@bobfrankston/mailx-store 0.1.44 → 0.1.46

package/db.d.ts

@@ -276,7 +276,7 @@ export declare class MailxDB {
      *  legacy columns are frozen at first-sight values. */
     getMessages(query: MessageQuery): PagedResult<MessageEnvelope>;
     /** Unified inbox: all inbox folders across accounts, sorted by date, paginated in SQL */
-    getUnifiedInbox(page?: number, pageSize?: number): PagedResult<MessageEnvelope>;
+    getUnifiedInbox(page?: number, pageSize?: number, flaggedOnly?: boolean): PagedResult<MessageEnvelope>;
     /** Map a `messages` row to a MessageEnvelope. Exposes `uuid` (stable local
      *  identity) and `bodyPath` (authoritative on-disk location) in addition
      *  to the server-binding metadata. */
@@ -375,6 +375,14 @@ export declare class MailxDB {
         uid: number;
         folderId: number;
     }[];
+    /** Rebuild messages_fts if it still has the OLD external-content schema
+     *  (`content=messages`). That schema referenced columns (to_text/cc_text/
+     *  body_text) that don't exist in `messages`, so content-dereferencing
+     *  failed ("no such column: T.to_text") and corrupt/empty-subject rows
+     *  silently never indexed → search missed them (Bob 2026-06-05). One-time
+     *  per DB: drop, recreate standalone, reindex subject/from + derived to/cc.
+     *  body_text backfills as bodies parse. */
+    private migrateFtsSchema;
     /** Record a prefetch failure (0-body fetch / store-write fail) for a UID,
      *  incrementing its backoff count. Persisted so it survives restarts. */
     recordPrefetchFailure(accountId: string, folderId: number, uid: number): void;

package/db.js

@@ -192,9 +192,16 @@ const SCHEMA = `
     CREATE INDEX IF NOT EXISTS idx_contacts_email ON contacts(email);
     CREATE INDEX IF NOT EXISTS idx_contacts_name ON contacts(name);
 
+    -- Standalone FTS5 (NOT external-content). It was declared
+    -- content=messages, but messages has no to_text/cc_text/body_text columns,
+    -- so any operation that dereferenced the "content" failed with
+    -- "no such column: T.to_text" — and corrupt/empty-subject rows never got
+    -- indexed, so search silently missed them (Bob 2026-06-05). Standalone =
+    -- the index stores its own text (we INSERT it explicitly on upsert), so
+    -- there's nothing to dereference and DELETE/INSERT/reindex all work. The
+    -- migrateFtsSchema() pass below rebuilds an existing external-content table.
     CREATE VIRTUAL TABLE IF NOT EXISTS messages_fts USING fts5(
-        subject, from_name, from_address, to_text, cc_text, body_text,
-        content=messages, content_rowid=id
+        subject, from_name, from_address, to_text, cc_text, body_text
     );
 
     CREATE TABLE IF NOT EXISTS sync_actions (
@@ -403,6 +410,27 @@ export class MailxDB {
         this.db.exec("PRAGMA journal_mode = WAL");
         this.db.exec("PRAGMA foreign_keys = ON");
         this.db.exec(SCHEMA);
+        this.migrateFtsSchema();
+        // Purge phantom uid=0 rows (invalid IMAP UID — empty stub letters, the
+        // upsertMessage guard now prevents new ones; this clears any already on
+        // disk, e.g. Bob's 00:03 INBOX phantom). Cascade to FTS + membership.
+        try {
+            const ph = this.db.prepare("SELECT id FROM messages WHERE uid = 0").all();
+            if (ph.length) {
+                for (const r of ph) {
+                    try {
+                        this.db.prepare("DELETE FROM messages_fts WHERE rowid = ?").run(r.id);
+                    }
+                    catch { /* */ }
+                    this.db.prepare("DELETE FROM message_folders WHERE message_row_id = ?").run(r.id);
+                }
+                this.db.prepare("DELETE FROM messages WHERE uid = 0").run();
+                console.log(`  [db] purged ${ph.length} phantom uid=0 row(s)`);
+            }
+        }
+        catch (e) {
+            console.error(`  [db] phantom purge failed: ${e?.message || e}`);
+        }
         // Idempotent migrations for older databases that predate new columns.
         // SQLite doesn't support "ADD COLUMN IF NOT EXISTS", so we just try the
         // ALTER and catch the "duplicate column" error. Simpler and more robust
@@ -1457,6 +1485,17 @@ export class MailxDB {
         // whole `name <addr>` into the mailbox local-part as one encoded
         // word (`=?utf-8?q?...=3C...=40...=3E?=@host`). Decoding it at least
         // renders readable text instead of raw `=3C`/`=C3=A9` gibberish.
+        // Reject invalid UIDs CENTRALLY. Valid IMAP UIDs are >= 1; Gmail uses
+        // large positive hash UIDs; -recover uses NEGATIVE uids deliberately.
+        // A uid of exactly 0 means a FETCH/APPENDUID response arrived with no
+        // parseable UID — inserting it creates a phantom empty INBOX row (no
+        // message_id/subject/body — Bob's 00:03 "blank line"). A uid<=0 guard
+        // already existed on ONE insert path (mailx-imap), but the phantom kept
+        // recurring because OTHER paths (qresync new-message fetch, etc.)
+        // bypassed it. Guarding at the storage seam covers all of them.
+        if (msg.uid === 0 || !Number.isFinite(msg.uid)) {
+            return -1;
+        }
         msg.subject = decodeHeaderWords(msg.subject);
         if (msg.from)
             msg.from = { name: decodeHeaderWords(msg.from.name || ""), address: decodeHeaderWords(msg.from.address || "") };
@@ -1464,7 +1503,7 @@ export class MailxDB {
             msg.to = msg.to.map(a => ({ name: decodeHeaderWords(a.name || ""), address: decodeHeaderWords(a.address || "") }));
         if (msg.cc)
             msg.cc = msg.cc.map(a => ({ name: decodeHeaderWords(a.name || ""), address: decodeHeaderWords(a.address || "") }));
-        const existing = this.db.prepare("SELECT id, provider_id FROM messages WHERE account_id = ? AND folder_id = ? AND uid = ?").get(msg.accountId, msg.folderId, msg.uid);
+        const existing = this.db.prepare("SELECT id, provider_id, message_id FROM messages WHERE account_id = ? AND folder_id = ? AND uid = ?").get(msg.accountId, msg.folderId, msg.uid);
         if (existing) {
             // Backfill provider_id on existing rows that predate this column —
             // critical for body fetch to bypass listMessageIds pagination.
@@ -1505,6 +1544,27 @@ export class MailxDB {
                     WHERE id = ?
                 `).run(flagsToWrite, Date.now(), existing.id);
             }
+            // SELF-HEAL corrupt rows. An empty message_id is the tell: a
+            // partial fetch (no ENVELOPE) created the row with no Message-ID and
+            // a fallback (today) date — which breaks dedup (empty mid = its own
+            // bucket → zombie duplicate) and shows the wrong date (Bob 2026-06-05,
+            // the Oct-2025 "Greeking Out" letter resurfacing). The old update
+            // path only touched flags/body, so such a row never healed even when
+            // a later fetch carried the real envelope. Backfill mid + date +
+            // subject HERE, but only when the existing mid is empty AND the
+            // incoming msg actually has one — never clobber a good value.
+            if (msg.messageId && (!existing.message_id || existing.message_id === "")) {
+                this.db.prepare("UPDATE messages SET message_id = ?, date = ?, subject = ? WHERE id = ?").run(msg.messageId, msg.date || Date.now(), msg.subject || "", existing.id);
+                // The row was indexed with an empty subject (it had no envelope),
+                // so search missed it. Re-index now that we have the real subject
+                // + from/to. Standalone FTS5 → delete + insert. body_text
+                // backfills when the body parses.
+                try {
+                    this.db.prepare("DELETE FROM messages_fts WHERE rowid = ?").run(existing.id);
+                    this.db.prepare("INSERT INTO messages_fts (rowid, subject, from_name, from_address, to_text, cc_text, body_text) VALUES (?, ?, ?, ?, ?, ?, '')").run(existing.id, msg.subject || "", msg.from?.name || "", msg.from?.address || "", (msg.to || []).map(a => `${a.name || ""} ${a.address || ""}`).join(" "), (msg.cc || []).map(a => `${a.name || ""} ${a.address || ""}`).join(" "));
+                }
+                catch { /* best-effort */ }
+            }
             // Refresh membership last_seen_at — server confirmed this UID
             // is still in this folder. No-op if migration already populated
             // it; defensive INSERT-OR-UPDATE handles the race where the row
@@ -1683,7 +1743,12 @@ export class MailxDB {
                 EXISTS(
                     SELECT 1 FROM sync_actions sa
                     WHERE sa.account_id = m.account_id AND sa.uid = r.mf_uid
-                ) AS pending
+                ) AS pending,
+                -- Replied state OR'd across the Message-ID group (see
+                -- getUnifiedInbox) so the reply arrow is correct regardless of
+                -- which duplicate survives dedup. Bob 2026-06-01.
+                COALESCE((SELECT MAX(CASE WHEN m3.is_replied = 1 OR m3.flags_json LIKE '%Answered%' THEN 1 ELSE 0 END)
+                          FROM messages m3 WHERE m3.message_id = m.message_id AND COALESCE(m.message_id, '') != ''), m.is_replied) AS groupReplied
             FROM ranked r
             JOIN messages m ON m.id = r.m_id
             WHERE r.rn = 1
@@ -1706,7 +1771,7 @@ export class MailxDB {
             flags: JSON.parse(r.flags_json),
             size: r.size,
             hasAttachments: !!r.has_attachments,
-            isReplied: !!r.is_replied,
+            isReplied: !!r.groupReplied,
             preview: r.preview,
             bodyPath: r.body_path || "",
             pending: !!r.pending,
@@ -1714,7 +1779,7 @@ export class MailxDB {
         return { items, total, page, pageSize };
     }
     /** Unified inbox: all inbox folders across accounts, sorted by date, paginated in SQL */
-    getUnifiedInbox(page = 1, pageSize = 50) {
+    getUnifiedInbox(page = 1, pageSize = 50, flaggedOnly = false) {
         const offset = (page - 1) * pageSize;
         // Find all inbox folder IDs
         const inboxRows = this.db.prepare("SELECT id FROM folders WHERE special_use = 'inbox'").all();
@@ -1722,6 +1787,13 @@ export class MailxDB {
             return { items: [], total: 0, page, pageSize };
         const placeholders = inboxRows.map(() => "?").join(",");
         const folderIds = inboxRows.map((r) => r.id);
+        // Flagged-only filter must apply at the DB level, not just via the
+        // client's CSS `.flagged-only` rule. The unified list is paginated
+        // (50/page); a CSS-only filter would only hide non-flagged rows in
+        // the loaded page, so flagged messages deeper in the mailbox never
+        // appear and the ★ filter looks broken (Bob 2026-06-05). Same
+        // predicate as getMessages (line ~1876).
+        const flagFilter = flaggedOnly ? " AND m.flags_json LIKE '%\\\\Flagged%'" : "";
         // Dedup by Message-ID. When a sender includes multiple of the
         // user's own addresses on the recipient line (mailx@bob.ma +
         // bobf2@bobf.frankston.com), the local mail server delivers ONE
@@ -1735,7 +1807,7 @@ export class MailxDB {
                 SELECT 1
                 FROM messages m
                 JOIN message_folders mf ON mf.message_row_id = m.id
-                WHERE mf.folder_id IN (${placeholders})
+                WHERE mf.folder_id IN (${placeholders})${flagFilter}
                 GROUP BY CASE WHEN COALESCE(m.message_id, '') = '' THEN 'mid-empty:' || m.id ELSE m.message_id END
             )`).get(...folderIds).cnt;
         const rows = this.db.prepare(`WITH ranked AS (
@@ -1746,7 +1818,7 @@ export class MailxDB {
                     ) AS rn
                 FROM messages m
                 JOIN message_folders mf ON mf.message_row_id = m.id
-                WHERE mf.folder_id IN (${placeholders})
+                WHERE mf.folder_id IN (${placeholders})${flagFilter}
             )
             SELECT m.*, r.mf_uid AS uid, r.mf_folder_id AS folder_id,
                 EXISTS(
@@ -1754,7 +1826,16 @@ export class MailxDB {
                     WHERE sa.account_id = m.account_id AND sa.uid = r.mf_uid
                 ) AS pending,
                 (SELECT COUNT(DISTINCT account_id) FROM messages m2
-                 WHERE m2.message_id = m.message_id AND COALESCE(m.message_id, '') != '') AS dupeCount
+                 WHERE m2.message_id = m.message_id AND COALESCE(m.message_id, '') != '') AS dupeCount,
+                -- Replied state aggregated across the whole Message-ID group, not
+                -- just the dedup survivor. When duplicates collapse (same message
+                -- delivered to multiple self-addresses), the \Answered flag /
+                -- is_replied can live on a NON-surviving copy — so the survivor
+                -- showed no reply arrow even though TB did. OR it across the group
+                -- so the marker is correct regardless of which row wins dedup
+                -- (Bob 2026-06-01). Empty message_id → falls back to the row's own.
+                COALESCE((SELECT MAX(CASE WHEN m3.is_replied = 1 OR m3.flags_json LIKE '%Answered%' THEN 1 ELSE 0 END)
+                          FROM messages m3 WHERE m3.message_id = m.message_id AND COALESCE(m.message_id, '') != ''), m.is_replied) AS groupReplied
             FROM ranked r
             JOIN messages m ON m.id = r.m_id
             WHERE r.rn = 1
@@ -1776,7 +1857,7 @@ export class MailxDB {
             flags: JSON.parse(r.flags_json),
             size: r.size,
             hasAttachments: !!r.has_attachments,
-            isReplied: !!r.is_replied,
+            isReplied: !!r.groupReplied,
             preview: r.preview,
             bodyPath: r.body_path || "",
             pending: !!r.pending,
@@ -2034,6 +2115,50 @@ export class MailxDB {
             : "";
         return this.db.prepare(`SELECT uid, folder_id as folderId FROM messages WHERE account_id = ? AND (body_path IS NULL OR body_path = '')${exclusion} ORDER BY (size IS NULL OR size = 0), size ASC, date DESC LIMIT ?`).all(accountId, ...excludeFolderIds, limit);
     }
+    /** Rebuild messages_fts if it still has the OLD external-content schema
+     *  (`content=messages`). That schema referenced columns (to_text/cc_text/
+     *  body_text) that don't exist in `messages`, so content-dereferencing
+     *  failed ("no such column: T.to_text") and corrupt/empty-subject rows
+     *  silently never indexed → search missed them (Bob 2026-06-05). One-time
+     *  per DB: drop, recreate standalone, reindex subject/from + derived to/cc.
+     *  body_text backfills as bodies parse. */
+    migrateFtsSchema() {
+        try {
+            const row = this.db.prepare("SELECT sql FROM sqlite_master WHERE type='table' AND name='messages_fts'").get();
+            if (!row || !/content\s*=\s*messages/i.test(row.sql))
+                return; // already standalone
+            console.log("  [db] messages_fts had broken external-content schema — rebuilding standalone + reindexing");
+            this.db.exec("DROP TABLE IF EXISTS messages_fts");
+            this.db.exec("CREATE VIRTUAL TABLE messages_fts USING fts5(subject, from_name, from_address, to_text, cc_text, body_text)");
+            const addrText = (j) => {
+                try {
+                    return JSON.parse(j || "[]").map(a => `${a.name || ""} ${a.address || ""}`).join(" ");
+                }
+                catch {
+                    return "";
+                }
+            };
+            const rows = this.db.prepare("SELECT id, subject, from_name, from_address, to_json, cc_json FROM messages").all();
+            const ins = this.db.prepare("INSERT INTO messages_fts (rowid, subject, from_name, from_address, to_text, cc_text, body_text) VALUES (?, ?, ?, ?, ?, ?, '')");
+            this.db.exec("BEGIN");
+            try {
+                for (const r of rows)
+                    ins.run(r.id, r.subject || "", r.from_name || "", r.from_address || "", addrText(r.to_json), addrText(r.cc_json));
+                this.db.exec("COMMIT");
+            }
+            catch (e) {
+                try {
+                    this.db.exec("ROLLBACK");
+                }
+                catch { /* */ }
+                throw e;
+            }
+            console.log(`  [db] messages_fts rebuilt + reindexed ${rows.length} messages`);
+        }
+        catch (e) {
+            console.error(`  [db] migrateFtsSchema failed: ${e?.message || e}`);
+        }
+    }
     /** Record a prefetch failure (0-body fetch / store-write fail) for a UID,
      *  incrementing its backoff count. Persisted so it survives restarts. */
     recordPrefetchFailure(accountId, folderId, uid) {
@@ -2772,7 +2897,15 @@ export class MailxDB {
     searchMessages(query, page = 1, pageSize = 50, accountId, folderId, includeTrashSpam = false) {
         query = (query || "").trim();
         // Parse qualifiers (C45: extended set — date:, has:, is:, folder:).
-        let ftsQuery = "";
+        // Fragments accumulate here, then join with EXPLICIT `AND` between two
+        // value fragments. FTS5 treats a parenthesised group followed by an
+        // implicit-AND term as a syntax error — `(a OR b) c` throws "syntax
+        // error near c" and the whole search silently returns nothing. That
+        // killed every `from:X Y` / `to:X Y` / `a|b c` query (Bob 2026-06-08:
+        // `from:Google Voice` found nothing). Explicit `AND` is accepted; an
+        // `op:true` fragment is a user-typed AND/OR/NOT operator, which already
+        // supplies its own glue so we don't insert another `AND` around it.
+        const frags = [];
         const parts = query.match(/(?:[^\s"]+|"[^"]*")+/g) || [];
         // Extra SQL where-clauses for qualifiers that don't map to FTS columns.
         const extraWhere = [];
@@ -2819,19 +2952,21 @@ export class MailxDB {
             const isMatch = part.match(/^is:(.+)$/i);
             const folderMatch = part.match(/^folder:(.+)$/i);
             if (fromMatch) {
+                // FTS5 column-group `{c1 c2}:term` matches term in either
+                // column without the parens that break a trailing implicit-AND.
                 const term = ftsClean(fromMatch[1]);
                 if (term)
-                    ftsQuery += `(from_name:${term}* OR from_address:${term}*) `;
+                    frags.push({ s: `{from_name from_address}:${term}*`, op: false });
             }
             else if (toMatch) {
                 const term = ftsClean(toMatch[1]);
                 if (term)
-                    ftsQuery += `(to_text:${term}* OR cc_text:${term}*) `;
+                    frags.push({ s: `{to_text cc_text}:${term}*`, op: false });
             }
             else if (subjectMatch) {
                 const term = ftsClean(subjectMatch[1]);
                 if (term)
-                    ftsQuery += `subject:${term}* `;
+                    frags.push({ s: `subject:${term}*`, op: false });
             }
             else if (dateMatch || afterMatch || beforeMatch) {
                 const op = dateMatch ? (dateMatch[1] || "=") : (afterMatch ? ">" : "<");
@@ -2882,7 +3017,7 @@ export class MailxDB {
                 // `hoddie* AND* git*`, which FTS5 reads as three required terms
                 // (one of them being any word starting with "AND") — so a real
                 // match like "Peter Hoddie" + "github" returned zero hits.
-                ftsQuery += `${part} `;
+                frags.push({ s: part, op: true });
             }
             else {
                 // Unqualified — search everything. Strip /regex-literal/
@@ -2891,7 +3026,7 @@ export class MailxDB {
                 if (term.includes("|")) {
                     const alts = term.split("|").map(t => ftsClean(t)).filter(Boolean).map(t => `${t}*`).join(" OR ");
                     if (alts)
-                        ftsQuery += `(${alts}) `;
+                        frags.push({ s: `(${alts})`, op: false });
                 }
                 else {
                     // Match the FTS5 unicode61 tokenizer: split on any
@@ -2905,15 +3040,27 @@ export class MailxDB {
                     // a `*` so incremental typing keeps narrowing.
                     const sub = ftsClean(term).split(/[^\p{L}\p{N}_]+/u).filter(Boolean);
                     if (sub.length === 1) {
-                        ftsQuery += `${sub[0]}* `;
+                        frags.push({ s: `${sub[0]}*`, op: false });
                     }
                     else if (sub.length > 1) {
                         const last = sub.pop();
-                        ftsQuery += `${sub.join(" ")} ${last}* `;
+                        frags.push({ s: `${sub.join(" ")} ${last}*`, op: false });
                     }
                 }
             }
         }
+        // Join fragments. Two adjacent value fragments need an explicit `AND`
+        // (implicit-AND after a `(...)` / `{...}:` group is an FTS5 syntax
+        // error); a user operator fragment glues itself, so no insert around it.
+        let ftsQuery = "";
+        for (let i = 0; i < frags.length; i++) {
+            if (i === 0) {
+                ftsQuery = frags[i].s;
+                continue;
+            }
+            const sep = (frags[i].op || frags[i - 1].op) ? " " : " AND ";
+            ftsQuery += sep + frags[i].s;
+        }
         ftsQuery = ftsQuery.trim();
         // No real FTS term — either qualifier-only ("is:flagged after:1w") or
         // every term sanitized away (user typed only punctuation). There is NO

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-store",
-  "version": "0.1.44",
+  "version": "0.1.46",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",
@@ -9,7 +9,7 @@
   },
   "license": "ISC",
   "dependencies": {
-    "@bobfrankston/mailx-types": "^0.1.18",
+    "@bobfrankston/mailx-types": "^0.1.19",
     "@bobfrankston/mailx-settings": "^0.1.26",
     "@bobfrankston/mailx-bus": "^0.1.2",
     "mailparser": "^3.7.2"
@@ -29,7 +29,7 @@
   },
   ".transformedSnapshot": {
     "dependencies": {
-      "@bobfrankston/mailx-types": "^0.1.18",
+      "@bobfrankston/mailx-types": "^0.1.19",
       "@bobfrankston/mailx-settings": "^0.1.26",
       "@bobfrankston/mailx-bus": "^0.1.2",
       "mailparser": "^3.7.2"

package/store.d.ts

@@ -130,7 +130,7 @@ export declare class Store {
     /** Paginated message list for a (account, folder, ...) query. */
     getMessages(query: MessageQuery): PagedResult<MessageEnvelope>;
     /** All-Inboxes view: union of every account's INBOX, paginated. */
-    getUnifiedInbox(page?: number, pageSize?: number): PagedResult<MessageEnvelope>;
+    getUnifiedInbox(page?: number, pageSize?: number, flaggedOnly?: boolean): PagedResult<MessageEnvelope>;
     /** Local FTS5 search. Server-scope search is the reconciler's job. */
     searchMessages(query: string, page?: number, pageSize?: number, accountId?: string, folderId?: number, includeTrashSpam?: boolean): PagedResult<MessageEnvelope>;
     /** Read a fully-parsed message (envelope + body + attachments) entirely

package/store.js

@@ -182,8 +182,8 @@ export class Store {
         return this.db.getMessages(query);
     }
     /** All-Inboxes view: union of every account's INBOX, paginated. */
-    getUnifiedInbox(page = 1, pageSize = 50) {
-        return this.db.getUnifiedInbox(page, pageSize);
+    getUnifiedInbox(page = 1, pageSize = 50, flaggedOnly = false) {
+        return this.db.getUnifiedInbox(page, pageSize, flaggedOnly);
     }
     /** Local FTS5 search. Server-scope search is the reconciler's job. */
     searchMessages(query, page = 1, pageSize = 50, accountId, folderId, includeTrashSpam = false) {
@@ -205,16 +205,21 @@ export class Store {
         const allowList = this.getCachedAllowlist();
         const senderAddr = (envelope.from?.address || "").toLowerCase();
         const senderDomain = senderAddr.split("@")[1] || "";
-        const toAddrs = (envelope.to || []).map((a) => (a.address || "").toLowerCase());
+        // Recipient allowlist matches against every recipient-ish address, not
+        // just To: a mailing list often carries other subscribers in To/Cc and
+        // delivers to the user's allowlisted alias only via Delivered-To (added
+        // post-parse below).
+        const recipients = (allowList.recipients || []).map((r) => (r || "").toLowerCase());
+        const rcptAddrs = [...(envelope.to || []), ...(envelope.cc || [])]
+            .map((a) => (a.address || "").toLowerCase());
         // Allowlist auto-allow: trusted sender / domain / recipient skips
         // sanitization. Same rule as the legacy service implementation.
         if (!allowRemote) {
             const senders = (allowList.senders || []).map((s) => (s || "").toLowerCase());
             const domains = (allowList.domains || []).map((d) => (d || "").toLowerCase());
-            const recipients = (allowList.recipients || []).map((r) => (r || "").toLowerCase());
             if (senders.includes(senderAddr) ||
                 domains.includes(senderDomain) ||
-                toAddrs.some((a) => recipients.includes(a))) {
+                rcptAddrs.some((a) => recipients.includes(a))) {
                 allowRemote = true;
             }
         }
@@ -254,8 +259,12 @@ export class Store {
         const cached = this.parsedLruGet(cacheKey);
         if (cached) {
             // Allowlist state can change between views even with the same
-            // body cached; recompute the volatile fields and overlay.
-            return { ...cached, remoteAllowed: allowRemote, isFlagged };
+            // body cached; recompute the volatile fields and overlay. OR with
+            // the cached flag: if the body was already parsed-and-allowed (e.g.
+            // via a Delivered-To recipient match, which the early envelope-only
+            // check can't see), keep it allowed — the cached HTML is unsanitized
+            // and the flag must agree.
+            return { ...cached, remoteAllowed: allowRemote || cached.remoteAllowed, isFlagged };
         }
         // Synchronous parse. The .eml is on disk; read + parse it inline
         // and return the fully-rendered message. The parse runs on the
@@ -362,11 +371,6 @@ export class Store {
             size: x.a.size || 0,
             contentId: x.a.contentId || "",
         }));
-        if (bodyHtml && !allowRemote) {
-            const result = sanitizeHtml(bodyHtml);
-            bodyHtml = result.html;
-            hasRemoteContent = result.hasRemoteContent;
-        }
         // Header extraction — Delivered-To, Return-Path, List-Unsubscribe.
         // Each delivery agent PREPENDS its Delivered-To, so the FIRST
         // (topmost) header is the final delivery to the user's actual
@@ -374,6 +378,8 @@ export class Store {
         // routing artifacts. Take [0]. (The old code took the LAST entry —
         // on a forwarded message that grabbed a stale hop, e.g. a malformed
         // `…@elkin.ws@trap-prot` address — Bob 2026-05-21.)
+        // This runs BEFORE sanitization because Delivered-To feeds the
+        // recipient-allowlist re-check just below.
         let deliveredTo = "";
         const rawDelivered = parsed.headers.get("delivered-to");
         if (rawDelivered) {
@@ -403,6 +409,21 @@ export class Store {
         const mailxDraftId = hdr("x-mailx-draft-id").trim();
         const { listUnsubscribeMail, listUnsubscribeHttp, listUnsubscribeOneClick } = parseListUnsubscribe(parsed.headers);
         const listUnsubscribe = listUnsubscribeHttp || listUnsubscribeMail;
+        // Recipient-allowlist re-check with Delivered-To in hand. The early
+        // pass (envelope only) can't see Delivered-To, so a list message whose
+        // To/Cc are other subscribers and whose only allowlisted address is the
+        // Delivered-To alias (e.g. shsaa@bob.ma) would still be sanitized.
+        // Match the bare address out of "Name <addr>" / "<addr>" / "addr".
+        if (!allowRemote && deliveredTo) {
+            const dAddr = (deliveredTo.match(/[^\s<>]+@[^\s<>]+/)?.[0] || "").toLowerCase();
+            if (dAddr && recipients.includes(dAddr))
+                allowRemote = true;
+        }
+        if (bodyHtml && !allowRemote) {
+            const result = sanitizeHtml(bodyHtml);
+            bodyHtml = result.html;
+            hasRemoteContent = result.hasRemoteContent;
+        }
         const result = {
             ...envelope,
             bodyHtml, bodyText,