> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oximail.ch/llms.txt
> Use this file to discover all available pages before exploring further.

# Changelog

> The release model and the notable changes of the current line, with pointers to the pages that document each area in depth.

OxiMail evolves as a continuous line: the current release is **v0.30.0**, and the line receives functional and hardening batches continuously. An upgrade is a binary swap — schema migrations apply themselves at boot, transactionally, with no manual steps ([operations](../operator/operations#upgrades)). The full, per-change changelog is maintained in the server repository and will accompany its public opening; this page summarizes what has landed on the current line, newest first.

## Current line — v0.30 (2026)

**Mid-August**

* **Meet, the first working shape**: real-time calls gain a server surface — a session anchored on a chat room, whose creation reaches every member of that room so a callee learns of the call without a dedicated notification type, plus a transient relay for the WebRTC handshake that is never persisted and never logged. Phase 1 is peer-to-peer with up to three active participants, and membership is a self-expiring heartbeat lease rather than a flag ([Meet](../developer/jmap-meet)).
* **`Email/get` gains its tree**: `bodyStructure` is emitted and recursive, `fetchAllBodyValues` finally reaches every `text/*` leaf — the `text/calendar` part of an invitation included — and attachments carry `partId`, `charset` and `disposition`. Per-part headers are served under `bodyProperties`, the only RFC route to the Content-Type parameters that tell an invitation from an attached `.ics`. **Contract change**: with no `fetch*BodyValues` argument, `bodyValues` now comes back empty as RFC 8621 §4.2 requires, where it used to be populated unconditionally ([the body tree](../developer/jmap-mail#the-body-tree)).
* **Every `/get` closes its vocabulary, and the canon is published**: an unknown property name is `invalidArguments` naming the offenders rather than a silently ignored word, and which properties are selectable — and which are computed per caller — is now emitted in machine form next to the generated types ([the projection canon](../developer/jmap-v2#the-projection-canon)).
* **Shared mailboxes read and write correctly**: the decryption key follows the effective account rather than the caller, so bodies in a shared mailbox open; and a message filed by a grantee is encrypted for the owner, closing the mirror of the same defect ([encryption at rest](../operator/encryption-at-rest)).
* **`Thread/get` and `Thread/changes` return to pure RFC 8621 clients**, served under the `mail` capability where §3 puts them; a client declaring only `core` + `mail` used to be told `unknownCapability` on a mandatory method ([mail](../developer/jmap-mail#behaviours-worth-knowing)).
* **Tenant contact directories**: an organization can publish shared contact sets that reach members as read-only cards in their own address book, with entries maintained by named principals and groups ([contacts](../developer/jmap-contacts#tenant-contact-directories), ADR-133).
* **Post-quantum key exchange is actually negotiated**: X25519MLKEM768 is offered first, with classic X25519 as fallback, on 25, 465, 587, 993 and 443. The feature had been compiled in for months while the installed provider could not implement it, so every session silently fell back ([TLS & ACME](../operator/tls-acme#post-quantum-key-exchange)).
* **Two years of upstream encryption**: SQLCipher 4.5.7 to **4.14.0**, SQLite 3.45.3 to 3.51.3, verified by running `PRAGMA cipher_version` rather than by reading a manifest — the engine's own fixes only reach an encrypted database through a SQLCipher release. The shipped binary is now checked at deploy time to depend on no system crypto, TLS or SQLite library ([the database](../operator/encryption-at-rest#the-database-sqlcipher)).
* **Handshake logs stop crying wolf**: the four TLS listeners separate a peer that hung up before negotiating from a real handshake failure, each branch carrying a stable `reason` field. One production instance was emitting 480 harmless warnings a day from a single monitoring probe — and a real failure would have hidden inside them ([operations](../operator/operations#tls-handshake-logs)).
* **`dkim=fail` says why**: the failure reason reaches the `Authentication-Results` header and the stored per-message result, so a post-mortem can separate an invalid signature from a body altered in transit, a missing key, or a signature dated in the future — which means the server's own clock is behind ([email authentication](../operator/email-auth-security#dkim)).
* **Operability**: `oximail sql` routes by the shape of the statement, so a `WITH … SELECT` returns rows instead of reporting "0 rows affected"; `blobs gc` will not collect an unreferenced blob younger than a 24-hour upload grace window (RFC 8620 §6.1); local rollback snapshots gained a retention policy the deploy path applies; `doctor` judges clock health; and limits that were only announced became limits something enforces ([CLI](../operator/cli#two-behaviours-of-the-maintenance-verbs), [operations](../operator/operations#upgrades)).
* **Time zones**: a tenant's default time zone is readable, inherited and monitored, and a time zone supplied at provisioning now reaches the principal — an invalid one is refused before the first write instead of being accepted and ignored.

**Late July and early August**

* **Federation, first working shape**: the bilateral out-of-band [pairing ceremony](../developer/jmap-sharing) (fingerprint over realm and key, node key per organization), a portable identity root distinct from the disposable working key on the box (rotation is revocation, by monotonic epoch), and the cross-organization grant model — realm-scoped, owner-written, self-expiring, widening the access axis only. Pairing revocation *suspends* access rather than destroying the record; erasure notices are stamped on the identity anchor and fail closed at delivery (ADR-124 to ADR-127).
* **Read receipts, both surfaces.** Mail gains the [RFC 9007 MDN surface](../developer/jmap-mail#read-receipts-mdn) — `MDN/send` composes a receipt as an explicit user gesture, `MDN/parse` finally makes the inbound receipts already linked to your sent mail readable. Chat read receipts now reach every member of a group or channel live instead of only a direct peer, with a per-channel visibility switch and a room-size ceiling on the live fan-out ([chat](../developer/jmap-chat#read-receipts)).
* **Drive version history on the wire**: `FileVersion/query`, `get` and `restore`, with `maxVersionsPerNode` advertised and pruning driven by the same constant ([files](../developer/jmap-files#version-history)).
* **Sync honesty**: a `Foo/changes` cursor older than the 90-day replay window is now **refused** with `cannotCalculateChanges` instead of being told it is synced — one store-level chokepoint every consumer inherits, DAV `sync-collection` included. `/changes` also collapses to one outcome per id per RFC 8620 §5.2, and an empty `/set` batch no longer skips its `ifInState` check ([JMAP Core](../developer/jmap-core#the-replay-window-and-refused-deltas)).
* **Streaming credentials**: SSE streams open with a 60-second [ephemeral ticket](../developer/jmap-core#the-ephemeral-stream-ticket) instead of the session token, so a 24-hour credential no longer travels in a URL that proxies log.
* **Wire shapes corrected where they leaked storage**: chat link previews are typed objects rather than an array of raw byte values; a `message/rfc822` part is advertised as the attachment it is, instead of publishing the encapsulated message's own attachments at the top level; four calendar storage internals left the wire.
* **IMAP**: `FETCH RFC822`, `RFC822.HEADER` and `RFC822.TEXT` returned no payload — and `RFC822` marked the message `\Seen` anyway. Both fixed ([legacy protocols](../operator/legacy-protocols)).
* **Retention and backup integrity**: per-organization backup no longer silently omits attachment blobs or the rows of tables missing from a hand-maintained list, and `verify-backup` can see the difference; the trash that expiring messages sweep into finally has a retention policy behind it; body-part blobs became the derived cache ADR-098 always described, re-derived and hash-verified on a download miss ([operations](../operator/operations)).
* **Operability**: eleven boot-time janitors no longer collide into `sqlite busy` and a lost tick on every start; `doctor` stopped reporting the whole delivery queue as pending; a read-only `spam check` verb asks the filter its current opinion of a stored message; inbound DSN and ARF now raise bounce and complaint events on the ingest path.
* **App-password scopes are enforced** end to end: the scope rides the token and survives refresh, one capability matrix decides, and protocol access derives from the capability set — enforced at JMAP dispatch, IMAP login and DAV (ADR-129).
* **Anti-spam**: RCPT-time greylisting was retired as a defence — botnets retry, sender IP pools break the triple, and it taxed legitimate cold senders. Authentication enforcement and the scored pipeline carry that load (ADR-128, [anti-spam](../operator/anti-spam)).
* **Setup**: the wizard gained a smarthost profile as a third entry, recorded as an audited intent marker rather than a role ([first boot](../first-boot)).
* **Envelope-sender domains**: a platform sending through the MSA can use a technical `MAIL FROM` on a DNS-proven domain — VERP forms included — while the `From:` header stays the human identity. The granted domain must share its organizational domain with an identity of the account, so SPF alignment under relaxed DMARC holds by construction ([bulk sending](../operator/bulk-sending)).

**Early July**

* **Compliance**: per-organization mail [journaling](../operator/compliance) (inbound/outbound, mailbox or external archiver), and account erasure rebuilt as a durable, resumable [phase machine](../operator/compliance) with a reversal buffer, DSAR proof (`oximail erasure prove`), and audit-log retention enforcement.
* **Performance**: a measured load-test campaign roughly **tripled read throughput** (per-connection prepared-statement cache) and **doubled saturated ingest** (composite thread index); single-message ingest lost its fixed latency floor (search commits on quiescence); the WAL is bounded and observable.
* **Delivery correctness**: ingest delta-sync visibility became atomic with the message row; recipient Rules and vacation now run on local-to-local delivery (ADR-117); outbound hops mediate ESMTP extensions (SMTPUTF8/8BITMIME/SIZE) instead of silently bridging; DKIM oversigns From/To/Subject.
* **Client interop wave** (verified against Apple Calendar, Thunderbird, eM Client, Outlook invitations): DAV bootstrap at the server root, CDATA-safe XML, content-hash ETags, real `calendar-query` filters, VTIMEZONE emission, VALARM modelling, `EXPUNGE`-correct IMAP announcements, and an eM Client preconfigured settings endpoint.
* **Auth**: [DPoP v2](../developer/jmap-core#device-bound-tokens-dpop-rfc-9449) — server nonce, per-request resource proofs, and the single-blob media token.

**May – June**

* **Outbound smarthost relay** (ADR-116): relay accounts with DNS-proven domains, one-time enrolment, recipient-per-day quotas with warm-up, ephemeral relay retention, DNSBL self-monitoring ([outbound relay](../operator/outbound-relay)).
* **Security batch**: constant-work app-password verification, SSRF hardening on push and unfurl fetchers, fail-closed shared-account dispatch, submission `From:` header authorization, token at-rest hashing.
* **Spam pipeline overhaul**: Bayes corpus epochs and rebuild, authenticated-only trusted-reply whitelist, disposition spine ([anti-spam](../operator/anti-spam)).
* **Drive and collaboration**: rooted drive with per-viewer stars and server thumbnails, share-link accounting, conversation timeline, chat capacity caps and member-scoped typing.
* **Wire conformance sweep**: the `/query` silent-ignore class eliminated (unknown filters/sorts/arguments are errors), extension capabilities advertised truthfully in `accountCapabilities`.

**April — v0.30.0**

The pre-launch hardening release: the fail-loud discipline swept across every surface, tenant isolation at the storage layer, encryption at rest by default, the two-path SMTP model, the legacy bridges, and the setup wizard as shipped today.

For what is real versus specified, every page of this documentation states the version it describes — the site documents the **v0.30.0 line as deployed**, never planned work presented as shipped.