Audit remediation (2026-07-30): build the honestly-incomplete features (outbox remote-mutation executor; production-wire Calendar/Contacts sync) and remove fabrication landmines (delete fake e2ee/ai/plugin + orphaned dup CardDAV + fake credential-less mail paths). Path to the 9/10 zero-fakes bar. Precedes M7 API freeze.
Fail-closed crypto/updater, key zeroization, bind/egress hardening, HTML sanitization. Exit: security review passes; no fail-open path. Roadmap M6.
Freeze nuncio.v1, verify Swift/C#/TS codegen, CLI exercises every RPC in offline E2E, real coverage gate, CI green. Exit: frozen documented contract-tested API; front-end repos may begin. Roadmap M7.
Serial PROTO queue that makes nuncio.v1 freezable: typed errors, timestamps, keyset pagination, opaque ids, AccountConfig oneof, multi-recipient, flags, attachments-by-id, threading ids, Subscribe/Event. Sole .proto editor for the program.
Engine/store behind WS-A shapes: surrogate message-id (C1 fix, first), multi-address, flags, threading, client Move/Copy/Delete, folders, drafts, attachments persist.
Background scheduler + IDLE, reliable resumable push producer, graceful shutdown, per-account/per-item timeouts, single-instance lock, health surface.
SQLCipher whole-DB encryption (spike-gated), signed updates, bounded fetch, reject cleartext Plain, untrusted-content sanitization, token scoping, UDS/named-pipe IPC.
ETag-safe DAV write-back, event/contact CRUD, ListCalendars, recurrence editing, contact groups, scoped/paged Search service. (Invitations/free-busy/photos/dedup staged.)
Clean CLI errors, docs, structured logging, account scoping, GetHealth/Backup RPCs, decompose grpc.rs + DatabaseEngine.