- Shipped
- 14 Agosti 2026, 05:17 UTC
- Author
- kamo
- Commit
- 4d709b1
Opening a message showed the "display external images" banner for a moment and then withdrew it, for anyone who had already chosen to allow images everywhere. The banner's own condition was already careful — it required an authoritative "not allowed" rather than merely the absence of a yes, and its comment named this exact case. What defeated it was the value being handed in. The reading pane paints a cached body first and built that render by spreading the list row, and a list row's remoteImagesAllowed is always false: EmailService's EmailMessage declares it as a primitive boolean and only the full-message endpoints ever assign it, so the list path serialises a default and it reads as a real answer. The guard was checking a field that had been filled in with a lie. The cache-first render no longer inherits it. The flag is cached alongside the body it belongs to instead, so a message that genuinely needs approval shows the prompt in the same frame as its text rather than a beat later, and one that does not never shows it at all. Prefetched bodies carry it too, since a prefetch that dropped it would recreate the not-knowing it exists to prevent. The rule is now a named function with tests. It had been got wrong twice, both times in the same direction, and the failure is invisible in code review — every case except the unknown one behaves identically whether the check is strict or loose. A security prompt that appears on a guess and retracts itself is worse than one that waits, because it teaches people to dismiss it unread.