Committee inboxes can now be kept private per role. Until now, anyone who could open the shared Inbox could read every committee role's messages, which suits groups who treat all committee mail as open but is not acceptable for groups who need to keep some inboxes (for example the Membership Secretary's, which carries personal data) away from the rest of the committee.
Two modes, chosen in Mail Settings under Inbox. Configurable is the default and behaves exactly as before: every committee role-holder can read all role inboxes, but individual inboxes can then be restricted. Private is a hard lock where every member, member administrators included, sees only the inboxes for the roles they hold.
A new Inbox Visibility grid in Committee Settings sets, for each role's inbox, whether it is readable by all committee role-holders, only by specific roles, or only by whoever holds that role. The grid reads both ways: across a row to see who can read an inbox, and down a column to see what a role can read.
Committee Settings is now restricted to member administrators, so an ordinary committee member can no longer change who sees what.
The Inbox toolbar has a new Compose button to start a fresh message in the Email Composer, rather than only being able to reply to a message already received.
At a glance
New Who can read committee mail setting in Mail Settings then Inbox: Configurable (shared across roles, tighten per inbox) or Private (each member sees only their own roles).
New Inbox Visibility grid in Committee Settings to set who can read each role's inbox. It defaults to all committee role-holders, so turning it on locks nobody out until you deliberately tighten a role.
In Private mode nobody, not even a member administrator, can read a role's mail unless they hold that role.
Junk and unmatched ("Other") mail stay member-administrator only. Sent mail follows the same rule as the inbox it belongs to.
Committee Settings is now member-administrator only.
The Inbox toolbar has a new Compose button that opens the Email Composer.
A role's Inbound Forwarding panel and the Mail Settings privacy note both link straight to the Inbox Visibility grid.
Technical changes
InboxPrivacyMode (configurable | private) added to inbox.model, stored on InboxSettingsConfig.privacyMode, defaulting to configurable.
Per-role visibility fields on CommitteeMember: inboxVisibleToAllRoles (treated as visible-to-all when unset) and inboxVisibleToRoleTypes.
All read-side access resolves through the single permittedInboxRoleTypesForMember function in server/lib/inbox/inbox-access.ts. Private returns only the member's assigned roles (plus, for member admins, the general catch-all); Configurable additionally grants visible-to-all roles, roles that name one of the member's roles, and any collaborative connection.
New standalone CommitteeInboxVisibilityComponent renders the resource-centric matrix, bound to committeeConfig.roles and persisted by the existing Committee Settings Save button. The per-role control was removed from the role editor in favour of this grid.
Committee Settings tabs are now query-param addressable (?tab=inbox-visibility), following the Mail Settings tab pattern, so the grid can be linked to directly.
committee-settings route now uses MemberAdminAuthGuard instead of AdminAuthGuard, and the global privacy control renders only for member administrators.
Inbox toolbar Compose button navigates to the Email Composer via openComposer().