The wiki after 6.3.2: the changes page's timeline gains 6.3.2 (published 13 September 2026; the full Windows suite 2,219 tests, 2,211 passed, 0 failed, 8 skipped), the schema section runs to 6038, the landing page's current-release and schema rows say 6.3.2 and 6038, and the footer's date moves.
bdff831
The container page no longer says the base release is the only one the package installs on: Boost is linked statically since 11 September, so the .deb installs on later releases too; the image stays on the release it was built for
d3ba09a
Running in a Container: the image, the variables the entrypoint writes, reaching the API, a Compose first start, volumes and ports, upgrading, backups, auto-ban from the host, and how the image is proven; linked from the sidebar, the index and the Linux page, labelled as published with 6.3.2
03f409d
Auto-ban below the server, documented: the three settings on the capabilities page, and the hook, the capability it needs and fail2ban on the Linux page, labelled unreleased until 6.3.2
1b8ff5c
6.3.1 is the current release, and the installer is Authenticode-signed from it: the footer and the landing page say 6.3.1, and the six pages that said the installer carries no Authenticode signature say what changed on 11 September 2026 and what did not (SmartScreen, and every release before it)
1d76bad
The portal is a webmail since 6.3.0, so the two pages that tell a user what it is say what it gained
The self-service portal was documented at its 6.2.28 scope - a page that
signs in and reads mail. 6.3.0 gave it addresses on the fragment, so a folder,
a message, a search and a half-written draft each survive a reload and can be
linked to; a change probe it polls every six seconds and not at all while the
tab is hidden; folder create, rename and delete under IMAP's own rules and
refused in IMAP's own sentences; and inline images, which it fetches itself and
hands to its sandboxed frame as data: URLs, because the frame's opaque origin
is exactly what stops the session cookie travelling to a subresource request.
Neither page was wrong. Both understated the thing a user is deciding whether
to use.
d8d0b0c
6.3.0 is published, so the pages that were waiting for it say so: Linux is released rather than "in the tree", the write surface has a release number, and the version that never existed is gone
The Linux page opened with a banner saying the port was in the tree and not
yet released, and that the first release to carry packages would be "the next
one". That release is 6.3.0 and it went out on 10 September 2026, so the
banner now points at it and the install commands name the packages that are
actually on the release page rather than a version number nobody can download.
Five places named 6.2.29. There is no such version and there never will be -
the release after 6.2.28 is 6.3.0, and README.md already says why - so the two
package filenames, the two "since 6.2.29" notes about relative directory
values and the Installation paths diagnostic's label all move to 6.3.0.
The API reference's route tables gained the write surface a day before the
release but nothing in them said which release it belonged to, while the rows
around them carried 6.2.27 and 6.2.28. A reader could reasonably have read the
settings, rules and certificate routes as shipping in 6.2.27, which is half
true and the misleading half: those routes could only be read then. Section 4
now says which routes arrived in 6.3.0 and why the method column is the one to
read, and the scope note names the units the write surface was split into.
The landing page's At a glance table was stale in five of its rows: the
release and its build number, the platform (Windows only, when the whole point
of 6.3 is that it is not), the administration surfaces, the suite's size and
the wiki's own page count. The route count was stale in a way worth recording:
it said 65, which matched neither the number of rows in the reference table nor
the number of distinct paths at the commit it was written from, so it is now
82 routes over 68 paths, both countable from the page it points at.
The Control Panel reference said "the latest, v6.2.28", and one thing under
ControlPanel did move in 6.3.0: the sign-in box's user name is a literal again
(#156), which is why a fresh installation in Chinese could not sign in. The
page says so, with the twenty-one files that differ between the tags.
The footer stamped 6.2.28 on all fifty-one pages.
7863009
The Control Deck writes: the API Reference's page section says what the ten views do, how the page signs in for a session instead of keeping the administrator password, and why a 401 no longer opens the browser's own credential box over it
The REST page's session section is named for both browser sessions now, the portal's and the Deck's.
6da57ea
The REST API writes: the route tables on the REST and API Reference pages carry the settings groups, the rules, the routes, the aliases, the account update, the certificates and listeners and the restart in place, with what each refuses and who may call it
The Installing on Linux page's suite row and the Regression Test Environment page's "On Linux" section say what the write surface changed for the Linux run: 278 of 319 pass where 233 did, and what still skips is a COM-only call or the suite's fake DNS zone rather than a route that does not exist.
bb2a37f
The regression suite on Linux: the Installing on Linux page's suite row says what runs (319 of 2,135 tests, 233 passing, 86 skipped for named API gaps, 0 failing, and CI on every push), and the Regression Test Environment page gains an "On Linux" section with the variables, the test-tree recipe and the command
The section is the one hmailserver/docs/RegressionEnvironment.md carries at f18c38a04. A first draft of this page edit had appended an older copy of the whole page around the new section (338 lines became 630); this is the committed page plus the sixty lines of the section, inserted before "When a run is interrupted".
1d7ec4f
Linux: an Installing on Linux page from the packages to a delivered message, the relocation runbook as a page, the Installation paths diagnostic in the Monitoring table, the domain routes on the REST page, and the platform notes the Settings and Capabilities pages needed
2840c7e
The wiki rewritten in depth: 141 diagrams drawn from the code, every reference page made exhaustive, and twenty-one defaults corrected that no page had ever stated
The wiki was accurate after this morning's sweep and thin. This is the depth pass the owner asked for: every page read against the code again, every reference page completed, and a diagram wherever a diagram says it better than a paragraph.
141 Mermaid diagrams across 49 pages, each drawn from the handler rather than from memory: the SMTP submission sequence with the checks in the order ProtocolMAIL_ and ProtocolRCPT_ actually run them, the IMAP session state machine from the per-command authentication guards, the DMARC evaluation, the delivery pipeline and its retry arithmetic, the ACME renewal state machine, the spam decision from connection to delivery, the schema chain, the component and threading models of the whole server, the CI workflows and what each one gates, the release draft-sign-publish flow, and a map of the journeys through the wiki itself on the landing page.
The reference pages are now exhaustive rather than representative: every route with its method, authentication, request and response shape and its error codes; every [Settings] key with its default, its effect and whether it needs a restart; every port with the key that opens it; every rule criterion and action; every Sieve extension the server advertises; every metric the listener exposes.
Twenty-one facts were wrong or absent, and each is corrected against the code rather than adjusted. The ones that will save somebody an afternoon: IMAP SASL PLAIN and SCRAM are not advertised on a default install, which looks exactly like a client bug; SMTP AUTH PLAIN is off by default too; DMARC checking is on while SPF and DKIM as scored tests are off, and the DMARC test evaluates both itself regardless; the seeded DNSBL and SURBL servers are inactive; a new mailbox contains INBOX and nothing else, which is the real cause of the classic missing Sent folder; MTA-STS hosting and autoconfiguration default on while both web-service ports default to 0, so the shipped default is features on with nothing listening; and TLS-RPT and DMARC report sending are inert until their From address is set, with each completed day discarded unsent.
Eleven screenshots are named as wanted, with what each should show. The existing images are from a 6.2.10-era build and the pages say so where it matters.
c025634
Every page read against the tree on 8 September 2026: the release and schema stamps (6.2.27, schema 6031, 2,124 tests), the routes, keys and pages that were missing, the listener paragraphs that were false, and the unreleased work labelled as such
An audit of all 51 pages against master produced about 360 findings on 43 of them, applied here. The largest: the APIs reference lacked 47 routes and described the listeners as single-threaded HTTP/1.0 (they run on the Boost.Asio HTTP/1.1 server); the settings reference lacked the fourteen Update* keys and IMAPCompressionEnabled and counted 195 keys instead of 236; every "current release" stamp said 6.2.24; Changes Since 6.2.10 ended three releases and one schema step early; Architecture said the optional listeners were deliberately not Boost.Asio and built their own SSL contexts (neither is true); the upgrading pages still warned of a silent-upgrade hang fixed in 6.2.23; the Control Panel pages knew nothing of the seventeen languages, the Updates card or the stalled-mail page; and two pages did not render (a header inside a code block, CR and TAB bytes in file names).
Anything in the tree but not in v6.2.27 - the live update, the self-service portal and /api/v1/me, the HttpServer listeners, IMAP COMPRESS=DEFLATE, the seventeen-language Control Panel, the Control Deck views - is documented and marked "in the tree after 6.2.27, not yet released". The Control Panel screenshots are still from a 6.2.10 build and the pages now say so.
cec3055
Regenerated from the fact files after the merges of 6 September (IMAP external accounts, the ACME fix, the code-scanning findings)
7c2d717
Settings, API and Control Panel reference: metric history (schema 6028), Alt-key mnemonics, the envelope Sieve extension
d2a2dab
Settings and Control Panel reference: the authenticated-sender check, Send-As and the outbound pipelining keys
18345d4
Settings reference and regression environment: the suite-wide DNS zone, OutboundPipelining and OutboundChunking
88efb7a
Settings and Control Panel reference: BackupVerifyRestore and ArchiveDomains
55381d7
Control Panel reference: the Diagnosing stalled mail page and the intent-led Welcome page
42ba03f
References regenerated for 5 September 2026: message retention, scrypt, the ClamAV connection test, tarpitting, the server-enforced administrator second factor, and the assertion build; the landing page keeps its new name
7ab27dd
Settings and Control Panel references: the five keys added on 5 September 2026 (special-use folders, MariaDB TLS opt-out, hash work factors), and the migration guide's MySQL row
7c787ef
The hMailServer 6.2.24 wiki: the corrected manual, the runbooks, and the references generated from the code
a590b91