The wiki catches up with the tree after 6.3.3, and one thing the code says that no page said. Section 4e of the changes page is what is on master and in no release at all - checked line by line against the code at 916dec6a1 rather than against the commit messages, which is how three of the draft's claims came to be corrected: the Control Deck speaks twenty languages and the webmail twenty-three, so it is twenty of the webmail's languages rather than "the same twenty"; the server settings page has twenty-nine tabs, not thirty-one; and the Control Panel redesign added thirteen texts to each of the seventeen catalogues, not twenty-six. Everything else in it was verified where it could be: the 592 zone names counted out of the built-in table in ICalendar.cpp, the 501 texts counted in a Deck catalogue and the 631 in a webmail one, the eighteen dialogs counted as the classes deriving from FluentDialogWindow, the two calendar tables read out of Upgrade6040to6041, the schema step read out of DBUpdater's registration and REQUIRED_DB_VERSION, and the four new routes read out of the router rather than out of the OpenAPI prose. The gate numbers are the one thing left blank: the full Windows suite was still running on this exact tree, so the section carries a marked placeholder and section 1's master row says so, because a number invented here is a number somebody quotes.
Schema 6041 is in section 2 as a row of its own, marked as in the tree and in no release, and the two places that said "6040" now say what is where.
The Control Panel pages describe the program as it is now. The redesign of 15 September is in the tree and unreleased, and every paragraph about it says so, because a reader on 6.3.3 opens a window with the old chrome: the command bar with its search, status pill, theme toggle and administrator menu, the sidebar that collapses to a rail below a thousand pixels, the ten scaffold components, and eighteen dialogs sized to their content rather than to a pixel width typed into a constructor. What did not move is what a reader has learned - the navigation map, the page titles, the tab headers, the setting captions, the automation ids - and the pages say that too, which is why Control Panel Pages was not rewritten around it. Three counts were behind and are corrected from the code: 393 settings in the Ctrl+K index rather than 389, 343 captions with an Alt key rather than 340, and 3,403 texts in each catalogue rather than 3,376. Two of the four settings that moved the index shipped in 6.3.2 and the reference had missed them, so the per-page table's auto-ban and web-services rows are re-counted as well.
The settings pages carry the rule adopted on 15 September: a new setting goes in the database, in hm_settings with a Control Panel editor, and no new key is added to hMailServer.ini's [Settings] section. Both pages say the part that matters more than the rule - that nothing already there has moved. The 238 keys are still read from the file, in 6.3.3 and in the tree, and the Settings Reference is still their reference; the migration that flips which store is the truth is a roadmap row, not an event. The file keeps the directories, the database connection and the administrator password and second factor, and anything that genuinely has to be readable before the database opens is an argued-for exception.
The API reference gains what the server publishes and the page did not. Comparing the route table with the OpenAPI document the server emits found seventy-four paths of a hundred and forty-five unnamed, so the administration families are now all there: the six anti-spam collections and the blocked attachments as resources, an account's application passwords, folders, folder permissions and message object, all of which shipped in 6.3.3 and were nowhere on the wiki - and then the four that are in the tree and unreleased, groups with their members, the message copy, the rule-criterion probe and the calendar expansion, each with the body it takes and what it answers. The roughly forty /api/v1/me routes the webmail uses are still families rather than rows, and the page now says so in its own words and points at the OpenAPI document as the authority rather than leaving a reader to think the table is complete.
Stopping Spam was left alone deliberately. The brief said SPF was being replaced this week; at this commit it is not. The evaluator is still the original one with the ten-term limit and the void-lookup cap, nothing under AntiSpam or SMTP/SPF has changed since v6.3.3, and the page describes it correctly - so the honest edit was none.
The finding is on Backup and Restore, and it is the reason this pass was worth running against the code. The built-in backup's XML index is built by each business object's XMLStore. An account's record carries its password, its TOTP secret, its fetch accounts, its application passwords, its rules and its folders. Nothing anywhere writes hm_contacts, hm_accountprefs, hm_scheduled, hm_files, hm_smimekeys, hm_calendars or hm_calendarobjects - no XMLStore reads them - and Message::XMLStore writes Flags but not messagekeywords. So the address book, every webmail preference a user chose, their labels, their second and third stars, their follow-up flags, their scheduled and snoozed mail, their file links, their S/MIME keys and (in the tree) their calendars are in no archive this server writes. Worse than absent: every one of those tables cascades from hm_accounts, and a restore calls Domains::DeleteAll before it puts the backup's domains back, so a restore deletes them. The page now says it, in the short version and in a section of its own, with what to do instead - back the database up with the database server's own tool, and restore from that when recovering a whole server. No page said any of this before.
Monitoring and Health was re-checked rather than rewritten: not one metric family, bucket bound, probe condition, reason string or default has moved since it was verified at 6.2.28, and the only change to MetricsServer.cpp is the Linux accept-loop stop. It gains a section on reading the server from a shell - hmctl status, log list, log tail and backup, with the routes behind them - marked as in the tree and unreleased, since a reader on 6.3.3 has neither client.
Smaller corrections found while checking: the capabilities page's web-services entry predated CardDAV entirely and now carries both DAV protocols, their paths, their HTTPS-only rule and what CalDAV does not do; the installing page has a paragraph on winget and Chocolatey that says plainly they do not work yet, because a first submission is reviewed by a person; What hMailServer Is and Is Not still called 6.3.3 unreleased and said the webmail speaks twenty languages; the Control Panel reference still called 6.3.0 the current release; and the fuzzing page's "iCalendar reached through attachment handling" is now also reached by an authenticated CalDAV PUT, which is a shorter path to a parser that expands attacker-chosen numbers - the COUNT=100000000 defect fixed by hand this week is the argument for the target.