L4 0.2.10

Mail delivery, attachments and deletion recover safely from interrupted requests. Cloudflare update links keep their target in the official installer.

• Unsafe inbound attachments download with a sandboxed response policy and MIME sniffing protection. Only supported passive media can display inline on the Server origin.
• Mail keeps provider delivery receipts separate from RFC Message-IDs and sends valid reply headers. A provider acceptance followed by a failed receipt save stays uncertain; an expired send requires an explicit duplicate-warning confirmation before another copy is sent. Replaying a request does not send it twice.
• Reply defaults to Reply-To or the sender. Reply all includes To and Cc, excludes the mailbox itself, and lets the Member edit the full recipient list before sending. Subjects and display names lose header control characters before any outbound transport. Send, reply and retry share a per-Member mailbox rate limit.
• Incoming mail preserves Spam and Trash; new mail can reopen archived conversations. Email settings show the configured domains and operator setup requirements, distinguish mailbox delivery from authentication email, and show the conversation count before mailbox deletion.
• Mailbox deletion durably queues raw mail and attachment keys before removing database records. Storage failures retain those keys for a later refresh. Message deletion through HTTP and WebSocket immediately revokes downloads, removes attachments from message and Files views, and queues blob cleanup. The migration also queues attachments left on previously deleted messages. Backups remain separate from live file cleanup.
• The Shell no longer interprets Cloudflare update/storage target URLs as requests to open a saved Server. Update continuation links open outside embedded Clients. Verified downloaded backup receipts remain required across installer sessions; an unverified receipt still blocks deployment. On an older embedded Client, open the existing Continue link in a new tab for the first update. The separately reported loss of a verified receipt was not reproduced.
• Native Server Preview builds bind the resources provisioned for that PR and use a shared custom Preview domain with workers.dev disabled. The staging parent returns 404 and has no data bindings; base-domain routing stays disabled.

Validation includes Mail transport and authorization tests, real SQL cleanup/retry checks, HTTP/WebSocket deletion and cache regressions, standalone Docker/celld/RustFS acceptance with a local outbound capture gateway, isolated Server and Shell integration, self-host restore, type/lint/migration checks and Git-built Previews. Live external email-provider delivery and a customer Cloudflare OAuth/update remain separate acceptance gaps.

This release appends migrations 0015 and 0016 within server-v1. Keep a verified pre-update backup. The official web, Shell, installer, standalone Server, portable amd64 runtime and version-pinned Docs share version 0.2.10. Customer Servers remain pinned until their operators complete the backup/update flow. Native iOS/macOS publication remains frozen.