jochen
d14ef647d6
Review round 2 F3 (ADR 0517 §3, 1858/AC5): acted=1 stayed in the address, so a reload, a restored tab or a bookmark of it recorded no page opened or opened. An act's 303 (and a mode chosen) now sets mail_acted for 10 seconds, HttpOnly and SameSite=Strict, Secure but on 127.0.0.1; the next list or pane it reaches records nothing and clears it; the address carries no marker. The local run keeps the browser's other cookies.
mesh-mail-web — the mail page
The mail web client (novox/hq ADR 0440), built from mesh-mail's own source. It claims mail-webclient and serves
the mail page on its internal name, behind Keycloak sign-in. Since design 63 milestone 1 (issue 1859, ADR 0515)
the page opens on the operator's list — today, this week, later, the promises, good to know, read later,
handled today and the scam warnings — from mail reading (mail-reading.list and its acts), with the modes
Work, Personal and Everything (the trusted setting modes) and a reading pane for one mail and its
corrections. The classical list (accounts, folders, search, one mail, write) stays at /all, as All mail. One
script and one stylesheet, /static/app.js and /static/app.css, come from the page's own origin.
The code is the package internal/web; cmd/mesh-mail-web is the module's program, the one its manifest
builds.
The local run: the page on your own machine
cmd/mail-page-dev serves the same page handlers on 127.0.0.1 alone, to click through the page without the
mesh:
cd modules/mesh-mail-web
go run ./cmd/mail-page-dev
and open http://127.0.0.1:8463/. Flags:
-addr 127.0.0.1:8463— where it listens; any address other than 127.0.0.1 is refused.-now 2026-10-22T09:00:00+02:00— fixes "today" (RFC 3339), to see the list on a chosen day.
What is real and what is a stand-in:
- Real: every page, form, template, the script and the stylesheet, the content security policy, the host
check and the form tokens:
internal/webas the module runs it. - Stand-ins, in memory, gone when it stops: the mail — about 25 invented mails in two accounts,
workandpersonal, with design 63's mockup people and firms (Sara Claes, Tim Jacobs, Lena Janssens, the Harbor demo, Hostco, Telco) at.exampleaddresses; mail reading — invented entries with tasks, promises and read later in every section, handled, undone, reminded and corrected by the same rules as mesh-mail-reader; the settingmodes(Work iswork, Personal ispersonal); and sign-in, always signed in as a stand-in operator. - Nothing reaches the mesh: no bus, no database, no Keycloak, no mail server; a send answers an invented id, is waiting once, then says sent, and no mail leaves the machine.
It is not part of the module's build: module.json builds cmd/mesh-mail-web alone.