Four days after beta.38, and three of these came from @NotRetarded pressing buttons and telling me what he saw.
The interface was claiming a setting it did not have
With something invalid in SMTP_TLS — tls in a compose file, say — no option in the Connections dropdown matched, so the browser showed the first one and the page said STARTTLS while mail was refusing to send. The one person who needed to see the problem was the only one being shown something else. An unknown value now has its own entry, selected, saying it is not valid and that no mail is going out.
A security warning about a password you may not have
One sentence was printed in all six combinations of transport and credentials — including with no TLS at all, where there is no certificate to verify, and with no password set, where there is nothing to expose. An internal relay with no authentication was being told "the password is sent to whatever answers on that address". A warning that does not apply teaches people to skip the next one.
It says what is actually at risk now. And the combination that is genuinely dangerous — SMTP_TLS=none with a user configured, which puts the password on the wire in clear — was not warned about at all before. It is now.
"Send test" answers about now
Pressed while the server was down, it reported a flat failure and then the test message turned up minutes later, because the real send path holds a failed mail for redelivery. The test still runs that path — that is the value of it — but takes back whatever it queued, and says what a real alert would have done: "timed out — a real alert would be held and retried for up to 15 minutes".
Under the surface
No behaviour changed in these two, but both are promises nothing was holding.
A container that fails its healthcheck is rolled back. All three places that read a health outcome and act on it could be disabled without a single one of 194 test procedures noticing — the rollback function was well covered, the decision to call it was not.
And /metrics and /api/status are now checked for what they report rather than that they exist. Eight reverts in those endpoints — deleting a gauge, pinning a count to zero, renaming a JSON key, serving it as text/html — all went unnoticed. For a report-only install the numbers are the whole product, and a gauge silently stuck at zero reads as "nothing needs doing".
Six further promises are recorded as provably unguarded rather than quietly left: the major-version gate, MIN_IMAGE_AGE_DAYS, redaction in the audit log, OOM detection, the retry queue's age limit, and insecure_registries. The list may only get shorter.
196 procedures, 4666 checks, 81 guarded promises.
Still the warning from beta.38: SMTP_TLS has to be ssl, starttls or none. Anything else stops mail working and says so in the log — and, as of this build, in the interface too.