max / goingson

An outbox, and send-later with it Ruled by Max 2026-08-22 (a3c76a24): "have GoingsOn use an outbox model explicitly and leverage that to make send-later a first class feature." WHAT LED HERE, so the columns are not mistaken for plumbing. send_email is async: it opens an SMTP connection, and commands/email/send.rs has seven .await sites. A described route handler is synchronous, by quasi_router's Decision 6, which exists so egui and a terminal need no runtime. So compose could not be described at all while sending was something a button did. Queueing is a local write, so it can be. And the outbox is not the consolation prize for that constraint: it is a message you can see before it goes and stop, a message you can schedule, and a send that survives being offline instead of failing at the instant somebody pressed the button. Eudora shipped exactly this and named the distinction Send versus Queue, which is the design Max picked for compose the same day. A QUEUED MESSAGE IS A DRAFT THAT HAS BEEN COMMITTED TO SEND, so it stays in `emails` rather than moving to a table of its own. Eudora's Out mailbox is the same idea. save_draft, the drafts list and the compose screen loading one all keep working unchanged, and the outbox is a query rather than a second store to keep in step: is_draft = 1 AND queued_at IS NOT NULL. Migration 069 adds queued_at, send_after, send_attempts and send_error, every one NULL for a message nobody queued, so no backfill is owed. `emails` is per-device and unsynced, which is also the honest behaviour here: two machines draining one outbox would send twice. SEND-LATER IS send_after AND NOTHING ELSE. Compared against the clock on each wake rather than armed as a timer, so a message scheduled while the app was shut goes when the app comes back instead of being missed. THE DRAINER is this app's third tokio interval with a cancel token, after the sync scheduler and the notification pass, and deliberately so: a reader who has read either already knows how this one starts, stops and survives a failing tick. Nothing about it is described. The description says "queue this"; what drains the queue is not a screen and has no address, which is why an outbox answers the async problem rather than moving it. A failed send stamps the error, counts the attempt and leaves the message queued. It backs off on the count, capped, because without a cap a message that failed twenty times is a silent drop wearing a backoff's clothes. A queued draft with no account is stamped rather than retried: the account holds the credentials, so that one can never succeed. open_compose_window is deleted here rather than repaired. It built compose.html?to=.. and the swap deleted compose.html along with the JavaScript that called it, so it was unreachable and broken at once. The second window comes back with the described compose screen (3fb2526a), aimed at an address. Nine tests: queueing, send-later's two halves, taking a message back out, failure not dropping it, a received message refused, one person's outbox, and the backoff curve on its own without a clock or a database.