[ryanweiler92]

Collaboration bugs fixed (2026-11-05 and 11-06)

This lists every bug from the 11-05 bug hunt and what was done about it. The IDs match that report.

Severity	Found	Fixed
High	10	10
Medium	40	40
Low	38	37, plus half of L20

Every change is uncommitted, in Semoss and in SemossWeb (packages/collaboration). Every fix has a regression test that fails on the old code.

High

ID	Bug	Fix
H1	Reset could deadlock with a new-mail import, and the hang spread to every user's webhook mail.	The import's check under the ingest lock no longer takes the job lock, which was the lock Reset held.
H2	Every Teams ask was filed as FYI, "Not addressed to you".	A Teams message counts as addressed to the owner.
H3	The text cleaner deleted the ask from short emails.	The sign-off, disclaimer and quoted-reply rules are narrower. A disclaimer now has to sound legal.
H4	A never-ingest sender's email could be read through a reply that quoted it.	A reply that quotes a never-ingest sender is read without its quoted history.
H5	A failed reply-drafts step stopped the whole daily brief.	Drafting is its own step that catches its errors, with caps on how many drafts and how much text.
H6	Agendas and event planning read only the first day or two of the calendar.	Calendar reads follow the next page where the last one ended.
H7	One unusable element failed a topic's Work save on every run. Topic merge and delete left Work candidates on the old topic.	A bad element is skipped alone, and an unknown assignee becomes "unclear". Merge and delete move or clear the candidates' topic.
H8	Mail from the webhook, a chat pull or a thread open went to Work before it was classified.	Those imports no longer queue Work; the next sync classifies first.
H9	Run now and Retry ran the old settings.	Unsaved edits are saved before the run starts.
H10	A Teams attachment's own name decided where its download was written, so it could escape the room folder.	Only the file's base name is used.

Medium

Ingest and sync

ID	Bug	Fix
M5	A routine run or sync already in flight could undo turning off background access.	Saving the Microsoft sign-in back only updates a row that is still there; it never re-creates one.
M7	Anyone with the owner's display name was treated as the owner.	The owner is matched by email address only.
M8	Mail moved out of Junk after the sync window never entered Brain.	Such mail is let in as far back as the onboarding import reached.
M9	Attachment reuse ignored which email was asked for.	A staged copy is reused only for the same email.
M10	One failed changed-mail read silently lost moves and flags, and the stored Graph id went stale.	Only a mailbox that rejects the change filter falls back. Other failures fail the sync, so the window is read again. The new Graph id is stored.
M11	The ingest lock was held across Graph reads, which blocked Send and the shared webhook threads.	Mail and Teams are read before the lock. The lock is held only while writing to the database.
M12	A broken mail subscription wasn't replaced until its recorded expiry.	A 404 on renew, or a sign-in that can't refresh, drops the subscription so a new one is made.

Classifier, people and memory

ID	Bug	Fix
M13	A later confident filing left the old guess as the primary topic, and its question open.	A confident filing replaces Brain's guess and closes the question.
M14	People showed a sender blocked by address as not blocked, and the toggle couldn't unblock them.	Address blocks show, and unblocking removes them too.
M16	The "similar" merge folded different asks that differed by one name or number.	Merges happen only on identical text.
M22	A chat could stay linked to a deleted topic, and then every email sent from it failed.	A stale link no longer blocks sending. A failed link is undone before the email goes.
M23	Memory dedupe treated a one-word correction as the same memory.	Memories merge only on identical text.
M24	The chat review read a handed-over routine room's own prompt as the owner's words.	Routine run messages are skipped.

Work pipeline

ID	Bug	Fix
M15	A cut-off reconcile reply was saved as a plan that turned every candidate into a loose step.	Cut-off replies are refused.
M17	Done claims couldn't close loose steps, because reconcile never saw them.	Reconcile is shown the open loose steps.
M18	Work's read point on a thread moved past messages the extract never read.	It stops just before the first unread message. Late mail moves it back.
M19	A failed extract was retried only when the thread got new mail.	Each sync retries up to 10 threads that are behind. It gives up after three tries spread over at least 6 hours.
M20	One owner's queue held a pool thread until the queue was empty.	One job runs per turn, then the queue goes to the back, so other owners get the threads.
M21	The first Work build ran at most once and could be skipped or cut short silently.	The build records its progress (new WORK_BUILD_JSON column) and runs 25 threads at a time. Syncs finish a cut-off build, also when no Work model was set at first. Owners who already had a build don't get one again.

Routines and automation

ID	Bug	Fix
M1	The startup cleanup also dismissed Work items the owner or the assistant made.	It dismisses only Brain's.
M2	The brief hid colleagues' "Expense review:" threads.	That subject is hidden only when the owner is alone on the thread.
M3	The keep-out for routine results had permanent false positives and missed the timeout note.	Routines mark their mail with an x-semoss-routine header and a "SEMOSS routine" category. Unmarked mail is kept out only under a system routine's dated title, sent to the owner alone.
M4	After Run now, the card could keep showing the old result, with no Running view.	The card checks every 3 seconds, for up to a minute, until the run shows.
M6	A deleted custom routine left its runs and rooms behind, and Reset missed them.	Delete stops the routine and removes its runs, rooms and schedule. Reset sweeps every custom routine.
M25	RunAgent URL-decoded routine commands.	% and + are escaped in routine templates.

Microsoft connectors

ID	Bug	Fix
M26	Any Graph reply containing the text "error" was treated as a failure.	Only a real top-level error object counts.
M27	A mail search with "Unread only" dropped matches and said there were no more.	The search reads further pages, up to five.
M28	Drive files and mail attachments were read fully into memory, with no size check.	Downloads over 100 MB are refused, before fetching where Graph gives a size. Bytes stream to a temporary file. Outlook attachments are read raw instead of as base64.
M29	Events the agent created or edited were in UTC unless the model passed a time zone.	Event tools default to the owner's time zone.

Frontend

ID	Bug	Fix
M30	All-day events showed on the wrong day on Today, at a made-up 7 PM.	All-day events show on their own day, with no time.
M31	Work due dates showed a day early west of UTC, and Today counted tomorrow's items as due today.	Due dates are compared as local calendar days.
M32	Notes added to a topic made this session disappeared after the next refresh.	Notes keep the topic's local id.
M33	Deleting a routine run left its chats in the sidebar.	They are removed with the run.
M34	Making a suggested topic the main one was never saved.	The change is saved.
M35	A Work reorder showed the new order but wasn't saved when the drop missed a row.	Every drop is saved.
M36	Delegation polling stopped for good after one failed first read.	It keeps polling.
M37	In rooms from Outlook, Source attachments → Add always failed for Word, Excel, PowerPoint, .msg and .eml.	The download writes a text copy, using the same extractor Brain uses. A copy already in the chat is accepted.
M38	Replayed attachment errors blocked Save and Send after a reload.	Only new errors block.
M39	The chat box sent Office and mail files raw, so the turn failed after the draft was cleared.	They are converted to text before the turn starts. A failed conversion keeps the draft and shows why.
M40	Leaving setup after the Import step was permanent.	Today sends the owner back to setup until they open Work or press Skip (new SETUP_DONE_AT column). Setup resumes where they stopped. Skip always ends it.

Low

Backend

ID	Bug	Fix
L1	A card marked Done came back after its email was moved.	A re-read of the message a closed card came from is treated as a replay.
L3	Learn my style put back a signature or font the owner had cleared.	A clear is stored so it stays cleared.
L4	A "done" that named a repeated ask was dropped as unmatched.	It closes the step that ask repeats.
L5	Tidy could fold or reword steps the owner made.	It touches only Brain's steps that the owner never edited.
L6	The extract and reconcile prompts used the server's date, with no weekday.	They use the owner's local date and weekday.
L7	Rebuild with "replace old" retired steps and reset threads beyond the build's window.	It stays within the window.
L8	Two replacements of one memory both stayed active, and undoing one revived the original.	One version stays active, and Undo brings back the one just replaced.
L9	Undoing a topic delete or merge failed on H2 when the topic had rules.	Column names are quoted.
L10	Re-applying topic setup un-archived topics the owner had archived.	Kept topics keep their status.
L11	Open "which topic?" questions kept offering a merged or deleted topic.	Merge points them at the target. Delete drops the topic, and closes a question left with none.
L12	The topic setup chat crashed on an empty model reply.	It shows the usual "no usable answer" error.
L13	The startup cleanup left Brain's Work items from routine results in Work, with nothing on them.	Those items are dropped, including ones an earlier cleanup left.
L14	Run now or Retry of the brief wrote a second reply draft for every ask already drafted.	Asks an earlier brief already drafted get no second draft. It checks back up to 10 runs.
L16	A custom routine couldn't be paused once a tool, skill or agent it named became unusable.	Only settings the save changes are checked.
L17	A message that failed for a passing reason, such as a deadlock, was skipped for good.	Only the message's own data errors are skipped. Anything else fails the run, so the mail is read again.
L18	Event-planning sheet names differed between Python, Java and storage.	One naming rule, used everywhere.
L19	History labelled every scheduled custom-routine and event-planning run "Run now".	Scheduled runs are recorded as scheduled, and only Run now as a run by hand. This also lets a scheduled run recover from a run that crashed.
L20	Collaboration couldn't run on SQL Server.	Half done. Run claims now match on SQL Server's DATETIME. The BULK column name, a reserved word in SQL Server, is not fixed (see below).

Microsoft connectors

ID	Bug	Fix
L2	A reply given only cc dropped the person being replied to.	It keeps Outlook's own "to". A reply given only "to" still goes to just them.
L21	Teams channel file lists returned only the first page.	They read every page.
L22	Plain-text Teams messages posted "Q&A" as "Q&A".	Text is escaped only when it is sent as HTML.
L23	Messaging two or more people created a new group chat every time.	A group chat with exactly those members is reused.
L24	Pasted images in Teams messages couldn't be downloaded.	The message's pasted content is listed and can be downloaded.
L25	A reply or forward that failed after its draft was made left a sendable draft behind.	The draft is deleted on failure.

Frontend

ID	Bug	Fix
L15	A routine read answered just before a save could undo the save.	Reads asked for before a save are dropped.
L26	Memory thread links went to a page that doesn't exist.	They open the thread.
L27	Links to threads imported from Sources couldn't open after a reload or from a copied link.	They open the Work thread view, which reads them from their source again.
L28	A refresh asked for while another was running was dropped.	It is queued.
L29	Withdraw said "Withdrawn" for a request that had already been answered.	It says what actually happened.
L30	After a reload, sub-agent cards from earlier turns appeared at the bottom of the chat.	They appear with their turn.
L31	A reconnect during a send erased the message being sent.	A send in progress is left alone.
L32	The run inspector showed UTC times as if they were local.	It shows local times.
L33	A no-break space at the edge of a topic name made a successful apply fail its check.	The server trims names the same way the page does.
L34	Retrying the Outside step after a partial failure created duplicate organizations.	A domain the owner already has reuses its organization, and a retry skips contacts already kept.
L35	After a reload on Topics, "Treat as person" saved colleagues as external.	The owner's address is read from their own record.
L36	Custom routines accepted an 11th tool, which the server rejected, so every autosave then failed.	The limit is 10, and the picker turns off at the limit.
L37	The setup chat marked a "Combine" proposal Done when only its preview had opened.	It's Done only once the topics are combined.
L38	Onboarding people search could show results for an older query.	Results for an older query are dropped.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.