbuxa). */
+interface Sent {
+  held: boolean;
+}
+
+async function sendInternal(d: Draft, _get: () => ComposeState): Promise<Sent> {
   const mail = useMail.getState();
   const accountId = mail.accountId!;
   const ident = mail.identities.find((i) => i.id === d.identityId) ?? mail.identities[0];
@@ -949,6 +1106,7 @@ async function sendInternal(d: Draft, _get: () => ComposeState): Promise<void> {
     draftsId,
     scheduledId,
     sendAt: scheduled ? d.sendAt : null,
+    dlpOverride: d.dlpOverride ?? null,
   });
   const calls: Array<[string, Record<string, unknown>, string]> = [
     ["Email/set", { accountId, create: { m: email }, ...(d.draftId ? { destroy: [d.draftId] } : {}) }, "e"],
@@ -972,6 +1130,8 @@ async function sendInternal(d: Draft, _get: () => ComposeState): Promise<void> {
     // Clean up the created (unsent) email so it doesn't linger in Sent.
     const created = e.created?.m?.id;
     if (created) void client.call("Email/set", { accountId, destroy: [created] });
+    const dlp = dlpRefusalOf(err as { type?: string; rules?: { name?: string; notice?: string }[] });
+    if (dlp) throw new DlpRefusal(dlp);
     throw new Error(setErrorMessage(err));
   }
   if (d.relatedEmailId && d.relatedKeyword) {
@@ -993,6 +1153,7 @@ async function sendInternal(d: Draft, _get: () => ComposeState): Promise<void> {
   }
   void mail.loadMailboxes();
   void mail.refreshList();
+  return { held: (s.created?.s as { "inbuxa:held"?: boolean } | undefined)?.["inbuxa:held"] === true };
 }
 
 export { FULL_PROPS, BODY_PROPS };

web/src/store/contacts.ts

@@ -270,7 +270,8 @@ export const useContacts = create<ContactsState>((set, get) => ({
     // The reader's own, not whichever account is selected: a shared address
     // book is shown beside theirs rather than instead of it, so nothing here
     // should move when the switcher does.
-    const accountId = useSession.getState().ownAccountFor(CAP.contacts);
+    // inbuxa AL-7: or the locked account in view, the whole of it
+    const accountId = useSession.getState().viewAccountFor(CAP.contacts);
     const available = Boolean(accountId && client.hasCapability(CAP.contacts));
     if (accountId !== get().accountId) set({ accountId, books: {}, cards: {}, cardState: null, loaded: false, selection: { accountId: null, bookId: "all" } });
     set({ available });
@@ -300,7 +301,7 @@ export const useContacts = create<ContactsState>((set, get) => ({
    */
   async loadShared() {
     const session = useSession.getState();
-    const own = session.ownAccountFor(CAP.contacts);
+    const own = session.viewAccountFor(CAP.contacts);
     const s = session.session;
     const accounts = Object.entries(s?.accounts ?? {}).filter(([id, a]) => a.isPersonal === false && id !== own);
     if (!accounts.length) {

web/src/store/files.ts

@@ -139,13 +139,16 @@ export const useFiles = create<FilesState>((set, get) => ({
 
   async init() {
     const session = useSession.getState();
-    const ownAccountId = session.ownAccountFor(CAP.filenode);
+    // inbuxa AL-7: home is the locked account in view, the whole of it
+    const ownAccountId = session.viewAccountFor(CAP.filenode);
     const available = Boolean(ownAccountId && client.hasCapability(CAP.filenode));
     // Stay where the reader is if the session still offers that account;
-    // whether it still holds files is `discoverShared`'s to say.
+    // whether it still holds files is `discoverShared`'s to say. A new home
+    // (a locked account opened or left) starts there.
     const browsing = get().accountId;
     const offered = Object.entries(session.session?.accounts ?? {}).some(([id, a]) => id === browsing && a.isPersonal === false);
-    if (!(browsing && (browsing === ownAccountId || offered))) set(emptyForAccount(ownAccountId));
+    const moved = ownAccountId !== get().ownAccountId;
+    if (moved || !(browsing && (browsing === ownAccountId || offered))) set(emptyForAccount(ownAccountId));
     set({ available, ownAccountId });
   },
 

web/src/store/mail/index.ts

@@ -78,6 +78,7 @@ function offerArchiveFolder(retry: () => Promise<void>): void {
 
 export const useMail = create<MailState>((set, get) => ({
   accountId: null,
+  imagesShown: {},
   mailboxes: {},
   mailboxState: null,
   mailboxesLoaded: false,
@@ -104,6 +105,15 @@ export const useMail = create<MailState>((set, get) => ({
 
   setAccount(accountId) {
     if (accountId === get().accountId) return;
+    // inbuxa AL-7: leaving the reader's own mail for a delegated account,
+    // remember where theirs was, so new mail there is still announced
+    const own = useSession.getState().accountId;
+    const leaving = get().accountId;
+    if (leaving && leaving === own && accountId && accountId !== own) {
+      ownWhileAway = { accountId: own, inbox: get().roleId("inbox"), state: get().emailState };
+    } else if (accountId === own) {
+      ownWhileAway = null;
+    }
     resetBodyOrder();
     snapshots.clear();
     set({
@@ -866,6 +876,10 @@ export const useMail = create<MailState>((set, get) => ({
     }
   },
 
+  showImages(id) {
+    set((s) => ({ imagesShown: { ...s.imagesShown, [id]: true } }));
+  },
+
   select(ids, on) {
     set((s) => {
       const next = { ...s.selected };
@@ -1485,10 +1499,56 @@ function removeFromList(ids: Id[], set: (fn: (s: MailState) => Partial<MailState
 }
 
 async function notifyNewMail(created: Id[], get: () => MailState) {
-  const s = settings();
   const inbox = get().roleId("inbox");
   if (!inbox) return;
   const emails = await get().getEmails(created);
+  announceNewMail(emails, inbox);
+}
+
+/**
+ * The reader's own account while a delegated one is in view (inbuxa AL-7):
+ * its inbox and how far its mail was seen, so what arrives there meanwhile
+ * is still announced.
+ */
+let ownWhileAway: { accountId: Id; inbox: Id | null; state: string | null } | null = null;
+
+/** New mail in the reader's own account, while a delegated one is in view. */
+export async function notifyOwnWhileAway(): Promise<void> {
+  const away = ownWhileAway;
+  if (!away?.inbox || !away.state) return;
+  try {
+    const changes = await client.call<ChangesResponse>("Email/changes", {
+      accountId: away.accountId,
+      sinceState: away.state,
+      maxChanges: 50,
+    });
+    if (ownWhileAway !== away) return;
+    away.state = changes.newState;
+    if (!changes.created.length) return;
+    const got = await client.call<GetResponse<Email>>("Email/get", {
+      accountId: away.accountId,
+      ids: changes.created,
+      properties: LIST_PROPS,
+    });
+    announceNewMail(got.list, away.inbox);
+  } catch {
+    /* the next change tries again */
+  }
+}
+
+export function ownAccountAway(): Id | null {
+  return ownWhileAway?.accountId ?? null;
+}
+
+/** The reader's own inbox, whatever account is in view (inbuxa AL-7). */
+export function ownInboxId(): Id | null {
+  const mail = useMail.getState();
+  if (mail.accountId === useSession.getState().accountId) return mail.roleId("inbox");
+  return ownWhileAway?.inbox ?? null;
+}
+
+function announceNewMail(emails: Email[], inbox: Id) {
+  const s = settings();
   const fresh = emails.filter((e) => e.mailboxIds[inbox] && !e.keywords.$seen && !e.keywords.$draft);
   if (!fresh.length) return;
   if (s.notificationSound) playNewMailSound();
@@ -1514,9 +1574,12 @@ async function notifyNewMail(created: Id[], get: () => MailState) {
   }
 }
 
-/** Keep the store bound to the selected account. */
+/**
+ * Keep the store bound to the account in view: a delegated account while one
+ * is open (inbuxa AL-7), the reader's own otherwise.
+ */
 useSession.subscribe((s) => {
-  useMail.getState().setAccount(s.status === "authenticated" ? s.accountId : null);
+  useMail.getState().setAccount(s.status === "authenticated" ? (s.viewing ?? s.accountId) : null);
 });
 
 

web/src/store/mail/types.ts

@@ -33,6 +33,12 @@ export interface ListState extends ListQuery {
 
 export interface MailState {
   accountId: Id | null;
+  /**
+   * Messages the reader pressed "Show images" on, this session. Kept here
+   * rather than in the message view because replying quotes the message into
+   * a second window, which has to honour the same decision.
+   */
+  imagesShown: Record<Id, boolean>;
   mailboxes: Record<Id, Mailbox>;
   mailboxState: string | null;
   mailboxesLoaded: boolean;
@@ -113,6 +119,8 @@ export interface MailState {
   saveVacation(patch: Partial<VacationResponse>): Promise<void>;
   loadQuota(): Promise<void>;
 
+  /** Remember that this message's remote images were allowed by hand. */
+  showImages(id: Id): void;
   select(ids: Id[], on: boolean): void;
   clearSelection(): void;
   /** Refresh the per-label unread counts, in one request. */

web/src/store/session.ts

@@ -9,6 +9,7 @@ import { reloadIfServerRebuilt } from "@/lib/sw/staleBuild";
 import { unsubscribeThisDevice } from "@/lib/notify/webpush";
 import { clearAllData, clearSignedInData, setDeviceTrusted } from "@/lib/storage";
 import { startIdleLogout, stopIdleLogout } from "@/lib/idleLogout";
+import { delegationOf, type Delegation } from "@/lib/delegation";
 
 export type AuthStatus = "loading" | "anonymous" | "authenticated";
 
@@ -17,6 +18,14 @@ interface SessionState {
   session: JmapSession | null;
   /** Selected mail account (defaults to primary). */
   accountId: Id | null;
+  /**
+   * A locked account handed to the reader that the app shows instead of
+   * their own (inbuxa AL-7): its mail, calendar, contacts and files. The
+   * reader's settings, filters, signatures and push stay their own.
+   */
+  viewing: Id | null;
+  /** The name of an account whose delegation ended while it was in view. */
+  delegationEnded: string | null;
   error: string | null;
   pushConnected: boolean;
   /** Finer than pushConnected: tells "reconnecting" from "not connected". */
@@ -26,10 +35,20 @@ interface SessionState {
   logout(): Promise<void>;
   refresh(): Promise<void>;
   setAccount(id: Id): void;
+  /** Show a delegated account's mail, or the reader's own with null. */
+  view(id: Id | null): void;
+  clearDelegationEnded(): void;
   /** The account to read and write for a capability, honoring the account switcher. */
   accountFor(cap: string): Id | null;
   /** The user's own account for a capability, whatever they are looking at. */
   ownAccountFor(cap: string): Id | null;
+  /**
+   * inbuxa AL-7: the account calendar, contacts and files show: the locked
+   * account in view, if it offers `cap`, else the reader's own. Never for
+   * anything the reader keeps (settings, signatures, push): those stay
+   * `ownAccountFor`.
+   */
+  viewAccountFor(cap: string): Id | null;
 }
 
 let refreshing: Promise<void> | null = null;
@@ -38,6 +57,8 @@ export const useSession = create<SessionState>((set, get) => ({
   status: "loading",
   session: null,
   accountId: null,
+  viewing: null,
+  delegationEnded: null,
   error: null,
   pushConnected: false,
   pushState: "disconnected",
@@ -99,7 +120,7 @@ export const useSession = create<SessionState>((set, get) => ({
     // problem next -- and the address book cached here is the same argument.
     clearSignedInData();
     client.session = null;
-    set({ status: "anonymous", session: null, accountId: null });
+    set({ status: "anonymous", session: null, accountId: null, viewing: null });
   },
 
   refresh() {
@@ -109,7 +130,14 @@ export const useSession = create<SessionState>((set, get) => ({
         const s = await apiFetch<JmapSession>("/api/auth/session?refresh=1");
         client.session = s;
         setServerLocale(s.ihasmail?.userLocale);
-        set({ session: s });
+        // A delegation that ended takes the reader back to their own mail
+        const viewing = get().viewing;
+        if (viewing && !delegationOf(s, viewing)) {
+          const name = get().session?.accounts[viewing]?.name ?? null;
+          set({ session: s, viewing: null, delegationEnded: name });
+        } else {
+          set({ session: s });
+        }
       } catch {
         /* ignore */
       } finally {
@@ -123,6 +151,16 @@ export const useSession = create<SessionState>((set, get) => ({
     set({ accountId: id });
   },
 
+  view(id) {
+    if (id && !delegationOf(get().session, id)) return;
+    if (id === get().viewing) return;
+    set({ viewing: id });
+  },
+
+  clearDelegationEnded() {
+    set({ delegationEnded: null });
+  },
+
   accountFor(cap) {
     return accountForCapability(get().session, get().accountId, cap);
   },
@@ -130,6 +168,13 @@ export const useSession = create<SessionState>((set, get) => ({
   ownAccountFor(cap) {
     return ownAccountForCapability(get().session, cap);
   },
+
+  viewAccountFor(cap) {
+    const { session, viewing } = get();
+    const viewed = viewing ? session?.accounts[viewing] : undefined;
+    if (viewing && viewed && cap in (viewed.accountCapabilities ?? {})) return viewing;
+    return ownAccountForCapability(session, cap);
+  },
 }));
 
 function applySession(s: JmapSession, set: (p: Partial<SessionState>) => void) {
@@ -149,7 +194,7 @@ function applySession(s: JmapSession, set: (p: Partial<SessionState>) => void) {
     startIdleLogout(() => void useSession.getState().logout());
   }
   const accountId = s.primaryAccounts[CAP.mail] ?? Object.keys(s.accounts)[0] ?? null;
-  set({ status: "authenticated", session: s, accountId, error: null });
+  set({ status: "authenticated", session: s, accountId, viewing: null, error: null });
 }
 
 client.onUnauthenticated(() => {
@@ -162,12 +207,24 @@ client.onUnauthenticated(() => {
   // usual reason to be signed out here, and reloading a form someone has
   // already started typing into would throw the password away.
   void reloadIfServerRebuilt().then((reloading) => {
-    if (!reloading) useSession.setState({ status: "anonymous", session: null, accountId: null });
+    if (!reloading) useSession.setState({ status: "anonymous", session: null, accountId: null, viewing: null });
   });
 });
 
 push.onConnection((state) => useSession.setState({ pushConnected: state === "connected", pushState: state }));
 
+/** The delegation of the locked account in view, if one is (inbuxa AL-6). */
+export function useViewingDelegation(): Delegation | null {
+  const session = useSession((s) => s.session);
+  const viewing = useSession((s) => s.viewing);
+  return delegationOf(session, viewing);
+}
+
+export function viewingDelegation(): Delegation | null {
+  const s = useSession.getState();
+  return delegationOf(s.session, s.viewing);
+}
+
 export function hasCap(cap: string): boolean {
   return client.hasCapability(cap);
 }

web/src/styles/app.css

@@ -1248,6 +1248,20 @@ a.menu-item:hover { color: var(--fg); }
 .topbar .brand img { width: 34px; height: 34px; object-fit: contain; }
 .topbar .brand .brand-name { color: #14b8a6; }
 .topbar .brand .brand-name span { color: var(--fg-muted); font-weight: 500; }
+/*
+ * inbuxa AL-7: a locked account's mail in view. The bar is its own grid row
+ * above the top bar; its red is fixed, never the palette's, so it reads the
+ * same in every palette and mode and can't pass for part of a theme (white on
+ * red-700 is 6.5:1). The wordmark turns red too, with a padlock beside it.
+ */
+.app.delegated { grid-template-rows: auto var(--topbar-h) 1fr; }
+.delegated-bar { display: flex; align-items: center; gap: 8px; padding: 6px 12px; background: #b91c1c; color: #fff; font-size: .9em; min-width: 0; }
+.delegated-bar strong { font-weight: 700; }
+.delegated-bar button { flex: none; border: 1px solid rgba(255, 255, 255, .7); background: transparent; color: #fff; border-radius: 999px; padding: 3px 12px; font: inherit; font-weight: 600; cursor: pointer; }
+.delegated-bar button:hover, .delegated-bar button:focus-visible { background: rgba(255, 255, 255, .15); }
+.topbar .brand.locked .brand-name, .topbar .brand.locked .brand-lock { color: #dc2626; }
+[data-theme="dark"] .topbar .brand.locked .brand-name, [data-theme="dark"] .topbar .brand.locked .brand-lock { color: #f87171; }
+.topbar .brand .brand-lock { flex: none; }
 /* `min-width: 0`, or the flex default of `auto` holds the search field at its
    own min-content and the account buttons beside it are pushed off a phone. */
 .searchbar { flex: 1 1 auto; min-width: 0; max-width: 720px; margin: 0 auto; position: relative; }
@@ -1570,6 +1584,12 @@ a.menu-item:hover { color: var(--fg); }
 .composer-head .title { flex: 1; font-weight: 600; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
 .composer-head .status { color: var(--fg-faint); font-size: .8em; margin-right: 6px; white-space: nowrap; }
 .composer-body { display: flex; flex-direction: column; flex: 1; min-height: 0; }
+/* An offer the draft makes about itself, above the editor: quiet, one line, and dismissible. */
+.composer-notice { display: flex; align-items: center; gap: 8px; padding: 6px 10px 6px 14px; background: var(--accent-soft); color: var(--accent-soft-fg); border-bottom: 1px solid var(--border); font-size: .85em; flex: 0 0 auto; }
+.composer-notice span { flex: 1; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+/* inbuxa: a DLP warning or block on the last send */
+.composer-notice-dlp { background: var(--warn-soft); color: var(--fg); }
+.composer-notice-dlp span { white-space: normal; }
 .composer-fields { flex: 0 0 auto; padding: 0 12px; }
 .composer-field { display: flex; align-items: center; gap: 8px; min-height: 40px; border-bottom: 1px solid var(--border); padding: 4px 0; }
 .composer-field > label { color: var(--fg-muted); width: 42px; flex: 0 0 auto; font-size: .92em; }

web/src/ui/InbuxaWordmark.tsx

@@ -1,9 +1,9 @@
 /**
  * The INBUXA wordmark, "inbuxa" in Space Grotesk Bold, as vector paths in the
  * current text color, so it reads on every palette, light or dark. The mark
- * beside it is `/img/inbuxa-mark.png`: ihasmail's own cat and envelope, which
- * INBUXA's logo reuses unchanged. The paths are the same ones INBUXA Admin
- * draws, from the INBUXA logo bundle.
+ * beside it is `/img/inbuxa-mark.png`: inbuxa's own kitten, the family's cat
+ * over a server with a bay for each piece of the suite. The paths are the
+ * same ones inbuxa Admin draws, from the inbuxa logo bundle.
  *
  * ihasmail-inbuxa only. Public ihasmail keeps its own name.
  */

web/src/views/AppShell.tsx

@@ -1,14 +1,16 @@
 import { lazy, Suspense, useEffect, useRef, useState, type ReactNode } from "react";
 import { Link, useLocation } from "wouter";
-import { Calendar, ChevronsUpDown, FolderOpen, Globe, HelpCircle, LogOut, Mail, Menu as MenuIcon, Moon, PenSquare, Plus, RefreshCw, Settings, ShieldCheck, Sun, Upload, Users, X } from "lucide-react";
+import { Calendar, Check, ChevronsUpDown, FolderOpen, Globe, HelpCircle, Lock, LogOut, Mail, Menu as MenuIcon, Moon, PenSquare, Plus, RefreshCw, Settings, ShieldCheck, Sun, Upload, Users, X } from "lucide-react";
 import { useSession } from "@/store/session";
-import { withBase } from "@/lib/basePath";
-import { DEFAULT_APP_NAME } from "@/lib/brand";
+import { DEFAULT_APP_NAME, brandImage } from "@/lib/brand";
 import { InbuxaWordmark } from "@/ui/InbuxaWordmark";
 import { useEffectiveTheme, useSettings } from "@/store/settings";
 import { toggleTarget } from "@/lib/palette";
 import { useMail } from "@/store/mail";
-import { draftFromMailto, useCompose } from "@/store/compose";
+import { composeBlocked, draftFromMailto, useCompose } from "@/store/compose";
+import { delegatedAccounts } from "@/lib/delegation";
+import { toast } from "@/ui/toast";
+import { DelegatedBar } from "./DelegatedBar";
 import { Avatar, useIsMobile } from "@/ui/misc";
 import { MenuItem, MenuSep, Popover, useMenu } from "@/ui/popover";
 import { Splitter } from "@/ui/Splitter";
@@ -131,24 +133,45 @@ export function AppShell({ children }: { children: ReactNode }) {
   }, [openShare, navigate]);
 
   /*
-   * There is no account switcher any more.
+   * There is no general account switcher.
    *
    * It existed to reach what other people shared, and was the wrong door: it
    * moved the whole app to somebody else's account, and Stalwart advertises
    * every capability on a shared account, so mail, calendar and contacts went
    * with it and were refused. Shares are listed where they belong now -- in
-   * Files and in Contacts, beside the reader's own -- and found without anyone
-   * having to know an account switch was involved.
+   * Files and in Contacts, beside the reader's own.
+   *
+   * inbuxa AL-7 brings back one narrow door: a locked account an administrator
+   * handed to the reader. Only its mail is shown, in place of the reader's
+   * own; calendars, contacts, files and settings stay theirs. It is offered
+   * only when the session marks such an account, and only then is there
+   * anything to switch.
    */
+  const viewing = useSession((s) => s.viewing);
+  const delegated = delegatedAccounts(session);
+  const switchTo = (id: string | null) => {
+    acctMenu.close();
+    if (id === viewing) return;
+    // A message being written belongs to the account it was started in
+    if (useCompose.getState().drafts.length) {
+      toast.show(t("Send or close the message you're writing first."));
+      return;
+    }
+    useSession.getState().view(id);
+    navigate("/mail");
+  };
+  const composeOff = section !== "files" && section !== "calendar" && section !== "contacts" && composeBlocked() !== null;
 
   return (
-    <div className="app">
+    <div className={`app ${viewing ? "delegated" : ""}`}>
+      <DelegatedBar />
       <header className="topbar">
         <button className="icon-btn" aria-label={t("Menu")} onClick={() => (isMobile ? setDrawer((d) => !d) : update({ sidebarCollapsed: !collapsed }))}>
           <MenuIcon size={22} />
         </button>
-        <Link href="/mail" className="brand">
-          <img src={withBase(appName === DEFAULT_APP_NAME ? "/img/inbuxa-mark.png" : "/img/logo.png")} alt="" />
+        <Link href="/mail" className={`brand ${viewing ? "locked" : ""}`}>
+          <img src={brandImage(appName === DEFAULT_APP_NAME ? "/img/inbuxa-mark.png" : "/img/logo.png")} alt="" />
+          {viewing && <Lock size={18} className="brand-lock" aria-label={t("Locked account")} />}
           {/* A product name, not a word: translated it is a different product.
               Read from the session rather than written here, so a deployment
               that set APP_NAME is called what it calls itself -- the document
@@ -187,6 +210,27 @@ export function AppShell({ children }: { children: ReactNode }) {
               </div>
             </div>
             <MenuSep />
+            {delegated.length > 0 && (
+              <>
+                <div className="hint" style={{ padding: "4px 10px" }}>{t("Mail to show")}</div>
+                <MenuItem
+                  icon={viewing ? <Mail size={16} /> : <Check size={16} />}
+                  label={t("My mail")}
+                  active={!viewing}
+                  onClick={() => switchTo(null)}
+                />
+                {delegated.map((account) => (
+                  <MenuItem
+                    key={account.id}
+                    icon={viewing === account.id ? <Check size={16} /> : <Lock size={16} />}
+                    label={<span className="notranslate" translate="no">{account.name}</span>}
+                    active={viewing === account.id}
+                    onClick={() => switchTo(account.id)}
+                  />
+                ))}
+                <MenuSep />
+              </>
+            )}
             {/* The project site. It is linked from the login screen footer, which
                 is a page a signed-in user never sees again -- so from inside the
                 app there was no way back to it.
@@ -250,6 +294,7 @@ export function AppShell({ children }: { children: ReactNode }) {
               from the file manager and was the one thing nobody wanted there. */}
           <button
             className="compose-btn"
+            hidden={composeOff}
             onClick={() => {
               if (section === "calendar") window.dispatchEvent(new CustomEvent("ihm:new-event"));
               else if (section === "contacts") window.dispatchEvent(new CustomEvent("ihm:new-contact"));

web/src/views/DelegatedBar.tsx

@@ -0,0 +1,50 @@
+import { Lock } from "lucide-react";
+import { useLocation } from "wouter";
+import { useSession, useViewingDelegation } from "@/store/session";
+import { t } from "@/lib/i18n";
+import type { DelegationAccess } from "@/lib/delegation";
+
+export function accessText(access: DelegationAccess): string {
+  switch (access) {
+    case "read":
+      return t("Read only");
+    case "organize":
+      return t("Read and organize");
+    case "full":
+      return t("Full access");
+  }
+}
+
+/**
+ * inbuxa AL-7: while a locked account's mail is in view, a red bar across
+ * the whole app says so, with the way back. Red, not the palette's accent: a
+ * fixed color that reads the same in every palette and in dark mode, so it
+ * can't be mistaken for part of a theme.
+ */
+export function DelegatedBar() {
+  const viewing = useSession((s) => s.viewing);
+  const name = useSession((s) => (s.viewing ? s.session?.accounts[s.viewing]?.name : undefined));
+  const delegation = useViewingDelegation();
+  const [, navigate] = useLocation();
+  if (!viewing || !delegation) return null;
+  return (
+    <div className="delegated-bar" role="status">
+      <Lock size={15} aria-hidden />
+      <span className="grow truncate">
+        {t("Locked account:")} <strong className="notranslate" translate="no">{name}</strong>
+        {" · "}
+        {accessText(delegation.access)}
+        {delegation.sendAs ? ` · ${t("You can send as this account")}` : ""}
+      </span>
+      <button
+        type="button"
+        onClick={() => {
+          useSession.getState().view(null);
+          navigate("/mail");
+        }}
+      >
+        {t("Back to my mail")}
+      </button>
+    </div>
+  );
+}

web/src/views/Login.tsx

@@ -5,7 +5,7 @@ import { ApiError } from "@/jmap/client";
 import { withBase } from "@/lib/basePath";
 import { APP_VERSION } from "@/lib/version";
 import { DEFAULT_SOURCE_URL } from "@/lib/source";
-import { DEFAULT_APP_NAME } from "@/lib/brand";
+import { DEFAULT_APP_NAME, brandImage } from "@/lib/brand";
 import { t } from "@/lib/i18n";
 import { InbuxaWordmark } from "@/ui/InbuxaWordmark";
 
@@ -92,7 +92,7 @@ export function LoginPage() {
     <div className="login-page">
       <form className="login-card" onSubmit={submit}>
         <div className="logo">
-          <img src={withBase(appName === DEFAULT_APP_NAME ? "/img/inbuxa-mark.png" : "/img/logo.png")} alt="" width={120} height={143} />
+          <img src={brandImage(appName === DEFAULT_APP_NAME ? "/img/inbuxa-mark.png" : "/img/logo.png")} alt="" width={120} height={126} />
           {/* A product name, not a word: not translated, and not guessed at
               from the page it is on. INBUXA's is its wordmark. */}
           <h1 className="notranslate" translate="no">

web/src/views/admin/AccountSheet.tsx

@@ -1,5 +1,5 @@
 import { useEffect, useMemo, useState } from "react";
-import { Copy, Dices, KeyRound, Lock, Plus, Trash2, X } from "lucide-react";
+import { Copy, Dices, ExternalLink, KeyRound, Lock, Plus, X } from "lucide-react";
 import {
   ADMIN_BASELINE,
   can,
@@ -12,7 +12,6 @@ import {
   aliasList,
   createAccount,
   describeDirectoryError,
-  destroyAccount,
   hasPassword,
   passwordPatch,
   quotasWithDisk,
@@ -25,7 +24,7 @@ import { formatSize } from "@/lib/format";
 import { t, tNode } from "@/lib/i18n";
 import { Link } from "wouter";
 import { Avatar } from "@/ui/misc";
-import { Dialog } from "@/ui/dialog";
+import { useSession } from "@/store/session";
 import { toast } from "@/ui/toast";
 import { isSelf, roleName, type DirectoryContext } from "./directoryContext";
 import { usePermissions } from "./usePermissions";
@@ -39,7 +38,6 @@ interface Props {
   onClose: () => void;
   onChanged: () => void;
   onCreated: (id: string) => void;
-  onDeleted: () => void;
 }
 
 /** A role as one select value: "User", "Admin", or "custom:<ids>". */
@@ -71,7 +69,7 @@ const bytesOf = (gib: string) => {
  * a password and a delete are their own calls, because each is a decision of
  * its own and should never ride along with a renamed display name.
  */
-export function AccountSheet({ account, ctx, onClose, onChanged, onCreated, onDeleted }: Props) {
+export function AccountSheet({ account, ctx, onClose, onChanged, onCreated }: Props) {
   const perms = usePermissions();
   const creating = account === null;
   const self = account ? isSelf(account, ctx) : false;
@@ -288,9 +286,7 @@ export function AccountSheet({ account, ctx, onClose, onChanged, onCreated, onDe
 
         {error && <p className="admin-notice error" role="alert">{error}</p>}
 
-        {!creating && can(perms, "Account", "Destroy") && (
-          <DeleteAccount account={account} blocked={self ? t("You can't delete the account you're signed in with.") : locked ? t("This account has permissions yours doesn't.") : null} onDeleted={onDeleted} />
-        )}
+        {!creating && can(perms, "Account", "Destroy") && <DeleteInConsole accountId={account.id} />}
       </div>
 
       {editable && (
@@ -433,59 +429,24 @@ export function Aliases({ aliases, setAliases, editable, domains, defaultDomain,
   );
 }
 
-function DeleteAccount({ account, blocked, onDeleted }: { account: DirectoryAccount; blocked: string | null; onDeleted: () => void }) {
-  const [open, setOpen] = useState(false);
-  const [typed, setTyped] = useState("");
-  const [busy, setBusy] = useState(false);
-  const [error, setError] = useState<string | null>(null);
-  const address = account.emailAddress ?? account.name;
+/**
+ * inbuxa: deleting a person's account is the console's, beside locking it
+ * and legal holds: it asks why, for the audit log, and says when a hold
+ * keeps the data. Only the pointer is here.
+ */
+function DeleteInConsole({ accountId }: { accountId: string }) {
+  const adminUrl = useSession((s) => s.session?.ihasmail?.server?.adminUrl ?? null);
   return (
     <>
       <h3>{t("Delete")}</h3>
       <div className="admin-danger">
-        <p>{blocked ?? t("Deletes the mailbox and everything in it.")}</p>
-        <button className="btn btn-sm admin-danger-btn" disabled={!!blocked} onClick={() => { setTyped(""); setError(null); setOpen(true); }}>
-          <Trash2 size={14} /> {t("Delete account…")}
-        </button>
+        <p>{t("Deleting, locking and legal holds are done in the administration console, which records why and keeps what a hold covers.")}</p>
+        {adminUrl && (
+          <a className="btn btn-sm" href={`${adminUrl.replace(/\/$/, "")}/Management/x:Account/User/${accountId}`} target="_blank" rel="noopener noreferrer">
+            <ExternalLink size={14} /> {t("Open in the console")}
+          </a>
+        )}
       </div>
-      <Dialog
-        open={open}
-        onClose={() => setOpen(false)}
-        title={t("Delete {address}?", { address })}
-        size="sm"
-        footer={
-          <>
-            <button className="btn" onClick={() => setOpen(false)}>{t("Cancel")}</button>
-            <button
-              className="btn btn-danger"
-              disabled={busy || typed.trim().toLowerCase() !== address.toLowerCase()}
-              onClick={async () => {
-                setBusy(true);
-                setError(null);
-                try {
-                  await destroyAccount(account.id);
-                  toast.success(t("Deleted {address}", { address }));
-                  setOpen(false);
-                  onDeleted();
-                } catch (err) {
-                  setError(describeDirectoryError(err));
-                } finally {
-                  setBusy(false);
-                }
-              }}
-            >
-              {t("Delete account")}
-            </button>
-          </>
-        }
-      >
-        <p style={{ marginTop: 0 }}>{t("This deletes the mail, calendars, contacts and files in this account. The server removes them in the background, and it can't be undone.")}</p>
-        <div className="field">
-          <label htmlFor="admin-delete-confirm">{t("Type {address} to confirm", { address })}</label>
-          <input id="admin-delete-confirm" className="input notranslate" translate="no" value={typed} autoComplete="off" spellCheck={false} onChange={(e) => setTyped(e.target.value)} />
-        </div>
-        {error && <p className="admin-notice error" role="alert">{error}</p>}
-      </Dialog>
     </>
   );
 }

web/src/views/admin/AccountsAdmin.tsx

@@ -217,10 +217,6 @@ export function AccountsAdmin({ selectedId }: { selectedId?: string }) {
             changed();
             navigate(`/admin/accounts/${id}`);
           }}
-          onDeleted={() => {
-            changed();
-            close();
-          }}
         />
       )}
     </div>

web/src/views/admin/AdminDashboard.tsx

@@ -1,7 +1,7 @@
 import { useEffect, useState, type ReactNode } from "react";
 import { Link } from "wouter";
 import { ArrowDownToLine, ArrowUpFromLine, ExternalLink, Globe, Hourglass, LayoutDashboard, MemoryStick, RefreshCw, ShieldCheck, Users } from "lucide-react";
-import { legacyProtocolsOff } from "@/jmap/client";
+import { legacyProtocolsOff, legacyProtocolsPartlyOff } from "@/jmap/client";
 import { useAppName } from "@/lib/brand";
 import { adminSections, dashboardCards, type DashboardCard } from "@/lib/admin/adminAccess";
 import { balancedColumns, countObjects, DASHBOARD_WINDOW_MS, isRefused, loadMetrics, summarizeMetrics, type MessageStats } from "@/lib/admin/adminDashboard";
@@ -38,6 +38,7 @@ export function AdminDashboard() {
   const perms = usePermissions();
   const adminUrl = useSession((s) => s.session?.ihasmail?.server?.adminUrl ?? null);
   const legacyOff = useSession((s) => legacyProtocolsOff(s.session, s.accountId));
+  const legacyPartlyOff = useSession((s) => legacyProtocolsPartlyOff(s.session, s.accountId).join(", "));
   const app = useAppName();
   const cards = dashboardCards(perms);
   const sections = adminSections(perms);
@@ -113,6 +114,13 @@ export function AdminDashboard() {
           <span>{t("Legacy mail protocols are off for your organization. Only {app} and JMAP apps can sign in.", { app })}</span>
         </p>
       )}
+      {legacyPartlyOff && (
+        // INBUXA: one switch per protocol, some of them off
+        <p className="admin-notice">
+          <ShieldCheck size={16} />
+          <span>{t("Some legacy mail protocols are off for your organization: {protocols}.", { protocols: legacyPartlyOff })}</span>
+        </p>
+      )}
       {shown.length ? (
         <div className="admin-cards-wrap">
           <div className="admin-cards">

web/src/views/admin/TenantLegacyProtocols.tsx

@@ -68,10 +68,15 @@ export function TenantLegacyProtocols({ tenantId, tenantName }: { tenantId: stri
       <p>
         {state.off
           ? t("Off for {tenant}. Only {app} and JMAP apps can sign in to its domains.", { tenant: tenantName, app })
-          : t("On for {tenant}. Mail apps can use IMAP, POP3 and ManageSieve on its domains.", { tenant: tenantName })}
+          : state.partlyOff.length > 0
+            ? t("Some are off for {tenant}: {protocols}. Switch them one at a time in the administration console.", {
+                tenant: tenantName,
+                protocols: state.partlyOff.join(", "),
+              })
+            : t("On for {tenant}. Mail apps can use IMAP, POP3 and ManageSieve on its domains.", { tenant: tenantName })}
       </p>
 
-      {canChange && state.off && (
+      {canChange && (state.off || state.partlyOff.length > 0) && (
         <button className="btn" disabled={busy} onClick={() => void turn(false)}>
           {t("Turn legacy protocols back on")}
         </button>

web/src/views/admin/__tests__/account-sheet.test.tsx

@@ -48,7 +48,7 @@ describe("the account sheet", () => {
     await act(async () => {
       root.render(
         <Router hook={hook}>
-          <AccountSheet account={a} ctx={ctx} onClose={() => {}} onChanged={() => {}} onCreated={() => {}} onDeleted={() => {}} />
+          <AccountSheet account={a} ctx={ctx} onClose={() => {}} onChanged={() => {}} onCreated={() => {}} />
         </Router>,
       );
     });
@@ -89,7 +89,20 @@ describe("the account sheet", () => {
     expect(host.querySelector('a[href="/settings/security"]')).not.toBeNull();
     expect(button(host, "Set a new password")).toBeUndefined();
     expect((host.querySelector('select[aria-label="Role"]') as HTMLSelectElement).disabled).toBe(true);
-    expect(button(host, "Delete account")?.disabled).toBe(true);
+    expect(host.textContent).not.toContain("Delete account");
+    expect(host.textContent).toContain("administration console");
+  });
+
+  it("sends deleting a person to the console, opened on that account (inbuxa)", async () => {
+    signIn([...HELPDESK, "sysAccountDestroy"]);
+    const s = useSession.getState().session!;
+    useSession.setState({
+      session: { ...s, ihasmail: { ...s.ihasmail, server: { ...(s.ihasmail?.server ?? {}), adminUrl: "https://admin.example.com/" } } } as never,
+    });
+    await render(account({ id: "k7" }));
+    expect(host.textContent).not.toContain("Delete account");
+    const link = host.querySelector('a[href="https://admin.example.com/Management/x:Account/User/k7"]');
+    expect(link?.textContent).toContain("Open in the console");
   });
 });
 
@@ -108,7 +121,7 @@ describe("an account's tenant", () => {
   const render = async (a: DirectoryAccount) => {
     const { hook } = memoryLocation({ path: `/admin/accounts/${a.id}` });
     await act(async () => {
-      root.render(<Router hook={hook}><AccountSheet account={a} ctx={tenantCtx} onClose={() => {}} onChanged={() => {}} onCreated={() => {}} onDeleted={() => {}} /></Router>);
+      root.render(<Router hook={hook}><AccountSheet account={a} ctx={tenantCtx} onClose={() => {}} onChanged={() => {}} onCreated={() => {}} /></Router>);
     });
   };
   beforeEach(() => {

web/src/views/admin/__tests__/tenant-legacy-protocols.test.tsx

@@ -62,7 +62,7 @@ describe("a tenant's legacy mail protocols switch", () => {
   });
 
   it("shows who would notice and what it means, then asks for the exact phrase", async () => {
-    api.state = { off: false, recent: [{ accountId: "a", name: "[email protected]", protocol: "imap", lastUsedAt: Date.now() - 2 * 86400_000 }] };
+    api.state = { off: false, partlyOff: [], recent: [{ accountId: "a", name: "[email protected]", protocol: "imap", lastUsedAt: Date.now() - 2 * 86400_000 }] };
     signIn(["sysDomainGet", "sysDomainUpdate"]);
     await render();
     await act(async () => button(host, "Turn off legacy protocols…")!.click());
@@ -84,7 +84,7 @@ describe("a tenant's legacy mail protocols switch", () => {
   });
 
   it("turns it back on with one click", async () => {
-    api.state = { off: true, recent: [] };
+    api.state = { off: true, partlyOff: [], recent: [] };
     signIn(["sysDomainGet", "sysDomainUpdate"]);
     await render();
     await act(async () => button(host, "Turn legacy protocols back on")!.click());
@@ -92,7 +92,7 @@ describe("a tenant's legacy mail protocols switch", () => {
   });
 
   it("shows the state but no switch to someone who can't change domains", async () => {
-    api.state = { off: true, recent: null };
+    api.state = { off: true, partlyOff: [], recent: null };
     signIn(["sysDomainGet"]);
     await render();
     expect(host.textContent).toContain("Off for Acme Corp");

web/src/views/compose/Composer.tsx

@@ -141,17 +141,45 @@ export function Composer({ draft }: { draft: Draft }) {
     await send(key);
   };
 
+  // inbuxa: DLP warned: send anyway with a reason the server records
+  const sendAnyway = async () => {
+    const reason = await promptDialog({
+      title: translate("Send anyway?"),
+      message: translate("Your reason is recorded with the message."),
+      placeholder: translate("Why this needs to go"),
+      confirmLabel: translate("Send anyway"),
+    });
+    if (!reason?.trim()) return;
+    patch({ dlp: null, dlpOverride: reason.trim() });
+    await send(key);
+  };
+
   const scheduleFor = (at: Date) => {
     sendMenu.close();
     setScheduleOpen(false);
     patch({ sendAt: at.getTime() });
   };
 
+  /*
+   * Switching format converts what has been written, but the quoted message
+   * is not something this draft wrote: it was prepared in both formats when
+   * the reply opened. Converting the plain-text quote into HTML would hand
+   * back a flattened copy of a message that still exists in its original
+   * markup, so re-attach that instead, and keep only what the author typed
+   * above it. Where the quote can no longer be found -- edited, or a draft
+   * that quotes nothing -- convert the whole body as before.
+   */
   const toggleFormat = () => {
+    // Whichever way the format is changed, the offer has been answered.
     if (d.format === "html") {
-      patch({ format: "text", text: htmlToText(d.html) });
+      const at = d.quoteHtml ? d.html.indexOf('<div class="ihm-quote">') : -1;
+      const written = at >= 0 ? htmlToText(d.html.slice(0, at)) : htmlToText(d.html);
+      patch({ format: "text", text: at >= 0 ? written.replace(/\s+$/, "") + d.quoteText : written, formatOffer: null });
     } else {
-      patch({ format: "html", html: textToHtml(d.text, { linkify: false, quoteColors: false }).replace(/\n/g, "<br>") });
+      const keeps = Boolean(d.quoteText) && d.text.endsWith(d.quoteText);
+      const written = keeps ? d.text.slice(0, d.text.length - d.quoteText.length) : d.text;
+      const asHtml = textToHtml(written, { linkify: false, quoteColors: false }).replace(/\n/g, "<br>");
+      patch({ format: "html", html: keeps ? asHtml + d.quoteHtml : asHtml, formatOffer: null });
     }
   };
 
@@ -261,6 +289,41 @@ export function Composer({ draft }: { draft: Draft }) {
             )}
           </div>
         </div>
+        {/*
+          Replying in one format to a message written in the other loses
+          something either way: the formatting of a rich reply, or the plain
+          text somebody chose to write in. The draft opens in the format the
+          settings ask for, and this offers the other one for this message
+          only, rather than quietly overriding the setting (#407).
+        */}
+        {d.formatOffer && (
+          <div className="composer-notice">
+            <span>{d.formatOffer === "html" ? translate("This message is rich text") : translate("This message is plain text")}</span>
+            <button type="button" className="btn btn-sm" onClick={toggleFormat}>
+              {d.formatOffer === "html" ? translate("Switch to rich text") : translate("Switch to plain text")}
+            </button>
+            <button type="button" className="icon-btn sm" aria-label={translate("Dismiss")} onClick={() => patch({ formatOffer: null })}><X size={14} /></button>
+          </div>
+        )}
+        {/*
+          inbuxa: the server's DLP rules refused the last send. A warning
+          can be answered with a reason; a block can't, only by changing
+          the message.
+        */}
+        {d.dlp && (
+          <div className="composer-notice composer-notice-dlp" role="alert">
+            <AlertTriangle size={14} />
+            <span title={d.dlp.rules.map((r) => r.notice).join(" ")}>
+              {d.dlp.kind === "warning" ? translate("Not sent yet:") : translate("Not sent:")} {d.dlp.rules.map((r) => r.notice).join(" ")}
+            </span>
+            {d.dlp.kind === "warning" && (
+              <button type="button" className="btn btn-sm" onClick={() => void sendAnyway()}>
+                {translate("Send anyway…")}
+              </button>
+            )}
+            <button type="button" className="icon-btn sm" aria-label={translate("Dismiss")} onClick={() => patch({ dlp: null })}><X size={14} /></button>
+          </div>
+        )}
         {d.format === "html" ? (
           <RichEditor ref={editorRef} html={d.html} onChange={onHtml} placeholder={translate("Write your message…")} spellcheck={settings.spellcheck} onFiles={(files) => addFiles(key, files)} showToolbar={showToolbar} autoFocus={initialFocus === "body"} />
         ) : (

web/src/views/compose/__tests__/format-offer-bar.test.tsx

@@ -0,0 +1,107 @@
+import { act } from "react";
+import { createRoot, type Root } from "react-dom/client";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { Composer } from "../Composer";
+import { useCompose, type Draft } from "@/store/compose";
+import { useMail } from "@/store/mail";
+
+(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true;
+
+/**
+ * The bar the composer shows when the draft's format doesn't match the message
+ * it is answering (#407). A store test can say the offer was made; only the
+ * component can say that pressing it converts the body and puts the bar away.
+ */
+
+window.matchMedia = ((q: string) => ({ matches: false, media: q, addEventListener() {}, removeEventListener() {} })) as unknown as typeof window.matchMedia;
+
+const QUOTE_HTML = '<div class="ihm-quote"><br><div>On Friday, Ann wrote:</div><blockquote><p>Look at <b>this</b></p></blockquote></div>';
+const QUOTE_TEXT = "\n\nOn Friday, Ann wrote:\n> Look at this";
+
+const REPLY: Partial<Draft> = {
+  key: "d1", replyMode: "reply", subject: "Re: Numbers",
+  format: "text", text: QUOTE_TEXT, html: `<div><br></div>${QUOTE_HTML}`,
+  quoteHtml: QUOTE_HTML, quoteText: QUOTE_TEXT,
+  formatOffer: "html",
+};
+
+describe("the format offer in the composer", () => {
+  let host: HTMLDivElement;
+  let root: Root;
+  const bar = () => document.querySelector(".composer-notice");
+  const draft = () => useCompose.getState().drafts[0]!;
+  const button = (label: string) => Array.from(document.querySelectorAll<HTMLElement>(".composer-notice button")).find((b) => b.textContent === label || b.getAttribute("aria-label") === label)!;
+
+  beforeEach(() => {
+    useMail.setState({ accountId: "a1", identities: [] as never });
+    useCompose.setState({ drafts: [], activeKey: null, pendingSends: {} });
+    const key = useCompose.getState().open();
+    useCompose.getState().update(key, REPLY);
+    host = document.createElement("div");
+    document.body.appendChild(host);
+    root = createRoot(host);
+    act(() => root.render(<Composer draft={draft()} />));
+  });
+  afterEach(() => { act(() => root.unmount()); host.remove(); });
+
+  it("offers the message's own format, and says which it is", () => {
+    expect(bar()?.textContent).toContain("This message is rich text");
+    expect(button("Switch to rich text")).toBeTruthy();
+  });
+
+  it("switches this draft and puts the bar away", () => {
+    act(() => button("Switch to rich text").click());
+    act(() => root.render(<Composer draft={draft()} />));
+    expect(draft().format).toBe("html");
+    // The quoted reply came across, rather than the editor opening empty.
+    expect(draft().html).toContain("Ann wrote");
+    expect(bar()).toBeNull();
+  });
+
+  /*
+   * The message being quoted was prepared in both formats when the reply
+   * opened. Switching used to convert the plain-text body it had, handing
+   * back a flattened copy -- "> Look at this" -- of markup that still
+   * existed untouched on the draft.
+   */
+  it("restores the original message, rather than converting the flattened quote", () => {
+    act(() => button("Switch to rich text").click());
+    act(() => root.render(<Composer draft={draft()} />));
+    expect(draft().html).toContain("<b>this</b>");
+    expect(draft().html).toContain("<blockquote>");
+    expect(draft().html).not.toContain("&gt; Look at this");
+  });
+
+  it("keeps what the author typed above the quote", () => {
+    useCompose.getState().update("d1", { text: `Thanks, that helps.${QUOTE_TEXT}` });
+    act(() => root.render(<Composer draft={draft()} />));
+    act(() => button("Switch to rich text").click());
+    act(() => root.render(<Composer draft={draft()} />));
+    expect(draft().html).toContain("Thanks, that helps.");
+    expect(draft().html).toContain("<b>this</b>");
+    // Once only: the typed reply must not arrive with the quote doubled.
+    expect(draft().html.match(/On Friday, Ann wrote:/g)).toHaveLength(1);
+  });
+
+  it("goes back to plain text with the prepared quote, not a re-flattened one", () => {
+    // A rich draft answering a plain-text message: the offer runs the other way.
+    act(() => {
+      useCompose.getState().update("d1", { format: "html", html: `<div>Thanks.</div>${QUOTE_HTML}`, formatOffer: "text" });
+    });
+    act(() => root.render(<Composer draft={draft()} />));
+    act(() => button("Switch to plain text").click());
+    act(() => root.render(<Composer draft={draft()} />));
+    expect(draft().format).toBe("text");
+    expect(draft().text).toContain("Thanks.");
+    // The prepared plain-text quote, not HTML run through a converter.
+    expect(draft().text.endsWith(QUOTE_TEXT)).toBe(true);
+    expect(draft().text).not.toContain("<blockquote>");
+  });
+
+  it("dismisses without changing the format", () => {
+    act(() => button("Dismiss").click());
+    act(() => root.render(<Composer draft={draft()} />));
+    expect(draft().format).toBe("text");
+    expect(bar()).toBeNull();
+  });
+});

web/src/views/mail/MailView.tsx

@@ -4,7 +4,6 @@ import { DEFAULT_SORT, useMail, type ListQuery } from "@/store/mail";
 import { appliesTo, comparatorsFor } from "@/lib/listSort";
 import type { Comparator } from "@/jmap/types";
 import { useSettings } from "@/store/settings";
-import { withBase } from "@/lib/basePath";
 import { useCompose } from "@/store/compose";
 import { buildFilter, describeFilter, parseQuery } from "@/lib/search";
 import { keyboard } from "@/lib/input/keyboard";
@@ -17,10 +16,12 @@ import { LabelPicker } from "./LabelPicker";
 import type { Id } from "@/jmap/types";
 import { confirmDialog } from "@/ui/dialog";
 import { toast } from "@/ui/toast";
+import { viewingDelegation } from "@/store/session";
 import { isUnknownMailbox } from "@/lib/mailbox/mailboxRoute";
 import { scheduledMailboxIdFrom, useScheduled } from "@/store/scheduled";
 import { plural, t as translate, tNode } from "@/lib/i18n";
 import { mailboxDisplayName } from "@/lib/mailbox/mailboxName";
+import { brandImage } from "@/lib/brand";
 
 export function MailView({ mailboxId, threadId, search }: { mailboxId?: string; threadId?: string; search?: boolean }) {
   const [, navigate] = useLocation();
@@ -284,15 +285,36 @@ export function MailView({ mailboxId, threadId, search }: { mailboxId?: string;
     [threadId, currentRowIndex, settings.autoAdvance, ids, rowThreadId, openThread, setFocusId],
   );
 
+  /*
+   * inbuxa AL-6: in a locked account handed to the reader, what their level
+   * doesn't allow says so instead of trying. Read changes nothing; organize
+   * moves and flags but never deletes, so Trash and Junk are out of reach.
+   */
+  const refused = (destroys: boolean): boolean => {
+    const delegation = viewingDelegation();
+    if (!delegation) return false;
+    if (delegation.access === "read") {
+      toast.show(translate("This account was handed to you to read. Nothing in it can be changed."));
+      return true;
+    }
+    if (destroys && delegation.access === "organize") {
+      toast.show(translate("You can file and move mail in this account, but not delete it."));
+      return true;
+    }
+    return false;
+  };
+
   const actions = useMemo(
     () => ({
       archive: async (rows?: Id[]) => {
+        if (refused(false)) return;
         const t = await targetIds(rows);
         if (!t.length) return;
         await useMail.getState().archive(t);
         afterAction(true);
       },
       trash: async (rows?: Id[]) => {
+        if (refused(true)) return;
         const t = await targetIds(rows);
         if (!t.length) return;
         const mail = useMail.getState();
@@ -315,6 +337,7 @@ export function MailView({ mailboxId, threadId, search }: { mailboxId?: string;
         afterAction(true);
       },
       spam: async (rows?: Id[]) => {
+        if (refused(true)) return;
         const t = await targetIds(rows);
         if (!t.length) return;
         const mail = useMail.getState();
@@ -324,23 +347,28 @@ export function MailView({ mailboxId, threadId, search }: { mailboxId?: string;
         afterAction(true);
       },
       read: async (read: boolean, rows?: Id[]) => {
+        if (refused(false)) return;
         const t = await targetIds(rows);
         if (t.length) await useMail.getState().markRead(t, read);
         useMail.getState().clearSelection();
       },
       star: async (on: boolean, rows?: Id[]) => {
+        if (refused(false)) return;
         const t = await targetIds(rows);
         if (t.length) await useMail.getState().star(t, on);
       },
       move: async (rows?: Id[]) => {
+        if (refused(false)) return;
         const t = await targetIds(rows);
         if (t.length) setMovePicker({ ids: t });
       },
       label: async (rows: Id[] | undefined, anchor: { x: number; y: number }) => {
+        if (refused(false)) return;
         const t = await targetIds(rows);
         if (t.length) setLabelPicker({ ids: t, anchor });
       },
       moveTo: async (ids: Id[], mailboxId: Id) => {
+        if (refused(false)) return;
         await useMail.getState().move(ids, mailboxId);
         afterAction(true);
       },
@@ -468,7 +496,7 @@ export function MailView({ mailboxId, threadId, search }: { mailboxId?: string;
             <ThreadView key={`${threadId}:${openMessageId ?? ""}`} threadId={threadId} messageId={openMessageId} mailboxId={mailboxId ?? null} onBack={() => openThread(null)} actions={actions} onNavigate={(delta) => { const idx = currentRowIndex; const next = ids[idx + delta]; const t = next ? rowThreadId(next) : undefined; if (t) { setFocusId(next!); openThread(t, settings.conversationMode ? null : next!); } }} hasPrev={currentRowIndex > 0} hasNext={currentRowIndex >= 0 && currentRowIndex < ids.length - 1} />
           ) : (
             <div className="no-thread">
-              <img src={withBase("/img/logo.png")} alt="" />
+              <img src={brandImage("/img/logo.png")} alt="" />
               <div>
                 {list?.total
                   ? settings.conversationMode

web/src/views/mail/MailboxPicker.tsx

@@ -5,6 +5,7 @@ import { Dialog } from "@/ui/dialog";
 import type { Id, Mailbox } from "@/jmap/types";
 import { t } from "@/lib/i18n";
 import { mailboxDisplayPath } from "@/lib/mailbox/mailboxName";
+import { treeOrder } from "@/lib/mailbox/folderOrder";
 
 /**
  * @param need which right a folder has to grant to be worth offering.
@@ -24,10 +25,11 @@ export function MailboxPicker({ title, onClose, onPick, exclude, need = "mayAddI
   const [q, setQ] = useState("");
   const [active, setActive] = useState(0);
   const list = useMemo(() => {
-    const all = Object.values(mailboxes)
+    // The sidebar's order, not A–Z by path: a folder dragged into place has to
+    // be found in the same place here.
+    const all = treeOrder(mailboxes)
       .filter((m) => !exclude?.includes(m.id) && m.myRights[need] && (!allow || allow(m.id)))
-      .map((m) => ({ m, path: mailboxDisplayPath(m, mailboxes), pick: () => onPick(m.id) }))
-      .sort((a, b) => (a.m.role === "inbox" ? -1 : b.m.role === "inbox" ? 1 : a.path.localeCompare(b.path)));
+      .map((m) => ({ m, path: mailboxDisplayPath(m, mailboxes), pick: () => onPick(m.id) }));
     const rows: { m: Mailbox | null; path: string; pick: () => void }[] = root ? [{ m: null, path: root.label, pick: root.onPick }, ...all] : all;
     const ql = q.trim().toLowerCase();
     return ql ? rows.filter((x) => x.path.toLowerCase().includes(ql)) : rows;

web/src/views/mail/MailboxTree.tsx

@@ -18,6 +18,7 @@ import { canPlaceFolder, compareFolders, neighbour, placeFolder, type Placement
 import { haptic, useTouchRow } from "@/lib/input/touch";
 import { plural, t } from "@/lib/i18n";
 import { mailboxDisplayName } from "@/lib/mailbox/mailboxName";
+import { useSession } from "@/store/session";
 
 // Loaded when first opened: it is not needed to show mail, and it is not small.
 const ShareDialog = lazy(() => import("../settings/ShareDialog").then((m) => ({ default: m.ShareDialog })));
@@ -99,7 +100,10 @@ export function MailboxTree() {
       toast.error(t("Could not move “{name}”: {reason}", { name: mailboxDisplayName(mailboxes[id]!), reason: (err as Error).message }));
     }
   };
-  const shown = (m: Mailbox) => showHidden || m.isSubscribed || m.role === "inbox";
+  // inbuxa AL-7: subscriptions are the reader's own, and they have none in a
+  // locked account handed to them, so every folder there shows.
+  const viewingOther = useSession((s) => s.viewing !== null);
+  const shown = (m: Mailbox) => showHidden || viewingOther || m.isSubscribed || m.role === "inbox";
 
   // Tree: in `compareFolders` order at every level (Inbox, then any order the
   // user has dragged into place, then the special folders, then A–Z),
@@ -474,6 +478,7 @@ function FolderRow({ mailbox: m, label, depth, hasChildren, open, hiddenUnread,
 }
 
 function MailboxMenu({ mailbox: m, onClose, onCreateChild, onShare, onMove, onStep, canStep }: { mailbox: Mailbox; onClose: () => void; onCreateChild: () => void; onShare: () => void; onMove: () => void; onStep: (direction: "up" | "down") => void; canStep: (direction: "up" | "down") => boolean }) {
+  const viewingOther = useSession((s) => s.viewing !== null);
   const shared = Object.keys(m.shareWith ?? {}).length > 0;
   const [, navigate] = useLocation();
   const colors = useSettings((s) => s.settings.folderColors);
@@ -542,7 +547,7 @@ function MailboxMenu({ mailbox: m, onClose, onCreateChild, onShare, onMove, onSt
       {/* The way to reorder without a drag: from the keyboard, and on touch. */}
       <MenuItem icon={<ArrowUp size={16} />} label={t("Move up")} onClick={() => onStep("up")} disabled={!canStep("up")} />
       <MenuItem icon={<ArrowDown size={16} />} label={t("Move down")} onClick={() => onStep("down")} disabled={!canStep("down")} />
-      <MenuItem icon={m.isSubscribed ? <EyeOff size={16} /> : <Eye size={16} />} label={m.isSubscribed ? t("Hide from list") : t("Show in list")} onClick={() => void useMail.getState().updateMailbox(m.id, { isSubscribed: !m.isSubscribed })} disabled={m.role === "inbox"} />
+      {!viewingOther && <MenuItem icon={m.isSubscribed ? <EyeOff size={16} /> : <Eye size={16} />} label={m.isSubscribed ? t("Hide from list") : t("Show in list")} onClick={() => void useMail.getState().updateMailbox(m.id, { isSubscribed: !m.isSubscribed })} disabled={m.role === "inbox"} />}
       {/* Sharing a mail folder is withdrawn, not removed: Stalwart accepts and
           stores the share, and it never reaches the other account -- its own
           docs list calendars, address books and files as shareable and not mail

web/src/views/mail/MessageView.tsx

@@ -19,6 +19,7 @@ import { llmOpinion } from "@/lib/llmOpinion";
 import { LlmOpinionBanner, LlmOpinionDetail, llmBannerOpinion } from "./LlmOpinion";
 import { formatFullDate, formatListDate, formatSize } from "@/lib/format";
 import { displayName, domainOf, formatAddress } from "@/lib/address";
+import { remoteImagesAllowed } from "@/lib/mail/remoteImages";
 import { EMAIL_BASE_CSS, TEXT_EMAIL_CSS, hasHtmlAlternative, htmlDeclaresColors, markKeptSurfaces, sanitizeEmailHtml } from "@/lib/text/html";
 import { openableInTab, previewKind } from "@/lib/preview";
 // Loaded when first opened: it is not needed to show mail, and it is not small.
@@ -35,7 +36,7 @@ import type { ListActions } from "./MessageList";
 import { InviteCard } from "./InviteCard";
 import { VCardCard } from "./VCardCard";
 import { AddressList, useAddressMenu } from "./AddressMenu";
-import { useSession } from "@/store/session";
+import { useSession, useViewingDelegation } from "@/store/session";
 import { useScheduled } from "@/store/scheduled";
 import { formatScheduleTime } from "@/lib/schedule";
 import { mdnDecision, refusalText } from "@/lib/mdn";
@@ -120,7 +121,12 @@ export const MessageView = memo(function MessageView({ email: e, expanded, wasUn
   /* Stable, so the body's click handler keeps its identity between renders.
      Passing an inline arrow here is what made the handler change on every
      render in the first place. */
-  const showImages = useCallback(() => setAllowRemote(true), []);
+  const showImages = useCallback(() => {
+    setAllowRemote(true);
+    // Recorded for the composer: a reply quotes this message and must not
+    // fetch what the reader has not agreed to (#410).
+    useMail.getState().showImages(e.id);
+  }, [e.id]);
   const [filterOpen, setFilterOpen] = useState(false);
   const moreMenu = useMenu();
   const [, navigate] = useLocation();
@@ -130,10 +136,12 @@ export const MessageView = memo(function MessageView({ email: e, expanded, wasUn
   const from = e.from?.[0];
   const senderTrusted = settings.trustedImageSenders.includes((from?.email ?? "").toLowerCase());
   const inContacts = useContacts((s) => Boolean(from && s.loaded && s.lookupByEmail(from.email)));
-  const remoteAllowed = allowRemote || settings.imagePolicy === "always" || senderTrusted || (settings.imagePolicy === "contacts" && inContacts);
+  const remoteAllowed = remoteImagesAllowed({ from: from?.email, policy: settings.imagePolicy, trusted: settings.trustedImageSenders, inContacts, shown: allowRemote });
   const imageProxy = useSession((s) => s.session?.ihasmail?.imageProxy ?? true);
   const scheduled = useScheduled((s) => s.pending[e.id]);
   const receipt = useMemo(() => mdnDecision(e), [e]);
+  // inbuxa AL-4: a locked account sends no read receipts, not even by a delegate
+  const lockedInView = useViewingDelegation() !== null;
   const [receiptDone, setReceiptDone] = useState<"sending" | "dismissed" | null>(null);
   const cancelScheduled = useScheduled((s) => s.cancel);
 
@@ -384,7 +392,7 @@ export const MessageView = memo(function MessageView({ email: e, expanded, wasUn
               {receiptRequested && <><dt>{translate("Receipt")}</dt><dd>{receipt.offer ? translate("Requested, to {address}. Never sent automatically.", { address: receipt.to!.email }) : translate(refusalText(receipt.refusal!))}</dd></>}
             </dl>
           )}
-          {receipt.offer && settings.readReceiptPolicy !== "never" && receiptDone !== "dismissed" && (
+          {receipt.offer && settings.readReceiptPolicy !== "never" && receiptDone !== "dismissed" && !lockedInView && (
             <div className="receipt-banner" style={{ margin: "0 16px 8px" }}>
               <CheckCheck size={16} />
               <span className="grow">

web/src/views/mail/ThreadView.tsx

@@ -1,4 +1,5 @@
 import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { useViewingDelegation } from "@/store/session";
 import { AlertOctagon, Archive, ArrowLeft, ChevronDown, ChevronUp, FolderInput, Forward, Mail, MailOpen, MailPlus, MoreVertical, Printer, Reply, ReplyAll, ShieldCheck, Star, Tag, Trash2, Download , Paperclip} from "lucide-react";
 import { useMail } from "@/store/mail";
 import { visibleMessages } from "@/lib/openMessage";
@@ -131,8 +132,11 @@ export function ThreadView({ threadId, mailboxId, onBack, actions, onNavigate, h
   );
 
   // Mark as read after delay
+  // inbuxa AL-6: never in a locked account handed over to read: reading it
+  // changes nothing there, not even $seen
+  const readOnly = useViewingDelegation()?.access === "read";
   useEffect(() => {
-    if (!messages.length) return;
+    if (!messages.length || readOnly) return;
     const unread = messages.filter((e) => !e.keywords.$seen && isExpanded(e)).map((e) => e.id);
     if (!unread.length || settings.markReadDelay < 0) return;
     if (markTimer.current) window.clearTimeout(markTimer.current);
@@ -141,7 +145,7 @@ export function ThreadView({ threadId, mailboxId, onBack, actions, onNavigate, h
       if (markTimer.current) window.clearTimeout(markTimer.current);
     };
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [messages.map((m) => m.id + (m.keywords.$seen ? "1" : "0")).join(","), settings.markReadDelay]);
+  }, [messages.map((m) => m.id + (m.keywords.$seen ? "1" : "0")).join(","), settings.markReadDelay, readOnly]);
 
   /*
    * Open on the first unread message rather than the newest one (#87).
@@ -224,7 +228,23 @@ export function ThreadView({ threadId, mailboxId, onBack, actions, onNavigate, h
   }, [messages, reply]);
 
   const subject = messages[0]?.subject || emails[thread?.emailIds[0] ?? ""]?.subject || "(no subject)";
-  const rowIds = thread ? thread.emailIds.filter((id) => emails[id]) : [];
+  /*
+   * What the toolbar acts on: the messages the pane is showing, not the thread
+   * they belong to.
+   *
+   * With conversation view off, opening a message opens that message -- the
+   * list shows it alone, the pane renders it alone, and the buttons above it
+   * said so, because `anyUnread` and the rest already read `messages`. Only the
+   * ids handed to the action still named the whole thread, so Mark as unread,
+   * Move to, Report spam and Delete quietly took every message in it (#414).
+   *
+   * Same fallback as the pane's: an id naming nothing in this thread means the
+   * whole conversation, so the buttons keep matching what is on screen.
+   */
+  const rowIds = useMemo(() => {
+    const loaded = thread ? thread.emailIds.filter((id) => emails[id]).map((id) => ({ id })) : [];
+    return visibleMessages(loaded, messageId).map((m) => m.id);
+  }, [thread, emails, messageId]);
   const anyUnread = messages.some((e) => !e.keywords.$seen);
   const anyStarred = messages.some((e) => e.keywords.$flagged);
   const inJunk = Boolean(mailboxId && mailboxes[mailboxId]?.role === "junk");

web/src/views/mail/__tests__/move-picker-order.test.tsx

@@ -0,0 +1,62 @@
+import { act } from "react";
+import { createRoot, type Root } from "react-dom/client";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { MailboxPicker } from "../MailboxPicker";
+import { useMail } from "@/store/mail";
+import type { Mailbox, MailboxRole } from "@/jmap/types";
+
+(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true;
+
+/**
+ * The move-to picker (v) lists folders in the sidebar's order (#1 on GitLab).
+ *
+ * It used to sort A–Z by path, so a folder dragged into place in the sidebar
+ * turned up somewhere else here. The ordering has its own tests in
+ * lib/mailbox; these check what the dialog actually shows.
+ */
+
+window.matchMedia = ((q: string) => ({ matches: false, media: q, addEventListener() {}, removeEventListener() {} })) as unknown as typeof window.matchMedia;
+
+const rights = { mayReadItems: true, mayAddItems: true, mayRemoveItems: true, maySetSeen: true, maySetKeywords: true, mayCreateChild: true, mayRename: true, mayDelete: true, maySubmit: true };
+const box = (id: string, name: string, parentId: string | null, role: MailboxRole = null, sortOrder = 0): Mailbox => ({
+  id, name, parentId, role, sortOrder, totalEmails: 0, unreadEmails: 0, totalThreads: 0, unreadThreads: 0, myRights: rights, isSubscribed: true,
+});
+
+/** Ordered by hand in the sidebar: Zeta dragged to the top, Alpha to the bottom. */
+const MAILBOXES = {
+  inbox: box("inbox", "Inbox", null, "inbox", 10),
+  zeta: box("zeta", "Zeta", null, null, 20),
+  sent: box("sent", "Sent", null, "sent", 30),
+  work: box("work", "Work", null, null, 40),
+  clients: box("clients", "Clients", "work"),
+  trash: box("trash", "Deleted Items", null, "trash", 50),
+  alpha: box("alpha", "Alpha", null, null, 60),
+};
+
+describe("the move-to picker", () => {
+  let host: HTMLDivElement;
+  let root: Root;
+  const rows = () => Array.from(document.querySelectorAll('[role="option"]')).map((r) => r.querySelector(".grow")?.textContent);
+
+  function open(props: Partial<Parameters<typeof MailboxPicker>[0]> = {}) {
+    act(() => root.render(<MailboxPicker title="Move to…" onClose={() => {}} onPick={() => {}} {...props} />));
+  }
+
+  beforeEach(() => {
+    useMail.setState({ mailboxes: MAILBOXES, mailboxesLoaded: true });
+    host = document.createElement("div");
+    document.body.appendChild(host);
+    root = createRoot(host);
+  });
+  afterEach(() => { act(() => root.unmount()); host.remove(); });
+
+  it("lists folders in the order they were dragged into, not A–Z", () => {
+    open();
+    expect(rows()).toEqual(["Inbox", "Zeta", "Sent", "Work", "Work / Clients", "Deleted Items", "Alpha"]);
+  });
+
+  it("keeps that order for the folders left after excluding one", () => {
+    open({ exclude: ["work"] });
+    expect(rows()).toEqual(["Inbox", "Zeta", "Sent", "Work / Clients", "Deleted Items", "Alpha"]);
+  });
+});

web/src/views/mail/__tests__/thread-toolbar-scope.test.tsx

@@ -0,0 +1,128 @@
+import { act } from "react";
+import { createRoot, type Root } from "react-dom/client";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { ThreadView } from "../ThreadView";
+import { useMail } from "@/store/mail";
+import type { ListActions } from "../MessageList";
+import type { Email, Id } from "@/jmap/types";
+
+(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true;
+
+/* jsdom has neither of these, and the opening scroll uses both. */
+Element.prototype.scrollIntoView = () => {};
+globalThis.ResizeObserver ??= class { observe() {} unobserve() {} disconnect() {} } as unknown as typeof ResizeObserver;
+
+/* jsdom has no matchMedia, and the toolbar asks whether this is a phone. */
+window.matchMedia = ((q: string) => ({ matches: false, media: q, addEventListener() {}, removeEventListener() {} })) as unknown as typeof window.matchMedia;
+
+/*
+ * Reported from the inbox with conversation view off: marking a message unread
+ * from the list -- hover button, right-click menu -- touched that message, but
+ * the same action from the toolbar above the *opened* message marked every
+ * message in its thread. Move to, Report spam and Delete did it too (#414).
+ *
+ * The toolbar's labels were already right: "Mark as unread" read the messages
+ * on screen. Only the ids it handed the action named the whole thread.
+ */
+
+const msg = (id: Id, subject: string): Email =>
+  ({
+    id, threadId: "t1", subject, mailboxIds: { inbox: true }, keywords: { $seen: true },
+    from: [{ name: "Ann", email: "[email protected]" }], to: [{ name: "Me", email: "[email protected]" }],
+    receivedAt: "2026-09-20T10:00:00Z", size: 10, blobId: "b1", preview: "hi",
+    htmlBody: [], textBody: [{ partId: "1", type: "text/plain" }],
+    bodyValues: { "1": { value: "hi", isEncodingProblem: false, isTruncated: false } },
+    attachments: [],
+  }) as unknown as Email;
+
+const FIRST = msg("m1", "The question");
+const SECOND = msg("m2", "Re: The question");
+
+function stubStore() {
+  useMail.setState({
+    accountId: "a1",
+    threads: { t1: { id: "t1", emailIds: ["m1", "m2"] } } as never,
+    emails: { m1: FIRST, m2: SECOND } as never,
+    fullIds: { m1: true, m2: true } as never,
+    loadingThreads: {} as never,
+    mailboxes: { inbox: { id: "inbox", name: "Inbox", role: "inbox" } } as never,
+    loadThread: (async () => undefined) as never,
+    setOpenThread: (() => undefined) as never,
+    markRead: (async () => undefined) as never,
+    roleId: (() => null) as never,
+  });
+}
+
+describe("what the toolbar above an opened message acts on", () => {
+  let host: HTMLDivElement;
+  let root: Root;
+  let actions: ListActions;
+
+  const show = async (messageId: Id | null) => {
+    await act(async () => {
+      root.render(
+        <ThreadView
+          threadId="t1" mailboxId="inbox" messageId={messageId} actions={actions}
+          onBack={() => undefined} onNavigate={() => undefined} hasPrev={false} hasNext={false}
+        />,
+      );
+    });
+  };
+
+  /** The toolbar buttons carry their shortcut in the title, as the tooltips show. */
+  const press = async (title: string) => {
+    const btn = [...host.querySelectorAll("button")].find((b) => b.title === title);
+    expect(btn, `no toolbar button titled ${title}`).toBeTruthy();
+    await act(async () => btn!.click());
+  };
+
+  beforeEach(() => {
+    stubStore();
+    actions = {
+      archive: vi.fn(async () => undefined), trash: vi.fn(async () => undefined),
+      spam: vi.fn(async () => undefined), read: vi.fn(async () => undefined),
+      star: vi.fn(async () => undefined), move: vi.fn(async () => undefined),
+      label: vi.fn(async () => undefined),
+    } as unknown as ListActions;
+    host = document.createElement("div");
+    document.body.appendChild(host);
+    root = createRoot(host);
+  });
+
+  afterEach(async () => {
+    await act(async () => root.unmount());
+    host.remove();
+  });
+
+  it("marks only the message that is open, not its thread", async () => {
+    await show("m1");
+    await press("Mark as unread");
+    expect(actions.read).toHaveBeenCalledWith(false, ["m1"]);
+  });
+
+  it("moves, reports and deletes only that message too", async () => {
+    await show("m1");
+    await press("Move to (v)");
+    await press("Report spam (!)");
+    await press("Delete (#)");
+    expect(actions.move).toHaveBeenCalledWith(["m1"]);
+    expect(actions.spam).toHaveBeenCalledWith(["m1"]);
+    expect(actions.trash).toHaveBeenCalledWith(["m1"]);
+  });
+
+  it("takes the whole thread when the pane is showing the whole thread", async () => {
+    // Conversation view on: no message singled out, and the toolbar is the
+    // conversation's toolbar. That is the behaviour this must not disturb.
+    await show(null);
+    await press("Mark as unread");
+    expect(actions.read).toHaveBeenCalledWith(false, ["m1", "m2"]);
+  });
+
+  it("falls back to the thread when the open id names nothing in it", async () => {
+    // A link from somebody with conversation view on, or a stale `m` in the
+    // URL. The pane shows the conversation, so the toolbar acts on it.
+    await show("gone");
+    await press("Mark as unread");
+    expect(actions.read).toHaveBeenCalledWith(false, ["m1", "m2"]);
+  });
+});

web/src/views/settings/AboutSettings.tsx

@@ -4,9 +4,9 @@ import { useAppName } from "@/lib/brand";
 import { apiFetch, client } from "@/jmap/client";
 import { APP_VERSION } from "@/lib/version";
 import { DEFAULT_SOURCE_URL } from "@/lib/source";
-import { withBase } from "@/lib/basePath";
 import { t, tNode } from "@/lib/i18n";
 import { InbuxaWordmark } from "@/ui/InbuxaWordmark";
+import { brandImage } from "@/lib/brand";
 
 /** ihasmail-inbuxa: which webmail node answered and which mail node it talks to (server/src/nodes.ts). */
 interface Nodes {
@@ -47,7 +47,7 @@ export function AboutSettings() {
           inbuxa's own, not APP_NAME. */}
       <p className="lead">{tNode("{inbuxa} is a complete mail suite: a mail server, the console that administers it, and this webmail, each its own program, installed together and free under the AGPL.", { inbuxa: <strong className="brand-inbuxa notranslate" translate="no">inbuxa</strong> })}</p>
       <div className="row" style={{ gap: 16, alignItems: "center", marginBottom: 16 }}>
-        <img src={withBase("/img/inbuxa-mark.png")} alt="" width={80} />
+        <img src={brandImage("/img/inbuxa-mark.png")} alt="" width={80} />
         <div>
           <InbuxaWordmark height={26} />
           {/* A product name and a version string: neither is a word to translate. */}

web/src/views/settings/SecuritySettings.tsx

@@ -1,7 +1,7 @@
 import { useCallback, useEffect, useState } from "react";
 import { useAppName } from "@/lib/brand";
 import { Copy, KeyRound, ShieldCheck, Smartphone } from "lucide-react";
-import { apiFetch, ApiError, legacyProtocolsOff } from "@/jmap/client";
+import { apiFetch, ApiError, legacyProtocolsOff, legacyProtocolsPartlyOff } from "@/jmap/client";
 import { useSession } from "@/store/session";
 import { formatFullDate } from "@/lib/format";
 import { toast } from "@/ui/toast";
@@ -89,6 +89,14 @@ export function SecuritySettings() {
           {t("Your organization allows only {app} and JMAP apps, so phone and desktop mail apps can't connect to this account.", { app: appName })}
         </p>
       )}
+      {legacyProtocolsPartlyOff(session, accountId).length > 0 && (
+        // INBUXA: one switch per protocol; mail apps using the rest still work
+        <p className="info-box mb-16">
+          {t("Your organization has turned off {protocols} for mail apps. Mail apps that use it can't connect to this account; others still can.", {
+            protocols: legacyProtocolsPartlyOff(session, accountId).join(", "),
+          })}
+        </p>
+      )}
       {unsupported ? (
         <p className="hint">{t("App passwords are managed by your mail administrator.")}</p>
       ) : (