Assembly (L2)

1. Runtime components

The bundled authority server contains: desktop host and window manager, config repository, secret resolver, SQLite store and migrations, provider supervisor and account runtimes, domain service, query/view service, mutation coordinator, event log and event bus, body/blob cache service, UI link registry, the runtime adapter for renderer calls and state streams, and an optional /v1 API adapter for tools, tests, debugging, and migration bridges.

Runtime adapters use the shared wire vocabulary (posthaste-contract-core) and shared mail state types: QueryScope, query-window state, MessageSummaryState, MessageDetailState, ConversationRef, body/attachment tokens, the typed MailOperation vocabulary, MutationSettlementState, and state assertions. The UI adapter must not define parallel mail DTOs unless they are a generated or mechanical projection of the shared types.

2. Bundled package

The production bundle contains the Tauri desktop executable, static renderer assets built from the web app, Rust authority server code and provider drivers, schema migrations and local runtime resources, platform secret-store integration, and optional API/contract artifacts for local inspection. It opens existing local state without posthaste serve or another separately installed authority server.

Production mode loads renderer assets from the application bundle (no hosted web origin; remote mail content only through runtime-owned provider flows). A development build may load renderer assets from a local Vite server, but that server serves JavaScript and static assets only — it is not the mail authority, and a bug that reproduces only because development bypasses the runtime contract is a deployment-mode bug.

3. Startup and shutdown

3.1 Startup sequence

resolve platform paths -> initialize observability -> open config repository
 -> open secret backend -> open SQLite store and run migrations
 -> build authority server handle -> start event bus and account supervisor
 -> register renderer runtime adapter -> open main renderer window

The renderer may show startup progress but must not issue mail reads before the runtime adapter reports readiness. Failure to open required local dependencies (unreadable state directory, failed migration, unavailable required secret backend) is a startup error with a user-visible diagnostic. Account-specific provider failures become account runtime status when possible and do not block the renderer from opening existing local mail state.

3.2 Shutdown

Shutdown stops UI links and account runtimes, flushes durable local state, closes provider connections, and leaves queued provider work recoverable on the next launch. Bundled mode leaves no hidden authority daemon running after exit unless the user explicitly started a separate daemon deployment.

4. Builder inputs and outputs

The authority server builder accepts transport-neutral inputs and returns a handle plus shutdown and status, binding no listener:

RuntimeBuildConfig { configRoot, stateRoot, cacheRoot, bootstrapPath, processSettings, adapterCapabilities }
AuthorityRuntimeBuild { handle, shutdown, runtimeStatus, apiAuthMaterial?, logGuard? }

apiAuthMaterial is optional because a pure in-process adapter may not need bearer-token material; when a loopback or daemon API is enabled the API adapter uses it to protect /v1. The renderer adapter never receives provider secrets.

5. Adapter boundaries and task ownership

The Axum adapter owns HTTP concerns (extraction, auth middleware, host/origin checks, status codes, API error JSON, OpenAPI/AsyncAPI artifacts, CORS, optional static serving). The Tauri adapter owns desktop concerns (command names, event emission, window/link labels, local capability injection, focused-window routing, resource handoff). Neither owns mail-state semantics; when both expose the same operation they call the same handle method or a shared helper below it.

Long-lived runtime tasks are owned by the handle or services reachable from it. The shutdown handle stops account runtimes, closes view subscriptions, drains/persists queued mutation work, flushes stores, closes provider connections, and waits for tasks that must finish before process exit. Hosts may cancel transport tasks after shutdown begins but must not abandon provider mutations the runtime accepted durably.

6. Event and state streams

The event bus is the internal publication channel for state assertions, coarse lifecycle events, account status, sync progress, and mutation settlement. Renderer links consume it through the unified RuntimeFrame stream: view-affecting assertions become view frames, mutation lifecycle changes become MutationSettlement, link-global imperative signals become Notification. /v1/events is not a renderer cache-invalidation channel in the target design; any remaining feed is an API-platform/integration surface with separate auth, audience, and stability rules.

State assertions in durable event history carry authority-server sequence numbers; runtime links use their own RuntimeLinkSeq cursor for reconnects. Variant-specific catch-up happens behind the one link stream: active views collapse to current snapshots, unsettled mutations replay settlement state, and notifications replay only when their source is durable. One ordered stream means a large view snapshot can delay a later notification for that link; mail-list windows are bounded so this is acceptable, and the escape hatch is a transport swap behind the same RuntimeFrame contract, not another renderer push contract.

7. Assertions

ID	Sev.	Assertion
bundled-package-self-contained	MUST	The bundled app package contains the renderer and embedded authority server needed for ordinary local use.
no-external-daemon-required	MUST	Bundled startup does not require posthaste serve or another separately installed authority server.
production-assets-local	MUST	Production bundled mode loads renderer assets from the application bundle rather than a hosted web origin.
startup-builds-runtime-first	MUST	Bundled startup builds the authority server before opening mail views.
runtime-builder-transport-free	MUST	The authority server builder opens config, secrets, store, services, supervisor, event bus, views, mutations, and resources without binding HTTP or depending on Tauri.
runtime-shutdown-handle	MUST	The runtime exposes graceful shutdown that stops account runtimes, subscriptions, queued work, stores, and provider connections.
multi-window-shared-runtime	MUST	Multiple UI links observe the same authority server state through the shared event bus.