Canonical origin identity before provider synchronization

RelayDesk now exposes the provider contract used by the unified inbox: provider + account + thread + source identity, deterministic deduplication, authenticated authority for unread reconciliation, strong-identifier-only contact resolution, metadata-first attachment quarantine, and origin-locked reply drafts.

Safety truth: this checkpoint does not claim a new live provider. Gmail, Outlook, Slack, Teams, Telegram, WhatsApp Business and SMS remain blocked until secure authorization and provider-specific integration QA pass. No external message was sent. WordPress/WPWriter remains the deployment surface; Windows and Vercel were not used.

What changed

RelayDesk now groups locally blocked reply drafts by their originating provider and account. Each route shows the related conversation, number of saved replies, and the reason sending is blocked. Users can clear drafts for a single route without touching drafts for other providers.

The portable workspace backup metadata is now versioned as 2.3.6 and includes route-aware drafts while continuing to exclude temporary connector tokens and passwords.

Safety boundary

Matrix preview and RelayDesk Test remain the only reply-ready preview routes. Gmail, IMAP, Outlook, Teams, Slack, Telegram, production WhatsApp and SMS are not claimed as live sending adapters. No real external message was sent in this release.

Mobile

The Draft Queue collapses to one-column, full-width touch controls below the existing mobile breakpoint. This continues the Android/iOS mobile-first web/PWA direction. No native APK/AAB or IPA package was generated because the current WordPress/WPWriter environment does not expose a native mobile build pipeline.

Deployment truth

Deployment surface: WordPress on 4BR.ca through WPWriter only. Windows and Vercel were not changed. No plugin/backend engine code changed, so this release does not require a plugin ZIP.

Connector Capability Matrix + Thread Integrity Audit

Web 2.3.7 separates receive, reply, authentication and implementation status per provider instead of using one ambiguous “supported” label. A new local Thread Integrity Audit checks imported events and blocked drafts using the canonical provider + account + conversation key, reports missing route identity, and flags possible key collisions without modifying messages.

The 2.3.6 Identity Guard and route-aware Draft Queue remain active. Unsupported reply routes are still blocked from external send. Backup metadata is now versioned 2.3.7. Mobile layouts use a horizontally safe capability table and full-width audit control.

Truth: Matrix and RelayDesk Test remain preview/test reply routes; WhatsApp remains a bridge preview; Gmail, IMAP, Outlook, Teams, Slack, Telegram and SMS are not production reply adapters. No real external message was sent. A separate 2.3.7 notes page could not be created because the current WPWriter plan has reached its post-count limit, so this published page carries the synchronized follow-up notes.

Canonical provider identity + Adapter Readiness Gate

Web 2.3.8 adds a local normalization pass for imported events and blocked reply drafts. Clear aliases such as Microsoft 365/Outlook, Google Mail/Gmail, WhatsApp variants and Internet Message Access Protocol (IMAP) are mapped to stable canonical provider names. The original provider label is retained in rawProvider so provenance is not lost.

The new Adapter Readiness Gate reports records checked, canonical provider count, unknown providers, complete provider + account + conversation identities, and how many identities are currently reply-ready. Ambiguous sources remain Unknown and cannot become reply-ready merely because they resemble another provider.

Backup metadata is now versioned 2.3.8 and records the provider-account-conversation-v1 normalization contract. Matrix preview and RelayDesk Test remain the only reply-ready preview routes. No new production provider adapter is claimed, and no real external message was sent. Mobile controls remain full-width below the existing breakpoint.

Attachment metadata contract + read/unread normalization

Web 2.3.9 adds a local Attachment + Sync State Inspector for imported events and blocked drafts. It standardizes attachment references into name, type, size and status fields and normalizes known read/unread values while preserving unknown state rather than guessing.

No attachment binary is uploaded or sent by this preview. Backups now declare attachment-metadata-v1 and read-unread-local-observed-v1 contracts and explicitly exclude attachment binary payloads, connector passwords and temporary tokens.

The inspector is mobile-safe with full-width touch controls below the existing breakpoint. Connector truth is unchanged: Matrix preview and RelayDesk Test remain the only reply-ready preview routes; Gmail, IMAP, Outlook, Teams, Slack, Telegram, production WhatsApp and SMS are not claimed as production sending adapters. No real external message was sent.

Exact identity suggestions with collision guards

Web 2.4.0 adds a local Contact Identity Resolution layer over imported events and blocked drafts. Exact normalized email addresses or phone numbers can produce reviewable identity suggestions. Name-only matches are deliberately not auto-merged, and strong identifiers carrying multiple name variants are flagged for review.

The feature writes only a local identity-resolution-v1 suggestion map and does not mutate feed records, merge people automatically, contact providers, or send messages. Portable backups now include the identity suggestion map while continuing to exclude attachment binaries, connector passwords and temporary tokens.

Mobile controls remain full-width below the existing breakpoint. Connector truth is unchanged: Matrix preview and RelayDesk Test remain the only reply-ready preview routes; Gmail, IMAP, Outlook, Teams, Slack, Telegram, production WhatsApp and SMS are not claimed as production sending adapters. No real external message was sent.

Local normalized search + attention counters

Web 2.4.1 adds a local search and notification-triage layer over imported events and safe blocked drafts. Search spans provider, account, conversation, contact and message text while preserving provider/account/thread identity. Attention counters report only locally observed unread, high-priority and draft state; no provider notification or external sync is claimed.

The feature is read-only over the normalized feed data and does not send, mark read, mutate provider state or contact external services. Portable backup metadata is now versioned 2.4.1 and declares local-normalized-search-v1 and local-attention-triage-v1 contracts alongside the existing routing, attachment, state and identity contracts.

Mobile search controls collapse to full-width touch targets under the existing breakpoint. Connector truth is unchanged: Matrix preview and RelayDesk Test remain the only reply-ready preview routes; Gmail, IMAP, Outlook, Teams, Slack, Telegram, production WhatsApp and SMS are not claimed as production sending adapters. No real external message was sent. Windows and Vercel were not changed.

Adapter-safe message envelope and on-device mobile readiness check

Web 2.4.2 adds a normalized local transport envelope for every imported event and blocked draft. The envelope preserves provider, account, provider thread ID, source message ID, optional reply token and optional sync cursor so future adapters can map receive and reply operations without losing origin identity. Missing fields remain explicit instead of being guessed.

The release also adds a mobile QA check that reports the current viewport, bottom-navigation visibility and undersized navigation touch targets. Backup metadata is now versioned 2.4.2 and declares transport-envelope-v1. Responsive web remains the supported mobile surface; no native Android APK/AAB or iOS IPA was generated because WPWriter/WordPress does not expose a native compilation pipeline.

Connector truth is unchanged: Matrix preview and RelayDesk Test remain the only preview/test reply-ready routes. Gmail, IMAP, Outlook, Teams, Slack, Telegram, production WhatsApp and SMS are not claimed as production sending adapters. No real external message was sent. Windows, Vercel and WPVibe were not used.

Message reference ledger and stricter route identity gate

Web 2.4.3 adds a local message-reference ledger that preserves provider thread ID, source Message-ID, In-Reply-To and References-style metadata where present. The ledger reports message-ID collisions and reply-linked records without rewriting the feed or contacting any provider.

A new reply preflight requires provider, account, provider thread and source-message identity before a route can be considered safe for preview reply handling. This preflight does not enable any new connector: Matrix preview and RelayDesk Test remain the only preview/test reply-ready routes, and unsupported providers remain draft-only.

Mobile CSS now enforces a 44px minimum bottom-navigation touch target and adds overflow protection for message/detail surfaces. Backup metadata is versioned 2.4.3 and declares message-reference-ledger-v1 plus reply-preflight-v1. Responsive web remains the Android/iOS delivery surface; no native APK/AAB or IPA was generated because the current WordPress/WPWriter environment has no native compilation pipeline.

No real external message was sent. Windows, Vercel and WPVibe were not used.

Explicit provider capability truth and deterministic duplicate protection

Web 2.4.4 replaces provider-name inference with a local capability registry that records receive status, reply status, authentication mode and tested state for each known adapter family. A provider cannot become reply-ready simply because its name appears in imported data. Matrix preview and RelayDesk Test remain the only tested preview/test reply routes.

Deduplication now distinguishes strong duplicate identity from review-only similarity. Only provider + account + source-message identity qualifies for deterministic duplicate detection. Records without a strong source message ID can be reported as candidate duplicates, but RelayDesk does not auto-drop them. Reply routing remains locked for untested or blocked providers.

Portable backup metadata is now versioned 2.4.4 and declares provider-capability-registry-v1 plus strong-message-id-dedup-v1. The new capability table is horizontally safe on mobile, with full-width audit controls and the existing 44px mobile touch-target floor retained. Responsive web remains the Android/iOS delivery surface; no native APK/AAB or IPA was generated in the WordPress/WPWriter environment.

No real external message was sent. Gmail, IMAP, Outlook, Teams, Slack, Telegram, production WhatsApp and SMS remain blocked from production reply sending. Windows, Vercel and WPVibe were not used.

Provider/account/thread drift protection before reply handling

Web 2.4.5 adds a local Reply Target Affinity Guard. It compares blocked drafts with observed normalized feed routes and flags provider/account/thread drift, orphan drafts and missing source-message identity before a draft can qualify for preview reply handling.

The guard never reroutes a reply to a different provider or account. Matrix preview and RelayDesk Test remain the only tested preview/test reply routes; Gmail, IMAP, Outlook, Teams, Slack, Telegram, production WhatsApp and SMS remain blocked from production sending. No real external message was sent.

Portable backup metadata is now versioned 2.4.5 and adds reply-target-affinity-v1 while retaining transport, threading, reply-preflight, capability, deduplication, attachment, state, identity, search and triage contracts. Mobile controls remain full-width with the existing 44px touch-target floor. Responsive web remains the Android/iOS delivery surface; no native APK/AAB or IPA was generated. Windows, Vercel and WPVibe were not used.

State provenance and metadata-first attachment handling

Web 2.4.6 adds a local State Sync Provenance + Attachment Manifest audit. Normalized records are inspected for sync cursors or watermarks, observed read/unread state and attachment metadata. RelayDesk now distinguishes locally observed state from provider-authoritative state instead of implying that a local read flag has been synchronized back to Gmail, Outlook, Slack, Teams or another provider.

Attachment handling remains metadata-first. Filename, MIME type, size and provider attachment ID are preserved where available, while binary payloads are never auto-downloaded by this audit. Incomplete attachment metadata is surfaced for review rather than silently guessed.

Portable backup metadata is now versioned 2.4.6 and declares sync-state-contract-v1 plus attachment-manifest-v1. Reply safety is unchanged: Matrix preview and RelayDesk Test remain the only tested preview/test reply routes; Gmail, IMAP, Outlook, Teams, Slack, Telegram, production WhatsApp and SMS remain blocked from production sending. No real external message was sent.

Mobile controls remain full-width with the existing 44px touch-target floor. Responsive web remains the Android/iOS delivery surface; no native Android APK/AAB or iOS IPA was generated because the WordPress/WPWriter-only environment does not expose a native compilation pipeline. Windows, Vercel and WPVibe were not used.

Two-level threading with provider identity preserved

Web 2.4.7 begins the approved Wave A build. RelayDesk now creates a local two-level thread index. Provider-native identity remains authoritative using provider + account + native thread ID, while a conservative person + topic key can surface possible cross-provider conversation groups for review.

The new thread-engine-v2 index never rewrites provider thread IDs, never auto-merges ambiguous conversations and does not enable a provider sender. Portable backups now include the Thread Engine II contract alongside message-reference, reply-preflight, reply-affinity, capability, deduplication, attachment, state, identity, search and triage contracts.

Reply safety is unchanged: Matrix preview and RelayDesk Test remain the only tested preview/test reply routes. Gmail, IMAP, Outlook, Teams, Slack, Telegram, production WhatsApp and SMS remain blocked from production sending. No real external message was sent.

Responsive web remains the current Android/iOS delivery surface with the existing 44px touch-target floor. No native Android APK/AAB or iOS IPA was generated. Windows, Vercel and WPVibe were not used.

Conservative alias resolution with collision guards

Web 2.4.8 advances Wave A with identity-resolution-v2. RelayDesk builds a local identity graph from exact normalized email addresses, phone numbers and provider-scoped handles. Display names become aliases only after a stable identifier exists, so similar names alone never trigger an automatic merge.

The resolver reports stable identities, unresolved records and name-collision warnings. It preserves provider and account provenance on every node and does not mutate provider address books, send messages, or contact external identity services.

Portable backup metadata is now versioned 2.4.8 and carries Identity Resolver II together with Thread Engine II, transport, reply-preflight, reply-affinity, capability, deduplication, attachment, state, search and triage contracts. Reply safety is unchanged: Matrix preview and RelayDesk Test remain the only tested preview/test reply routes; Gmail, IMAP, Outlook, Teams, Slack, Telegram, production WhatsApp and SMS remain blocked from production sending. No real external message was sent.

Responsive web remains the Android/iOS delivery surface with the existing 44px touch-target floor. No native Android APK/AAB or iOS IPA was generated. Windows, Vercel and WPVibe were not used.

Two-tier duplicate detection without destructive merging

Web 2.4.9 advances Wave A with dedup-engine-v2. RelayDesk now treats exact provider + account + source-message identity as the authoritative duplicate key. Similar sender, subject/topic, body and five-minute timing are tracked only as review candidates, preventing legitimate repeated or cross-channel messages from being silently collapsed.

The audit does not delete or merge records. It reports strong duplicates, review candidates and records lacking a strong provider message identifier, while preserving provider/account/thread provenance for later connector work.

Portable backup metadata is now versioned 2.4.9 and carries Dedup Engine II together with Identity Resolver II, Thread Engine II, transport, reply-preflight, reply-affinity, capability, attachment, state, search and triage contracts. Reply safety is unchanged: Matrix preview and RelayDesk Test remain the only tested preview/test reply routes; Gmail, IMAP, Outlook, Teams, Slack, Telegram, production WhatsApp and SMS remain blocked from production sending. No real external message was sent.

Responsive web remains the Android/iOS delivery surface with the existing 44px touch-target floor. No native Android APK/AAB or iOS IPA was generated. Windows, Vercel and WPVibe were not used.

Five roadmap increments shipped as one controlled release

2.4.10 Unread Sync II distinguishes provider-authoritative state, locally observed state and unknown state. Local read/unread changes never imply provider synchronization unless a tested adapter confirms the remote update.

2.4.11 Attachment Center creates metadata manifests preserving provider/account/thread/message identity, provider attachment ID, filename, MIME type and size where available. Attachment binaries are not downloaded automatically.

2.4.12 Notification Engine adds permission-aware local attention state, quiet mode and high-priority/unread counters without claiming external push delivery. 2.4.13 Search II searches local normalized provider, account, person, thread and message fields. 2.4.14 Favorites pins local routes/messages without mutating provider state.

The portable backup contract is now versioned 2.4.14 and includes unread-sync-v2, attachment-center-v1, notification-engine-v1, local-search-v2 and favorites-v1 alongside the prior Thread Engine II, Identity Resolver II, Dedup Engine II and reply-safety contracts.

Reply safety is unchanged: Matrix preview and RelayDesk Test remain the only tested preview/test reply routes. Gmail, IMAP, Outlook, Teams, Slack, Telegram, production WhatsApp and SMS remain blocked from production sending. No real external message was sent.

Responsive web remains the Android/iOS delivery surface with the existing 44px minimum touch target. No native Android APK/AAB or iOS IPA was generated because the WordPress/WPWriter-only surface has no native mobile compilation pipeline. Windows, Vercel and WPVibe were not used.

AI triage safety, guarded replies, account diagnostics and unified inbox contracts

This checkpoint consolidates AI Triage II, AI Draft Guard, Reply Router II, Safe Reply Queue, Account Center, Connector Diagnostics, Unified Inbox Beta, paged local feed performance, modern conversation-view contracts, Contact Workspace and multi-account routing rules.

Triage is a local heuristic only and does not call an external AI service. Draft Guard creates local draft templates, preserves provider/account/thread/source-message affinity and never auto-sends. Reply routing remains blocked for every provider that is not actually implemented and tested; Matrix preview and RelayDesk Test remain the only preview/test reply-capable routes.

Account Center reports only provider/account identities observed in normalized local data. Connector Diagnostics exposes blocked, tested and unknown capability states instead of treating a provider label as proof of authorization. Unified Inbox Beta preserves source provenance across conversation grouping, contact workspace and multi-account views.

The portable backup contract is now versioned 2.5.4. No real external message was sent. Gmail, Outlook, IMAP, Teams, Slack, Telegram, production WhatsApp and SMS remain blocked as production reply adapters until their real API integrations are implemented and tested.

Responsive web remains the Android/iOS delivery surface with the 44px minimum touch-target floor. No Android APK/AAB or iOS IPA was generated in the WordPress/WPWriter-only environment. Windows, Vercel and WPVibe were not used.

Provider-specific sync and reply contracts without unsafe browser OAuth

RelayDesk now carries explicit email integration contracts for Gmail API, Microsoft Graph/Outlook, standards-based IMAP and JMAP Mail. The checkpoint preserves provider message ID, provider thread ID, Internet Message-ID, In-Reply-To, References, account identity and provider-specific synchronization cursors inside a normalized email envelope.

The Gmail design uses OAuth 2.0 with history-based incremental synchronization; Microsoft Graph uses OAuth 2.0 with per-folder message delta synchronization; IMAP tracks UID/UIDVALIDITY and server capabilities with OAuth preferred; JMAP tracks state/changes and EmailSubmission. Reply construction is dry-run only and retains the originating provider/account/thread/source-message route.

This is deliberately an integration-readiness checkpoint, not a claim that Gmail, Outlook, IMAP or JMAP is connected. A WordPress browser page is not used as a token vault. Production enablement remains gated on a server-side OAuth callback, encrypted token storage, provider application registration and provider integration tests.

Local synthetic QA covers normalized RFC 5322 threading metadata and dry-run reply route construction. No Gmail, Graph, SMTP, IMAP or JMAP send operation was executed and no real message was sent. Existing Matrix/RelayDesk Test safety boundaries remain unchanged.

Responsive mobile styles remain synchronized. No Android APK/AAB or iOS IPA was generated because the WordPress/WPWriter-only surface still provides no native compilation pipeline. Windows, Vercel and WPVibe were not used.

PKCE, authorization gates and synthetic Gmail/Graph adapter QA

RelayDesk now includes a connector-authorization safety harness for Gmail and Microsoft Graph/Outlook. The harness models OAuth authorization-code flows with PKCE, state and nonce, exact redirect identity, protected token storage requirements and provider app-registration gates. It explicitly rejects implicit/password-style shortcuts and does not place access or refresh tokens into RelayDesk page storage.

A local Web Crypto test generates one-time PKCE material without persisting the verifier or contacting a provider. The production gate keeps Gmail and Outlook receive/reply status blocked until application registration, protected token storage and provider integration tests are actually complete.

New synthetic Gmail and Graph tests validate normalized ingestion, provider/account/thread/source-message routing, Gmail history or Graph delta cursor preservation, and dry-run reply metadata. Synthetic addresses use the reserved invalid domain, no real credential is used, no external API call is made and no message is sent.

The security model follows current OAuth guidance: authorization code rather than implicit flow, PKCE for browser/public-client authorization, and exact redirect URI handling. Production Gmail/Outlook support is still not claimed.

Responsive mobile presentation remains synchronized with full-width controls under the existing breakpoint. No Android APK/AAB or iOS IPA was generated because the WordPress/WPWriter-only surface still does not provide native compilation. Windows, Vercel and WPVibe were not used.

Unified communications program checkpoint with truthful provider gates

RelayDesk 3.0.0 consolidates the completed Unified Inbox core and email-readiness work with cross-channel provider capability contracts, origin-route reply locking, mobile readiness checks, guarded AI-assist policy and production-hardening diagnostics.

Slack, Teams, Telegram, WhatsApp, SMS, Gmail, Outlook, IMAP and JMAP now appear in one capability registry, but they remain explicitly blocked as live receive/reply providers until credentials, authorization and real integration tests exist. Matrix preview and RelayDesk Test remain the only preview/test routes marked receive/reply-capable. No real external message was sent.

The reply dry-run uses provider + account + thread + source-message identity and verifies that an unsupported provider remains blocked instead of silently falling back to another route. The mobile readiness check reports viewport, bottom-navigation availability and undersized touch targets. PWA installability, service-worker support and native Android/iOS binaries are not claimed in this checkpoint.

Wave E remains guarded: local triage/draft assistance does not auto-send and external private-feed AI is not enabled by default. Wave F adds runtime checks for secure context, Web Crypto, local storage availability and the absence of external send capability or page-stored provider credentials.

Deployment remained WordPress on 4BR.ca through WPWriter only. Windows, Vercel and WPVibe were not used.

Recovery, retry, idempotency and blocked-reply operations

RelayDesk 3.1.0 adds the operational control layer required before real provider rollout. The bundle covers resumable sync-cursor recovery, bounded exponential retry, provider/account/thread/source-derived idempotency keys, a blocked-reply dead-letter queue, safe replay rules and connector runtime-health diagnostics.

Cursor recovery preserves the last confirmed provider cursor and models explicit resume/full-resync decisions rather than silently skipping or rereading state. Retry behavior is capped and route-aware so a retried reply cannot silently change provider, account or conversation. Unsupported reply jobs remain quarantined with their original route identity and are never auto-sent.

Validation is local and synthetic. Connector health checks only browser capabilities the WordPress client can verify, including secure context, Web Crypto and local storage. OAuth authorization, encrypted provider token storage and production external-provider health remain unclaimed because those services are not present in the WordPress page.

No real provider call or external message was made. Gmail, Outlook, IMAP/JMAP, Slack, Teams, Telegram, production WhatsApp and SMS remain blocked until real credentials, provider authorization and integration tests exist. Matrix preview and RelayDesk Test remain preview/test surfaces only.

Responsive Android/iOS web remains the current mobile surface. No Android APK/AAB or iOS IPA was generated. Windows, Vercel and WPVibe were not used.

Unified routing, data integrity, guarded assistance and mobile readiness

RelayDesk 4.9 consolidates the planned application architecture through the 4.x line while preserving the last-known-good WordPress routes. The checkpoint unifies provider capability truth, origin-locked reply routing, strong-ID deduplication, provider-native threading, conservative contact identity, state provenance, attachment metadata, normalized search, local notifications, cursor recovery, idempotency, dead-letter handling and guarded AI drafting/triage.

Production provider support is deliberately not claimed. Gmail, Outlook, IMAP/JMAP, Slack, Teams, Telegram, WhatsApp Business and SMS remain blocked for live receive/reply until real provider authorization, secure token storage and integration QA exist. A provider label cannot enable sending. Synthetic reply QA preserves provider + account + thread + source-message identity and performs no external send.

Mobile work remains responsive-web-first with a 44px touch-target QA floor. Native Android APK/AAB, iOS IPA, PWA manifest/service worker and production push are not claimed because those build/runtime surfaces are not available through this WordPress/WPWriter deployment alone.

No real provider call or user message was made. Windows, Vercel and WPVibe were not used.

Account isolation, conflict handling, attachment safety and AI/mobile guardrails

RelayDesk 5.5 strengthens correctness before live connector rollout. Provider/account identities remain isolated, duplicate source records with conflicting state are surfaced for reconciliation instead of being silently overwritten, and provider-authoritative state remains distinct from locally observed state.

Attachment handling is metadata-first and now includes a quarantine decision for executable/script-like types; binaries are not automatically downloaded or opened. Search/index health audits require stable provider/account/source/thread identity before a record is considered fully indexable. Notification policy remains permission-aware and local until a production push backend exists.

AI assistance remains guarded: drafts require human review, never auto-send, do not receive provider tokens, and do not forward attachment binaries by default. Mobile QA continues to inspect responsive behavior and the 44px touch-target floor while native Android/iOS and PWA installability remain unclaimed.

Gmail, Outlook, IMAP/JMAP, Slack, Teams, Telegram, WhatsApp Business and SMS remain blocked for live receive/reply until real authorization and integration tests pass. No real provider call or user message was made. Windows, Vercel and WPVibe were not used.

Inbox first; release diagnostics removed from the normal product experience

RelayDesk 6.0 changes the direction of the interface rather than adding another visible engineering panel. The accumulated 2.x–5.x wave/diagnostic sections are hidden from the normal workspace and replaced with a simplified RelayDesk product shell focused on Inbox, Unread, Favorites, Drafts and Admin.

The underlying safety contracts remain preserved: provider/account/thread/source identity stays attached to conversations, local drafting remains non-sending, attachment/search/state rules remain available, and production providers are not marked live until their specific adapters are authorized and tested.

This is a WordPress/WPWriter product-first reset. No real external message was sent during the change. The next build should move from the simplified shell into a true message-list/conversation/composer experience and then into authenticated sandbox connectors.

Real inbox interaction model with safe local reply flow

RelayDesk 6.8 replaces the static 6.0 product shell with an interactive three-pane inbox: navigation, conversation list and message thread. It adds local search, unread filtering, favorites, local drafts, mobile bottom navigation and conversation-level route identity.

The composer shows the locked provider/account route for the selected conversation. Safe-send testing never sends externally: RelayDesk Test and Matrix Preview only report a successful local preview, while Gmail and all other production providers remain blocked until authorization and adapter QA exist.

Read/unread state is updated locally when a synthetic conversation is opened. Drafts are stored only in local browser storage for this checkpoint. Search runs only across the normalized local sample feed. No provider API, OAuth token, remote attachment fetch, push notification or external AI call is used.

Responsive behavior now includes a mobile message list, conversation pane and 44px+ navigation/reply controls. Native APK/AAB, iOS IPA and production PWA/push remain unclaimed. Windows, Vercel and WPVibe were not used.

Old brochure route retired; RelayDesk now opens the stronger app directly

The /rd1/ route now redirects into /rd1-app/ so users no longer land on the legacy “One web feed” marketing/demo page. The working app remains the source of truth for inbox, people, actions, connectors and workspace behavior.

The inbox now exposes direct quick actions for Import Messages, Actions, Connect and Workspace, reducing navigation friction on mobile. Existing person/thread grouping, provider visibility, read/unread state, local drafts and reply-route safety are preserved.

No production provider support is newly claimed. Gmail, Outlook, Slack, Teams, Telegram, WhatsApp and SMS remain blocked for live receive/reply until their real authorization and adapter QA are complete. No real external message was sent.

Today in RelayDesk: action-first inbox controls

RelayDesk 8.0 adds a compact command center above the inbox so the main jobs are available immediately: Needs action, Unread, Search, Import and Connect. The stronger app remains the product entry point while the older brochure route stays out of the way.

Existing unified person/thread grouping, provider visibility, local read/unread state, draft handling, action center, workspace import and connector pages are preserved. On mobile, the command actions become a horizontally scrollable 46px-target control row and low-value technical version text is reduced.

Reply routing rules remain unchanged: provider/account/thread/source identity is preserved and live provider sending is blocked unless that adapter has real authorization and integration QA. No real external message was sent.

GitHub release control was recorded in private repository 4br/projects on the dev branch. Main was not updated or merged. Windows, Vercel and WPVibe were not used.

The five jobs that matter most are now visible immediately

RelayDesk 9.0 adds a compact, responsive command strip directly above the inbox for Needs action, Unread, Drafts & tasks, Search and Connect. Existing provider/account/thread/source identity, local drafts, action center, people view, workspace import/export and connector truth remain preserved.

The Search action moves focus to the existing local search box; the other actions reuse the app’s existing filter/view handlers instead of creating duplicate state. No live provider send capability was added. Production Gmail, Outlook, Slack, Teams, Telegram, WhatsApp and SMS remain blocked until their real authorization and adapter QA exist.

The visible app version is synchronized to Web 9.0 / Major Wave 9. The command buttons use 46px minimum height and an auto-fit grid so they remain usable on narrow screens. No new storage key, database schema, plugin/backend engine, native mobile package or external AI call was introduced.

One visible flow from attention to preserved work

RelayDesk 10.0 replaces the previous five-action strip with a clearer conversation workflow: Needs action, New context, Person view, Tasks + drafts, Preserve, and Connector truth. The workspace deliberately reuses the existing inbox filters, People view, Action Center, portable Workspace and Connect surface instead of creating duplicate state or new browser-storage contracts.

The main product marker is now Web 10.0 / Major Wave 10, and the Action Center marker is synchronized. All new controls are native buttons with 48px minimum height and an auto-fit responsive grid. No animation was added, so reduced-motion behavior is unchanged.

No production provider was enabled and no external message was sent. Gmail, Outlook, Slack, Teams, Telegram, production WhatsApp and SMS remain blocked until their real authorization and adapter QA exist. No database/schema, API, authentication, payment, credential, plugin/backend engine, provider-token store, external AI call or new localStorage key was introduced.

Safer identity, reply routing and local-state contracts without fake connector claims

RelayDesk 14.0 strengthens the existing unified inbox around conservative strong-ID deduplication, provider/account/thread/source reply preflight, local unread/favorite/draft provenance, attachment metadata safety, normalized local search, notification-permission awareness and guarded AI-assist policy. Display-name similarity is explicitly insufficient for automatic contact merging.

The runtime audit keeps external sending disabled and records zero real messages sent. Gmail, Outlook, IMAP/JMAP, Slack, Teams, Telegram, WhatsApp Business and SMS remain blocked until provider authorization, secure server-side token handling and provider-specific integration QA exist.

Mobile policy retains a 44px minimum target and raises the current mobile navigation/command controls to 46px where this wave owns them. Native Android APK/AAB, iOS IPA, PWA push/offline runtime and binary checksums remain unclaimed because those build surfaces are not supplied by this WordPress/WPWriter deployment.

GitHub release control was staged on private 4br/projects dev before deployment. WordPress source read-back is required as deployment evidence. Main was not updated or merged. Windows, Vercel and WPVibe were not used.

Persistent normalized feed, deterministic dedup and origin-locked reply preflight

RelayDesk 15.0 adds a browser-local normalized data plane for safe product development before external connectors are authorized. Events normalize to provider, account, thread and source identity; deterministic merge removes duplicate events with the same strong route key; local unread/favorite state records provenance; search operates over the normalized local feed; attachment metadata flags executable/script-like names for quarantine.

A safe reply preflight requires provider + account + thread + source identity and always returns externalSend=false. The included RelayDesk Test QA item is synthetic/local only. No production provider API, OAuth credential, remote attachment, external AI call or real message is used.

Mobile command controls use a 46px minimum height and collapse to a horizontal scroll strip on narrow screens. Native Android/iOS binaries and PWA push/offline runtime remain unclaimed because those build surfaces are not available through this WordPress/WPWriter deployment alone.

Rollback point is Major Wave 14. GitHub release control is recorded on private 4br/projects dev; main remains untouched.

Gmail/Outlook adapter contracts and secure-token policy without pretending OAuth is live

RelayDesk 16.0 introduces explicit Gmail and Outlook sandbox adapter contracts above the Wave 15 local data plane. Each provider remains receive=false, reply=false and tokenStored=false until a real OAuth flow, secure server-side token vault and provider-specific integration QA are available.

The token policy prohibits persistent production tokens in browser local storage, requires PKCE/state validation and least privilege, and records the server vault as not yet implemented. The synchronization contract preserves one cursor per provider/account, strong provider/account/thread/source deduplication, provider-authoritative unread reconciliation after authentication, metadata-first attachments and idempotent ingestion.

Reply preflight still requires provider + account + thread + source and always returns externalSend=false. No OAuth flow, provider API call, remote attachment fetch, external AI call or real message was executed in this wave.

Mobile controls retain 46px minimum targets. Native Android/iOS binaries and production PWA/push remain unclaimed. Rollback point is Wave 15. Windows, Vercel and WPVibe were not used.

Provider-authoritative state rules and origin-locked drafts

Wave 18 consolidates the reconciliation contract: authenticated provider state becomes authoritative for unread/state sync; deduplication remains provider + account + thread + source; contact merging requires strong identifiers rather than display-name similarity; attachment handling remains metadata-first with quarantine policy; reply drafts stay locked to their originating provider/account/thread/source.

Gmail and Outlook remain sandbox contracts only. No live OAuth, provider API call, remote attachment fetch, external AI transmission or real message send is claimed or enabled.

Existing 46px mobile touch targets and responsive inbox navigation are preserved. Native Android/iOS binaries remain unclaimed because this WordPress/WPWriter surface cannot build them. Rollback point is Wave 17. Windows, Vercel and WPVibe were not used.

No adapter can imply receive/reply readiness before authorization and route QA

Wave 19 tightens the provider-readiness contract across the unified feed. Reply drafts require provider + account + thread + source identity; deduplication remains deterministic on those origin fields; provider-authoritative unread reconciliation is permitted only after authenticated sync; contact identity stays strong-identifier-only; attachment retrieval remains metadata-first/quarantined until its provider path is validated.

Gmail and Outlook adapter contracts remain receive/reply blocked until secure server-side token storage, real OAuth authorization and sandbox QA exist. Persistent production tokens in browser storage remain prohibited. Local draft preparation is allowed, but external send remains disabled. No provider call, remote attachment fetch, external AI transmission or real message occurred.

Responsive inbox navigation and the existing 46px minimum touch-target policy are preserved for Android/iOS-oriented web use. No native mobile binary is claimed. Rollback point is Wave 18. Windows, Vercel and WPVibe were not used.