ElyOffice/tasks/reviews/C12.6-r2.md

FAIL

1. crates/ely-mail-engine/src/store/schema.rs:2 — The schema changes overwrite V1 without adding a migration. A database created by the completed C12.3/C12.5 implementation already has user_version = 1, so opening it skips upgrading and leaves synced, role, uidvalidity and missing absent. The independent probe opened the exact HEAD schema successfully, then Store::synced failed with no such column: synced; folder synchronization and message reads likewise reference absent columns. Preserve the existing V1 and append a versioned migration, with a regression that reopens a populated previous-version database and verifies its data and synchronization. Evidence: .work/C12.6-r2-probes.log, probe_an_existing_v1_store_is_upgraded.

2. crates/ely-mail-engine/src/imap/parts.rs:110 — Multipart attachment dispositions are ignored before descending into their children, leaving round 1 defect 5 incompletely fixed. For a recent multipart/mixed message containing an attached multipart/alternative whose child is text/plain, every leaf is classified as body content, Node::complete() returns true, and sync downloads and stores the whole attachment through BODY.PEEK[]. The independent probe cached nested.mime, including its private attachment payload, without a request. Classify an attached multipart as one omitted entity before descending, retain its part number in missing, and cover multipart attachments in the synchronization regression. This matches the existing MIME reader and RFC 2183 §2.9. Evidence: .work/C12.6-r2-probes.log, probe_multipart_attachments_stay_on_demand.

3. crates/ely-mail-engine/src/imap/parts.rs:142 — The attachment check overrides multipart/related semantics and omits inline body content. A recent HTML message with a CID PNG marked Content-Disposition: attachment is valid and is classified as an inline image by the existing MIME reader, but synchronization never requests its payload. The probe completed synchronization with empty image bytes instead of the PNG bytes; the message is then marked body-cached and subsequent default syncs skip it. Apply related-container semantics before disposition checks when selecting body parts, and test related roots and CID images carrying attachment dispositions. RFC 2387 §4 requires ignoring the disposition type within multipart/related. Evidence: .work/C12.6-r2-probes.log, probe_related_images_marked_attachment_are_cached.

4. apps/ely-mail/src/syncing.rs:35 — A TLS initialization failure is discarded instead of appearing as a synchronization failure. If the local store opens but platform TLS initialization returns an error, startup synchronization returns after a generic log message, creates no Syncing entry, and the account view displays neither synchronization status nor the actual failure reason required by §12.3. The GPUI probe injected platform trust store unavailable and confirmed that the account had no failure state. Preserve the original TLS error in the account's synchronization state and render it through the existing failure banner; add startup coverage with failed TLS initialization. Evidence: .work/C12.6-r2-app-probes.log, probe_tls_initialization_failure_is_shown_as_a_sync_failure.