@bobfrankston/mailx 1.0.461 → 1.0.463

package/packages/mailx-imap/index.js

@@ -0,0 +1,3684 @@
+/**
+ * @bobfrankston/mailx-imap
+ * Multi-account IMAP management wrapping iflow.
+ * Syncs messages to local store, emits events for new mail.
+ */
+import { createAutoImapConfig, CompatImapClient } from "@bobfrankston/iflow-direct";
+import { authenticateOAuth } from "@bobfrankston/oauthsupport";
+import { FileMessageStore } from "@bobfrankston/mailx-store";
+import { loadSettings, getStorePath, getConfigDir, getHistoryDays, getPrefetch } from "@bobfrankston/mailx-settings";
+import { EventEmitter } from "node:events";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { simpleParser } from "mailparser";
+import { GmailApiProvider } from "./providers/gmail-api.js";
+import { SmtpClient } from "@bobfrankston/smtp-direct";
+import * as os from "node:os";
+import { fileURLToPath } from "node:url";
+// Well-known ports — no magic numbers
+const SMTP_PORT_STARTTLS = 587;
+const SMTP_PORT_IMPLICIT_TLS = 465;
+/** Per-message SMTP retry delay: if a send attempt fails, wait this long before
+ *  the same file is retried. Gives the server time to settle so a retry after a
+ *  lost-ack doesn't arrive while the first copy is still being processed. */
+const OUTBOX_RETRY_DELAY_MS = 60000;
+/** Parse X-Mailx-Retry* tracking headers from a raw RFC822 message. */
+function parseRetryInfo(raw) {
+    const headerEnd = raw.search(/\r?\n\r?\n/);
+    const headers = headerEnd >= 0 ? raw.slice(0, headerEnd) : raw;
+    const attemptCount = (headers.match(/^X-Mailx-Retry:/gmi) || []).length;
+    const nextMatch = headers.match(/^X-Mailx-Retry-After:\s*(.+)$/mi);
+    const parsed = nextMatch ? Date.parse(nextMatch[1].trim()) : NaN;
+    return { attemptCount, nextAttemptAt: Number.isFinite(parsed) ? parsed : 0 };
+}
+/** Remove every occurrence of a header field from a raw RFC822 message. */
+function stripHeaderField(raw, name) {
+    const re = new RegExp(`^${name.replace(/[.*+?^${}()|[\\]\\\\]/g, "\\\\$&")}:.*\\r?\\n`, "gmi");
+    return raw.replace(re, "");
+}
+/** Insert a header line just before the header/body blank line. Preserves CRLF vs LF. */
+function insertHeaderBeforeBody(raw, line) {
+    const m = raw.match(/\r?\n\r?\n/);
+    if (!m)
+        return raw + "\r\n" + line + "\r\n";
+    const nl = m[0].startsWith("\r\n") ? "\r\n" : "\n";
+    return raw.slice(0, m.index) + nl + line + raw.slice(m.index);
+}
+/** Error thrown when a message body can't be fetched because the server says
+ *  the message is gone (deleted from another device, expunged, etc.). The
+ *  caller uses this to remove the stale local row instead of showing a
+ *  generic "fetch failed" error to the user. */
+function makeNotFoundError(accountId, folderId, uid) {
+    const err = new Error(`Message ${accountId}/${folderId}/${uid} not found on server`);
+    err.isNotFound = true;
+    return err;
+}
+/** Extract full error detail with provenance */
+function imapError(err) {
+    const msg = err.message || err.reason || err.code || (typeof err === "string" ? err : "");
+    const parts = [];
+    if (msg)
+        parts.push(msg);
+    if (err.responseText)
+        parts.push(err.responseText);
+    if (err.responseStatus)
+        parts.push(`[${err.responseStatus}]`);
+    if (err.code && err.code !== msg)
+        parts.push(`[${err.code}]`);
+    if (parts.length === 0)
+        parts.push(`Unexpected error: ${JSON.stringify(err).slice(0, 200)}`);
+    // Add source location if available
+    if (err.stack) {
+        const frame = err.stack.split("\n").find((l) => l.includes("imap") || l.includes("transport") || l.includes("compat"));
+        if (frame)
+            parts.push(`(${frame.trim().replace(/^at\s+/, "")})`);
+    }
+    return parts.join(" — ");
+}
+/** Convert iflow address objects to our EmailAddress */
+function toEmailAddress(addr) {
+    return {
+        name: addr?.name || "",
+        address: addr?.address || ""
+    };
+}
+/** Convert array of iflow addresses */
+function toEmailAddresses(addrs) {
+    if (!addrs)
+        return [];
+    return addrs.map(toEmailAddress);
+}
+/** Decode HTML entities (  & etc.) to plain characters */
+function decodeEntities(text) {
+    return text
+        .replace(/&#(\d+);/g, (_, n) => String.fromCodePoint(Number(n)))
+        .replace(/&#x([0-9a-fA-F]+);/g, (_, h) => String.fromCodePoint(parseInt(h, 16)))
+        .replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">")
+        .replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&nbsp;/g, " ");
+}
+/** Extract a plain-text preview from message source */
+async function extractPreview(source) {
+    try {
+        const parsed = await simpleParser(source);
+        const bodyText = parsed.text || "";
+        const bodyHtml = parsed.html || "";
+        // Use text part; fall back to stripping HTML tags if text is empty
+        let raw = bodyText || bodyHtml.replace(/<[^>]+>/g, " ");
+        const preview = decodeEntities(raw).replace(/\s+/g, " ").trim().slice(0, 200);
+        const hasAttachments = (parsed.attachments?.length || 0) > 0;
+        return { bodyHtml, bodyText, preview, hasAttachments };
+    }
+    catch {
+        return { bodyHtml: "", bodyText: "", preview: "", hasAttachments: false };
+    }
+}
+/** Race a promise against a timeout. On timeout, forcibly logout the client to prevent hanging. */
+async function withTimeout(promise, ms, client, label) {
+    let timer;
+    const timeout = new Promise((_, reject) => {
+        timer = setTimeout(() => {
+            // Force-close the client to unblock the hanging promise
+            try {
+                client.logout?.();
+            }
+            catch { /* ignore */ }
+            reject(new Error(`${label} timeout (${ms / 1000}s)`));
+        }, ms);
+    });
+    try {
+        return await Promise.race([promise, timeout]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+export class ImapManager extends EventEmitter {
+    configs = new Map();
+    watchers = new Map();
+    fetchClients = new Map();
+    db;
+    bodyStore;
+    syncIntervals = new Map();
+    /** Track which accounts have already shown an error banner — only emit once per session */
+    accountErrorShown = new Set();
+    syncing = false;
+    inboxSyncing = false;
+    /** Use native IMAP client instead of imapflow. Set to true to enable. */
+    useNativeClient = false;
+    // Connection management: see withConnection() below.
+    // Cap-hit backoff machinery removed — bounded per-account concurrency
+    // (one ops socket + one IDLE socket) keeps mailx well under any
+    // reasonable server cap, so the recovery timer was dead weight that
+    // mostly served to lock the UI for minutes after a transient failure.
+    /** Per-account health counters. Incremented when the server misbehaves
+     *  in ways that suggest a problem the user should know about (inactivity
+     *  timeouts, connection-cap hits, rate-limit waits). Surfaced via a
+     *  `diagnostics` event + `getDiagnostics` IPC so the UI can show a ⚠
+     *  badge instead of burying the issue in the log. */
+    diagnostics = new Map();
+    getDiagnosticsEntry(accountId) {
+        let d = this.diagnostics.get(accountId);
+        if (!d) {
+            d = { accountId, inactivityTimeouts: 0, connCapHits: 0, rateLimitWaits: 0, lastTimeoutAt: 0, lastCommand: "", lastError: "" };
+            this.diagnostics.set(accountId, d);
+        }
+        return d;
+    }
+    /** Classify an error message and bump the relevant counter; emit the
+     *  updated diagnostics snapshot. Call this from every catch in the sync
+     *  paths so the UI can count "something's wrong" in real time. */
+    recordError(accountId, errMsg) {
+        const d = this.getDiagnosticsEntry(accountId);
+        if (/inactivity timeout/i.test(errMsg)) {
+            d.inactivityTimeouts++;
+            d.lastTimeoutAt = Date.now();
+            const m = errMsg.match(/A\d+ [A-Z ]+.*$/);
+            if (m)
+                d.lastCommand = m[0].slice(0, 120);
+        }
+        else if (/UNAVAILABLE|Maximum number of connections|too many connections/i.test(errMsg)) {
+            d.connCapHits++;
+        }
+        else if (/429|rate limit/i.test(errMsg)) {
+            d.rateLimitWaits++;
+        }
+        else {
+            return; // not a known diagnostic class — don't emit
+        }
+        d.lastError = errMsg.slice(0, 200);
+        this.emit("diagnostics", accountId, { ...d });
+    }
+    /** Public read for the IPC surface: snapshot of all account diagnostics. */
+    getDiagnosticsSnapshot() {
+        return Array.from(this.diagnostics.values()).map(d => ({ ...d }));
+    }
+    transportFactory;
+    constructor(db, transportFactory) {
+        super();
+        this.db = db;
+        this.transportFactory = transportFactory;
+        const storePath = getStorePath();
+        this.bodyStore = new FileMessageStore(storePath);
+    }
+    /** Get OAuth access token for an account (for SMTP auth) */
+    async getOAuthToken(accountId) {
+        const config = this.configs.get(accountId);
+        if (!config || !config.tokenProvider)
+            return null;
+        return config.tokenProvider();
+    }
+    /** Accounts currently re-authenticating — all operations skip these */
+    reauthenticating = new Set();
+    /** Last reauth attempt timestamp per account — prevents reauth loops (5 min cooldown) */
+    lastReauthAttempt = new Map();
+    /** Force re-authentication for an OAuth account — deletes cached IMAP token, triggers browser consent */
+    async reauthenticate(accountId) {
+        if (this.reauthenticating.has(accountId))
+            return false; // already in progress
+        this.reauthenticating.add(accountId);
+        try {
+            const settings = loadSettings();
+            const account = settings.accounts.find(a => a.id === accountId);
+            if (!account)
+                return false;
+            // Stop IDLE watcher for this account
+            const stopWatcher = this.watchers.get(accountId);
+            if (stopWatcher) {
+                try {
+                    await stopWatcher();
+                }
+                catch { /* */ }
+                this.watchers.delete(accountId);
+            }
+            // Delete only the IMAP token (not contacts — separate scope, separate consent)
+            const accountDir = account.imap.user.replace(/[@.]/g, "_");
+            const tokenDir = path.join(getConfigDir(), "tokens", accountDir);
+            const tokenPath = path.join(tokenDir, "token.json");
+            if (fs.existsSync(tokenPath)) {
+                fs.unlinkSync(tokenPath);
+                console.log(`  [reauth] Deleted ${tokenPath}`);
+            }
+            // Re-register the account to get a fresh config with new tokenProvider
+            this.configs.delete(accountId);
+            await this.addAccount(account);
+            // addAccount already pre-validates the token (opens browser if needed)
+            const config = this.configs.get(accountId);
+            if (config?.tokenProvider) {
+                console.log(`  [reauth] ${accountId}: success`);
+                this.accountErrorShown.delete(accountId);
+                this.syncInbox().catch(() => { });
+                return true;
+            }
+        }
+        catch (e) {
+            console.error(`  [reauth] ${accountId}: ${e.message}`);
+        }
+        finally {
+            this.reauthenticating.delete(accountId);
+        }
+        return false;
+    }
+    /** Delete a message directly on the IMAP server (for stuck outbox messages not in local DB) */
+    async deleteOnServer(accountId, folderPath, uid) {
+        return this.withConnection(accountId, async (client) => {
+            await client.deleteMessageByUid(folderPath, uid);
+            console.log(`  Deleted UID ${uid} from ${folderPath} on server`);
+        });
+    }
+    /** Search messages on the IMAP server — returns matching UIDs */
+    async searchOnServer(accountId, mailboxPath, criteria) {
+        return this.withConnection(accountId, async (client) => {
+            return await client.searchMessages(mailboxPath, criteria);
+        });
+    }
+    /** Server-side search that also materializes any UIDs we don't yet have
+     *  locally. Returns the full result after upsert, so the caller can
+     *  render hits that fall outside the history window. The fetch loop
+     *  can be long for big hit-sets, so this runs on the slow lane and
+     *  yields between chunks (each chunk is a separate withConnection)
+     *  so an interactive body fetch can interleave. */
+    async searchAndFetchOnServer(accountId, folderId, mailboxPath, criteria) {
+        const uids = await this.withConnection(accountId, async (client) => {
+            return await client.searchMessages(mailboxPath, criteria);
+        });
+        if (uids.length === 0)
+            return [];
+        const have = new Set(this.db.getUidsForFolder(accountId, folderId));
+        const missing = uids.filter(u => !have.has(u));
+        if (missing.length > 0) {
+            const folder = this.db.getFolders(accountId).find(f => f.id === folderId);
+            if (folder) {
+                const CHUNK = 500;
+                for (let i = 0; i < missing.length; i += CHUNK) {
+                    const range = missing.slice(i, i + CHUNK).join(",");
+                    await this.withConnection(accountId, async (client) => {
+                        const fetched = await client.fetchMessages(mailboxPath, range, { source: false });
+                        if (fetched?.length) {
+                            await this.storeMessages(accountId, folderId, folder, fetched, 0);
+                        }
+                    }, { slow: true });
+                }
+                this.db.recalcFolderCounts(folderId);
+            }
+        }
+        return uids;
+    }
+    /** Create a fresh IMAP client for an account (public access for API endpoints) */
+    async createPublicClient(accountId) {
+        return this.createClient(accountId);
+    }
+    // Legacy fallback disabled — was doubling connections without helping.
+    // To re-enable: uncomment legacyFallbacks logic in createClient and _syncAll.
+    // private legacyFallbacks = new Set<string>();
+    // ── Connection management: one persistent connection per account ──
+    // All operations on an account are serialized through an operation queue.
+    // No semaphore, no pool, no per-operation connect/disconnect.
+    // IDLE uses a separate connection (see startWatching).
+    /** Persistent operational connections — one per account, reused for all operations.
+     *  Body fetch, sync, prefetch, outbox-append, flag/move all serialize through
+     *  this single client per account via withConnection(). The priority lane
+     *  in the queue lets interactive clicks jump ahead of background prefetch. */
+    opsClients = new Map();
+    /** Two-lane operation queue per account — interactive ops (body fetch on
+     *  click, flag toggle) drain before background ops (sync, prefetch). FIFO
+     *  within each lane. The single ops connection means there's never a race
+     *  on which folder is SELECTed; commands run strictly sequentially. */
+    opsQueues = new Map();
+    /** Per-host semaphore — caps simultaneous IMAP socket opens to one server.
+     *  Defensive guardrail: with the single-ops-per-account model an individual
+     *  user's mailx never hits more than (#accounts × 2) sockets per host, well
+     *  under any reasonable server cap. Exists for the multi-account-on-one-host
+     *  case (e.g. bobma + bobma2 both on imap.iecc.com). */
+    hostSemaphores = new Map();
+    static HOST_PERMITS = 4;
+    /** Get (or create) the persistent operational connection for an account.
+     *  logout() is wrapped as a no-op so legacy callers don't close it. */
+    async getOpsClient(accountId) {
+        let client = this.opsClients.get(accountId);
+        if (client) {
+            // C38: health-check the cached client before returning. If the
+            // underlying socket is dead (Dovecot silently dropped IDLE after
+            // the inactivity timeout, or we lost connectivity), the next
+            // command would fail with "Not connected" — and nothing would
+            // recover it until an explicit reconnectOps was called from the
+            // catch handler. Cheap pre-check here catches it earlier.
+            const sock = client?.native?.transport?.socket;
+            const dead = sock?.destroyed || sock?.readyState === "closed" || client?._dead;
+            if (!dead)
+                return client;
+            try {
+                await (client._realLogout || client.logout)();
+            }
+            catch { /* */ }
+            this.opsClients.delete(accountId);
+            console.log(`  [conn] ${accountId}: stale ops client detected in getOpsClient — reconnecting`);
+            client = undefined;
+        }
+        client = await this.newClient(accountId, "ops");
+        // Wrap logout as no-op — this is a persistent connection. The
+        // newClient wrapper's close-counter runs on `_realLogout`.
+        const realLogout = client.logout.bind(client);
+        client.logout = async () => { };
+        client._realLogout = realLogout;
+        this.opsClients.set(accountId, client);
+        return client;
+    }
+    /** Run an operation on the account's connection — queued, sequential, no concurrency */
+    /** Run an operation against the account's single ops connection. Tasks
+     *  queue strictly sequentially per account — only one IMAP command in
+     *  flight at a time. This eliminates the SELECT-races and "stale client
+     *  recovery" paths the old multi-client design needed.
+     *
+     *  Default lane is `fast` — covers virtually everything (body fetch,
+     *  flag toggle, move, incremental sync). Pass `slow: true` only for
+     *  operations the caller knows will take a long time and shouldn't
+     *  block the user (multi-folder prefetch batches, large backfills).
+     *  When both lanes have tasks, fast drains first.
+     *
+     *  Within a lane, FIFO. The running task always finishes — IMAP can't
+     *  preempt a command mid-flight. */
+    async withConnection(accountId, fn, opts = {}) {
+        let queue = this.opsQueues.get(accountId);
+        if (!queue) {
+            queue = { fast: [], slow: [], running: false };
+            this.opsQueues.set(accountId, queue);
+        }
+        // Per-task wall-clock cap. Without one, a wedged IMAP command (TCP
+        // half-open, server stalled mid-FETCH) keeps the queue's running flag
+        // set forever and every subsequent fast-lane task — including the
+        // retry button the user just hit — waits behind it. Default is
+        // generous; callers driving user-visible reads pass a tighter value.
+        const timeoutMs = opts.timeoutMs ?? 90_000;
+        return new Promise((resolve, reject) => {
+            const task = async () => {
+                let timer;
+                try {
+                    const client = await this.getOpsClient(accountId);
+                    const result = await Promise.race([
+                        fn(client),
+                        new Promise((_, rej) => {
+                            timer = setTimeout(() => rej(new Error(`ops timeout after ${Math.round(timeoutMs / 1000)}s — discarding client`)), timeoutMs);
+                        }),
+                    ]);
+                    clearTimeout(timer);
+                    resolve(result);
+                }
+                catch (e) {
+                    clearTimeout(timer);
+                    // Discard client on any error — keeping a half-broken
+                    // socket poisoned every subsequent request. Destroy
+                    // synchronously kills the in-flight command's socket so
+                    // the underlying promise rejects and stops holding state.
+                    const stale = this.opsClients.get(accountId);
+                    this.opsClients.delete(accountId);
+                    if (stale) {
+                        try {
+                            await (stale._realLogout || stale.logout)();
+                        }
+                        catch { /* */ }
+                        try {
+                            stale.destroy?.();
+                        }
+                        catch { /* */ }
+                    }
+                    reject(e);
+                }
+            };
+            (opts.slow ? queue.slow : queue.fast).push(task);
+            this.drainOpsQueue(accountId);
+        });
+    }
+    /** Run the next queued task. Fast lane drains before slow.
+     *  Idempotent — safe to call after each task completes; the running
+     *  flag prevents reentrant draining. */
+    drainOpsQueue(accountId) {
+        const queue = this.opsQueues.get(accountId);
+        if (!queue || queue.running)
+            return;
+        const next = queue.fast.shift() || queue.slow.shift();
+        if (!next)
+            return;
+        queue.running = true;
+        next().finally(() => {
+            queue.running = false;
+            this.drainOpsQueue(accountId);
+        });
+    }
+    /** Acquire one slot of the per-host connection semaphore. Returns a release
+     *  function — call exactly once when the socket is closed. Used by
+     *  newClient to cap simultaneous IMAP connections to a single server
+     *  across all mailx accounts. */
+    acquireHostSlot(host) {
+        let sem = this.hostSemaphores.get(host);
+        if (!sem) {
+            sem = { permits: ImapManager.HOST_PERMITS, waiters: [] };
+            this.hostSemaphores.set(host, sem);
+        }
+        const semRef = sem;
+        return new Promise(resolve => {
+            const grant = () => {
+                semRef.permits--;
+                let released = false;
+                resolve(() => {
+                    if (released)
+                        return;
+                    released = true;
+                    semRef.permits++;
+                    const next = semRef.waiters.shift();
+                    if (next)
+                        next();
+                });
+            };
+            if (semRef.permits > 0)
+                grant();
+            else
+                semRef.waiters.push(grant);
+        });
+    }
+    /** Open IMAP clients per account, used to trace who's opening sockets
+     *  when we hit the Dovecot per-user+IP connection cap. */
+    openClients = new Map();
+    /** Create a new IMAP client (internal — callers use getOpsClient or withConnection).
+     *  Acquires one slot of the per-host semaphore before constructing the
+     *  client; the slot is released when logout() or destroy() runs.
+     *  `purpose` is a short tag printed alongside the `[conn+]` log so we can
+     *  tell which code path (ops/idle/etc.) opened each connection. */
+    async newClient(accountId, purpose = "?") {
+        if (this.reauthenticating.has(accountId))
+            throw new Error(`Account ${accountId} is re-authenticating`);
+        const config = this.configs.get(accountId);
+        if (!config)
+            throw new Error(`No config for account ${accountId}`);
+        const host = config.server || accountId;
+        const releaseHostSlot = await this.acquireHostSlot(host);
+        let client;
+        try {
+            client = new CompatImapClient(config, this.transportFactory);
+        }
+        catch (e) {
+            releaseHostSlot();
+            throw e;
+        }
+        let open = this.openClients.get(accountId);
+        if (!open) {
+            open = new Set();
+            this.openClients.set(accountId, open);
+        }
+        open.add(client);
+        console.log(`  [conn+] ${accountId} (${purpose}) — ${open.size} open`);
+        let closed = false;
+        const markClosed = (how) => {
+            if (closed)
+                return;
+            closed = true;
+            open.delete(client);
+            releaseHostSlot();
+            console.log(`  [conn-] ${accountId} (${purpose}/${how}) — ${open.size} open`);
+        };
+        const origLogout = client.logout?.bind(client);
+        if (origLogout) {
+            client.logout = async () => {
+                try {
+                    await origLogout();
+                }
+                finally {
+                    markClosed("logout");
+                }
+            };
+        }
+        const origDestroy = client.destroy?.bind(client);
+        if (origDestroy) {
+            client.destroy = () => {
+                try {
+                    origDestroy();
+                }
+                finally {
+                    markClosed("destroy");
+                }
+            };
+        }
+        return client;
+    }
+    /** Force-close every IMAP socket for an account — ops + any lingering
+     *  ones in openClients (e.g. an IDLE watcher in flight). Used during
+     *  account removal and disconnectOps so the server's connection slots
+     *  free immediately rather than waiting for socket idle timeouts. */
+    async closeAllClients(accountId) {
+        const ops = this.opsClients.get(accountId);
+        this.opsClients.delete(accountId);
+        if (ops) {
+            try {
+                await (ops._realLogout || ops.logout)();
+            }
+            catch { /* */ }
+            try {
+                ops.destroy?.();
+            }
+            catch { /* */ }
+        }
+        const open = this.openClients.get(accountId);
+        if (open) {
+            for (const c of Array.from(open)) {
+                try {
+                    await (c._realLogout || c.logout)?.();
+                }
+                catch { /* */ }
+                try {
+                    c.destroy?.();
+                }
+                catch { /* */ }
+            }
+            open.clear();
+        }
+    }
+    /** Disconnect the persistent operational connection for an account */
+    async disconnectOps(accountId) {
+        const client = this.opsClients.get(accountId);
+        this.opsClients.delete(accountId);
+        if (client) {
+            // Force-close: don't wait for LOGOUT on a possibly dead socket
+            try {
+                const timeout = new Promise(r => setTimeout(r, 2000));
+                await Promise.race([(client._realLogout || client.logout)(), timeout]);
+            }
+            catch { /* */ }
+            // Destroy underlying socket if still open
+            try {
+                client.destroy?.();
+            }
+            catch { /* */ }
+            console.log(`  [conn] ${accountId}: disconnected`);
+        }
+    }
+    /** Legacy entry: returns the shared persistent ops client. Most callers
+     *  should be using `withConnection()` instead — that gives proper
+     *  queueing and lets fast operations jump ahead of slow ones. */
+    async createClientWithLimit(accountId) {
+        return this.getOpsClient(accountId);
+    }
+    /** Disposable fresh client — only used by the IDLE watcher, which holds
+     *  its own socket so the fast/slow ops queue isn't blocked by IDLE
+     *  parking the connection in a wait-for-server state. */
+    async createClient(accountId, purpose = "misc") {
+        return this.newClient(accountId, purpose);
+    }
+    trackLogout(_accountId) { }
+    /** Number of registered IMAP accounts */
+    getAccountCount() { return this.configs.size; }
+    /** Register an account */
+    async addAccount(account) {
+        if (this.configs.has(account.id))
+            return;
+        // createAutoImapConfig auto-detects Gmail from server/username and sets up OAuth
+        // For OAuth accounts, provide a tokenProvider using oauthsupport
+        let tokenProvider;
+        if (account.imap.auth === "oauth2" || (!account.imap.password && account.imap.host?.includes("gmail"))) {
+            // Find Google OAuth credentials — check ~/.mailx first, then iflow-direct package
+            let credPath = path.join(getConfigDir(), "google-credentials.json");
+            if (!fs.existsSync(credPath)) {
+                try {
+                    // Use fileURLToPath, NOT string-replace on "file://" — on Linux,
+                    // file:///usr/local/... loses its leading slash via .replace("file:///",
+                    // "") and becomes relative, so fs.existsSync silently fails.
+                    const pkgDir = path.dirname(fileURLToPath(import.meta.resolve("@bobfrankston/iflow-direct")));
+                    for (const name of ["iflow-credentials.json"]) {
+                        const p = path.join(pkgDir, name);
+                        if (fs.existsSync(p)) {
+                            credPath = p;
+                            break;
+                        }
+                    }
+                }
+                catch { /* iflow-direct not resolvable */ }
+            }
+            const tokenDir = path.join(getConfigDir(), "tokens", account.imap.user.replace(/[@.]/g, "_"));
+            tokenProvider = async () => {
+                // Wall-clock timeout on OAuth. Use a longer timeout when no
+                // cached token exists (first auth needs user to click through
+                // the browser consent screen — 30s is too tight).
+                const hasToken = fs.existsSync(path.join(tokenDir, "oauth-token.json"));
+                const TOKEN_FETCH_TIMEOUT_MS = hasToken ? 30_000 : 120_000;
+                const authPromise = authenticateOAuth(credPath, {
+                    // Scope set covers two-way sync of all mailx-managed local
+                    // stores: mail (mail.google.com), contacts (full, not
+                    // readonly — we write edits back), calendar (full), tasks
+                    // (full), drive (for shared accounts.jsonc).
+                    scope: "https://mail.google.com/ https://www.googleapis.com/auth/contacts https://www.googleapis.com/auth/calendar https://www.googleapis.com/auth/tasks https://www.googleapis.com/auth/drive",
+                    tokenDirectory: tokenDir,
+                    credentialsKey: "installed",
+                    loginHint: account.imap.user,
+                });
+                const timeoutPromise = new Promise((_, reject) => setTimeout(() => reject(new Error(`OAuth token fetch timeout (${TOKEN_FETCH_TIMEOUT_MS / 1000}s)`)), TOKEN_FETCH_TIMEOUT_MS));
+                const result = await Promise.race([authPromise, timeoutPromise]);
+                return result?.access_token || "";
+            };
+        }
+        // Non-Gmail accounts (typically Dovecot / generic IMAP) get a smaller
+        // fetch chunk size (10 vs 25) and longer inactivity timeout (300s) so
+        // multi-body FETCH batches don't trip the connection-dead detector on
+        // slow servers. Gmail stays at the defaults since it's fast and has
+        // its own rate limits to respect.
+        const isGmail = account.imap.host?.includes("gmail") || account.email.endsWith("@gmail.com");
+        const config = createAutoImapConfig({
+            server: account.imap.host,
+            port: account.imap.port,
+            username: account.imap.user,
+            password: account.imap.password,
+            tokenProvider,
+            inactivityTimeout: isGmail ? 60000 : 300000,
+            fetchChunkSize: isGmail ? 25 : 10,
+            fetchChunkSizeMax: isGmail ? 500 : 100,
+        });
+        this.configs.set(account.id, config);
+        // Register account in DB
+        this.db.upsertAccount(account.id, account.name, account.email, JSON.stringify(account));
+        // Pre-validate OAuth token (so browser consent happens now, not during a timed sync)
+        if (config.tokenProvider) {
+            try {
+                await config.tokenProvider();
+                console.log(`  [auth] ${account.id}: token valid`);
+            }
+            catch (e) {
+                const errMsg = imapError(e);
+                console.error(`  [auth] ${account.id}: ${errMsg}`);
+                const isTransient = /timeout|ECONNREFUSED|ECONNRESET|ETIMEDOUT|ENETUNREACH/i.test(errMsg);
+                if (isTransient) {
+                    console.log(`  [transient] ${account.id}: ${errMsg} — will retry on first sync`);
+                }
+                else if (!this.accountErrorShown.has(account.id)) {
+                    this.accountErrorShown.add(account.id);
+                    const config = this.configs.get(account.id);
+                    this.emit("accountError", account.id, errMsg, errMsg, !!config?.tokenProvider);
+                }
+            }
+        }
+    }
+    /** Check if an account uses Gmail (should use API instead of IMAP) */
+    isGmailAccount(accountId) {
+        const settings = loadSettings();
+        const account = settings.accounts.find(a => a.id === accountId);
+        if (!account)
+            return false;
+        return account.imap?.host?.includes("gmail") || account.email?.endsWith("@gmail.com") || false;
+    }
+    /** Get a Gmail API provider for an account (reuses tokenProvider from IMAP config) */
+    getGmailProvider(accountId) {
+        const config = this.configs.get(accountId);
+        if (!config?.tokenProvider)
+            throw new Error(`No tokenProvider for ${accountId}`);
+        return new GmailApiProvider(config.tokenProvider);
+    }
+    /** Convert ProviderMessage to the shape expected by storeMessages/upsertMessage */
+    providerMsgToLocal(msg) {
+        return {
+            uid: msg.uid,
+            messageId: msg.messageId,
+            date: msg.date || new Date(),
+            subject: msg.subject,
+            from: msg.from,
+            to: msg.to,
+            cc: msg.cc,
+            seen: msg.seen,
+            flagged: msg.flagged,
+            answered: msg.answered,
+            draft: msg.draft,
+            size: msg.size,
+            source: msg.source,
+            providerId: msg.providerId,
+        };
+    }
+    /** Sync folder list for an account */
+    async syncFolders(accountId, client) {
+        if (!client)
+            client = await this.getOpsClient(accountId);
+        this.emit("syncProgress", accountId, "folders", 0);
+        const t0 = Date.now();
+        console.log(`  [diag] ${accountId}: getFolderList starting...`);
+        const folders = await client.getFolderList();
+        console.log(`  [diag] ${accountId}: getFolderList done in ${Date.now() - t0}ms (${folders.length} folders)`);
+        const specialFolders = client.getSpecialFolders(folders);
+        // Collect server paths so we can prune anything the server no longer
+        // has (user-renamed / -deleted / case-flipped a folder from another
+        // client). IMAP paths are case-sensitive, so "Foo" → "foo" is a real
+        // delete+create of two distinct mailboxes.
+        const serverPaths = new Set();
+        for (const folder of folders) {
+            // Skip non-selectable folders (virtual parents like "Added", "Added2")
+            const flags = folder.flags;
+            const flagArr = flags instanceof Set ? [...flags] : (flags || []);
+            if (flagArr.some((f) => f.toLowerCase() === "\\noselect" || f.toLowerCase() === "\\nonexistent"))
+                continue;
+            let specialUse = null;
+            if (specialFolders.inbox === folder.path)
+                specialUse = "inbox";
+            else if (specialFolders.sent === folder.path)
+                specialUse = "sent";
+            else if (specialFolders.trash === folder.path)
+                specialUse = "trash";
+            else if (specialFolders.drafts === folder.path)
+                specialUse = "drafts";
+            else if (specialFolders.spam === folder.path || specialFolders.junk === folder.path)
+                specialUse = "junk";
+            else if (specialFolders.archive === folder.path)
+                specialUse = "archive";
+            this.db.upsertFolder(accountId, folder.path, folder.name || folder.path.split(folder.delimiter || "/").pop() || folder.path, specialUse, folder.delimiter || "/");
+            serverPaths.add(folder.path);
+        }
+        // Prune: any local folder whose exact path (case-sensitive) isn't in
+        // the server's list has been deleted or renamed server-side. Safety
+        // rails: only prune when the server returned a non-empty list (empty
+        // result is more likely a transient protocol / auth error than "all
+        // your folders were deleted"). Never prune INBOX under any
+        // circumstances — even a broken server response shouldn't make us
+        // drop the account's primary mailbox. All other special-use folders
+        // ARE prunable: if the user actually deleted Sent on the server,
+        // we should reflect that locally, and the next sync will re-detect
+        // the server's real Sent folder and re-upsert.
+        if (folders.length > 0) {
+            const localFolders = this.db.getFolders(accountId);
+            const stale = localFolders.filter(f => !serverPaths.has(f.path) &&
+                f.specialUse !== "inbox");
+            for (const f of stale) {
+                console.log(`  [sync] ${accountId}: pruning stale folder "${f.path}" (id=${f.id}) — no longer on server`);
+                try {
+                    this.db.deleteFolder(f.id);
+                }
+                catch (e) {
+                    console.error(`  [sync] ${accountId}: prune failed for "${f.path}": ${e.message}`);
+                }
+            }
+            if (stale.length > 0) {
+                this.emit("folderCountsChanged", accountId, {});
+            }
+        }
+        this.emit("syncProgress", accountId, "folders", 100);
+        // Notify UI that folder structure changed — triggers tree re-render
+        const dbFolders = this.db.getFolders(accountId);
+        this.emit("folderCountsChanged", accountId, {});
+        return dbFolders;
+    }
+    /** Store a batch of messages to DB immediately — used by onChunk for incremental sync */
+    async storeMessages(accountId, folderId, folder, msgs, highestUid) {
+        let stored = 0;
+        this.db.beginTransaction();
+        try {
+            for (const msg of msgs) {
+                // Debug: log subjects with non-ASCII to trace encoding issues
+                if (msg.subject && /[^\x00-\x7F]/.test(msg.subject)) {
+                    const hex = Buffer.from(msg.subject, "utf-8").subarray(0, 40).toString("hex");
+                    console.log(`  [encoding] subject: "${msg.subject.substring(0, 60)}" hex: ${hex}`);
+                }
+                if (msg.uid <= highestUid)
+                    continue; // already have it
+                // Tombstone check: if the user locally deleted this Message-ID,
+                // don't re-import it. Server-side EXPUNGE may lag, or reconcile
+                // may find the message in an old list snapshot. Without this,
+                // deleted messages reappear on the next sync pass.
+                if (msg.messageId && this.db.hasTombstone(accountId, msg.messageId)) {
+                    console.log(`  [tombstone] ${accountId}: skipping ${msg.messageId} (locally deleted)`);
+                    continue;
+                }
+                const source = msg.source || "";
+                let bodyPath = "";
+                let preview = "";
+                let hasAttachments = false;
+                if (source) {
+                    bodyPath = await this.bodyStore.putMessage(accountId, folderId, msg.uid, Buffer.from(source, "utf-8"));
+                    const parsed = await extractPreview(source);
+                    preview = parsed.preview;
+                    hasAttachments = parsed.hasAttachments;
+                }
+                const flags = [];
+                if (msg.seen)
+                    flags.push("\\Seen");
+                if (msg.flagged)
+                    flags.push("\\Flagged");
+                if (msg.answered)
+                    flags.push("\\Answered");
+                if (msg.draft)
+                    flags.push("\\Draft");
+                this.db.upsertMessage({
+                    accountId, folderId, uid: msg.uid,
+                    messageId: msg.messageId || "",
+                    inReplyTo: msg.inReplyTo || "",
+                    references: [],
+                    date: msg.date instanceof Date ? msg.date.getTime() : (typeof msg.date === "number" ? msg.date : Date.now()),
+                    subject: msg.subject || "",
+                    from: toEmailAddress(msg.from?.[0] || {}),
+                    to: toEmailAddresses(msg.to || []),
+                    cc: toEmailAddresses(msg.cc || []),
+                    flags, size: msg.size || 0, hasAttachments, preview, bodyPath
+                });
+                stored++;
+            }
+            this.db.commitTransaction();
+        }
+        catch (e) {
+            this.db.rollbackTransaction();
+            console.error(`  storeMessages error: ${e.message}`);
+        }
+        return stored;
+    }
+    /** Sync messages for a specific folder */
+    async syncFolder(accountId, folderId, client) {
+        if (!client)
+            client = await this.getOpsClient(accountId);
+        const prefetch = getPrefetch();
+        const folders = this.db.getFolders(accountId);
+        const folder = folders.find(f => f.id === folderId);
+        if (!folder)
+            throw new Error(`Folder ${folderId} not found`);
+        this.emit("syncProgress", accountId, `sync:${folder.path}`, 0);
+        // Get the highest UID we already have for this folder
+        const highestUid = this.db.getHighestUid(accountId, folderId);
+        console.log(`  [sync] ${accountId}/${folder.path}: highestUid=${highestUid}, fetching...`);
+        let messages;
+        const firstSync = highestUid === 0;
+        const historyDays = getHistoryDays(accountId);
+        // historyDays=0 means "all". On first sync we still cap at 30 days
+        // so the UI isn't empty for minutes while SEARCH SINCE 1970 runs
+        // through a years-old mailbox. Once we have any local messages, the
+        // backfill below extends the window in 90-day chunks per sync cycle.
+        let effectiveDays = historyDays;
+        if (effectiveDays === 0 && firstSync)
+            effectiveDays = 30;
+        const startDate = effectiveDays > 0
+            ? new Date(Date.now() - effectiveDays * 86400000)
+            : new Date(0);
+        if (highestUid > 0) {
+            // Incremental: fetch new messages — prefetch bodies for offline access
+            const fetched = await client.fetchMessagesSinceUid(folder.path, highestUid, { source: false });
+            // Filter out the last known message (IMAP * always returns at least one)
+            messages = fetched.filter((m) => m.uid > highestUid);
+            // Gap detection: check for missing UIDs within the range we've already synced
+            // Only reconcile between our lowest and highest UID — don't try to fetch the entire folder history
+            const existingUids = this.db.getUidsForFolder(accountId, folderId);
+            if (existingUids.length > 0) {
+                try {
+                    const lowestUid = Math.min(...existingUids);
+                    // Fetch UIDs in our known range from IMAP
+                    const rangeUids = await client.getUids(folder.path);
+                    const rangeInScope = rangeUids.filter((uid) => uid >= lowestUid && uid <= highestUid);
+                    const existingSet = new Set(existingUids);
+                    const newSet = new Set(messages.map(m => m.uid));
+                    const missingUids = rangeInScope.filter((uid) => !existingSet.has(uid) && !newSet.has(uid));
+                    if (missingUids.length > 0 && missingUids.length <= 5000) {
+                        console.log(`  ${folder.path}: gap detected — ${missingUids.length} missing UIDs in range ${lowestUid}..${highestUid}`);
+                        const chunkSize = 500;
+                        let recoveredTotal = 0;
+                        for (let i = 0; i < missingUids.length; i += chunkSize) {
+                            const chunk = missingUids.slice(i, i + chunkSize);
+                            const range = chunk.join(",");
+                            const recovered = await client.fetchMessages(folder.path, range, { source: false });
+                            messages.push(...recovered);
+                            recoveredTotal += recovered.length;
+                            console.log(`  ${folder.path}: gap-fill ${recoveredTotal}/${missingUids.length}`);
+                        }
+                    }
+                    else if (missingUids.length > 5000) {
+                        console.log(`  ${folder.path}: ${missingUids.length} missing UIDs — too many, skipping reconciliation (delete DB to force full re-sync)`);
+                    }
+                }
+                catch (e) {
+                    console.error(`  ${folder.path}: gap detection failed: ${e.message}`);
+                }
+            }
+            // Backfill: if the history window reaches further back than our
+            // oldest local message, fetch the gap. Chunk 90 days per sync
+            // cycle so historyDays=0 catches up incrementally instead of
+            // asking Dovecot for SEARCH SINCE 1970 in one go.
+            const oldestDate = this.db.getOldestDate(accountId, folderId);
+            if (oldestDate > 0 && startDate.getTime() < oldestDate) {
+                try {
+                    const CHUNK_MS = 90 * 86400000;
+                    const chunkStart = new Date(Math.max(startDate.getTime(), oldestDate - CHUNK_MS));
+                    const existingUids = new Set(this.db.getUidsForFolder(accountId, folderId));
+                    const backfill = await client.fetchMessageByDate(folder.path, chunkStart, new Date(oldestDate), { source: false });
+                    const newBackfill = backfill.filter((m) => !existingUids.has(m.uid));
+                    if (newBackfill.length > 0) {
+                        console.log(`  ${folder.path}: backfilling ${newBackfill.length} older messages (${chunkStart.toISOString().slice(0, 10)} → ${new Date(oldestDate).toISOString().slice(0, 10)})`);
+                        messages.push(...newBackfill);
+                    }
+                }
+                catch (e) {
+                    console.error(`  ${folder.path}: backfill failed: ${e.message}`);
+                }
+            }
+        }
+        else {
+            // First sync: fetch in chunks, store each chunk immediately for instant UI
+            let totalStored = 0;
+            const onChunk = async (chunk) => {
+                const stored = await this.storeMessages(accountId, folderId, folder, chunk, highestUid);
+                totalStored += stored;
+                if (stored > 0) {
+                    this.db.recalcFolderCounts(folderId);
+                    this.emit("folderCountsChanged", accountId, {});
+                }
+            };
+            const tomorrow = new Date(Date.now() + 86400000); // IMAP BEFORE is exclusive
+            // First sync: metadata only for fast UI — bodies prefetched in background after
+            messages = await client.fetchMessageByDate(folder.path, startDate, tomorrow, { source: false }, onChunk);
+            if (totalStored > 0) {
+                console.log(`  ${folder.path}: ${totalStored} messages (streamed)`);
+                this.db.recalcFolderCounts(folderId);
+                this.emit("folderCountsChanged", accountId, {});
+                this.emit("syncProgress", accountId, `sync:${folder.path}`, 100);
+                return totalStored;
+            }
+        }
+        if (messages.length > 0)
+            console.log(`  ${folder.path}: ${messages.length} new messages`);
+        let newCount = 0;
+        const batchSize = 50;
+        for (let batchStart = 0; batchStart < messages.length; batchStart += batchSize) {
+            const batchEnd = Math.min(batchStart + batchSize, messages.length);
+            this.db.beginTransaction();
+            try {
+                for (let i = batchStart; i < batchEnd; i++) {
+                    const msg = messages[i];
+                    // Skip if we already have this UID
+                    if (msg.uid <= highestUid) {
+                        // But update flags in case they changed
+                        const flags = [];
+                        if (msg.seen)
+                            flags.push("\\Seen");
+                        if (msg.flagged)
+                            flags.push("\\Flagged");
+                        if (msg.answered)
+                            flags.push("\\Answered");
+                        if (msg.draft)
+                            flags.push("\\Draft");
+                        this.db.updateMessageFlags(accountId, msg.uid, flags);
+                        continue;
+                    }
+                    // Tombstone check — same reason as the streamy onChunk path
+                    // at storeMessages: a locally-deleted message that the server
+                    // hasn't EXPUNGEd yet would otherwise reappear on next sync.
+                    // User-visible symptom: "I deleted it but it came back."
+                    if (msg.messageId && this.db.hasTombstone(accountId, msg.messageId)) {
+                        console.log(`  [tombstone] ${accountId}: skipping ${msg.messageId} in syncFolder (locally deleted)`);
+                        continue;
+                    }
+                    // Store body
+                    const source = msg.source || "";
+                    let bodyPath = "";
+                    if (source) {
+                        bodyPath = await this.bodyStore.putMessage(accountId, folderId, msg.uid, Buffer.from(source, "utf-8"));
+                    }
+                    // Parse for preview and attachment info
+                    const parsed = await extractPreview(source);
+                    // Build flags array
+                    const flags = [];
+                    if (msg.seen)
+                        flags.push("\\Seen");
+                    if (msg.flagged)
+                        flags.push("\\Flagged");
+                    if (msg.answered)
+                        flags.push("\\Answered");
+                    if (msg.draft)
+                        flags.push("\\Draft");
+                    // Store metadata
+                    this.db.upsertMessage({
+                        accountId,
+                        folderId,
+                        uid: msg.uid,
+                        messageId: msg.messageId || "",
+                        inReplyTo: msg.inReplyTo || "",
+                        references: [],
+                        date: msg.date instanceof Date ? msg.date.getTime() : (typeof msg.date === "number" ? msg.date : Date.now()),
+                        subject: msg.subject || "",
+                        from: toEmailAddress(msg.from?.[0] || {}),
+                        to: toEmailAddresses(msg.to || []),
+                        cc: toEmailAddresses(msg.cc || []),
+                        flags,
+                        size: msg.size || 0,
+                        hasAttachments: parsed.hasAttachments,
+                        preview: parsed.preview,
+                        bodyPath
+                    });
+                    newCount++;
+                }
+                this.db.commitTransaction();
+            }
+            catch (e) {
+                console.error(`    transaction error: ${e.message}`);
+                this.db.rollbackTransaction();
+                throw e;
+            }
+            // Emit progress and notify client after each batch
+            this.emit("syncProgress", accountId, `sync:${folder.path}`, Math.round((batchEnd / messages.length) * 100));
+            // On first sync, emit folderCountsChanged per batch so newest messages appear immediately
+            if (firstSync && newCount > 0) {
+                this.db.recalcFolderCounts(folderId);
+                const folderInfo = this.db.getFolders(accountId).find(f => f.id === folderId);
+                this.emit("folderCountsChanged", accountId, {
+                    [folderId]: { total: folderInfo?.totalCount || 0, unread: folderInfo?.unreadCount || 0 }
+                });
+            }
+        }
+        if (newCount > 0)
+            console.log(`    stored ${newCount} new messages`);
+        // Remove messages deleted on the server (skip on first sync — nothing to reconcile).
+        //
+        // SAFETY (same three guards the Gmail API path uses, see ~line 1388):
+        //   1. Skip if server returned an empty list but we have local messages
+        //      (transient Dovecot error / connection hiccup returning empty UID SEARCH
+        //      must not wipe the folder).
+        //   2. Refuse to delete more than 50% in one pass — indicates a sync bug,
+        //      never a real user action. User can fix with `mailx -rebuild` if real.
+        //   3. Log every deletion with Message-ID + subject so future reports have
+        //      data (the "ubiquiti letter disappeared after reply" case had no trace).
+        let deletedCount = 0;
+        if (!firstSync) {
+            try {
+                const serverUidsArr = await client.getUids(folder.path);
+                const serverUids = new Set(serverUidsArr);
+                const localUids = this.db.getUidsForFolder(accountId, folderId);
+                const toDelete = localUids.filter(uid => !serverUids.has(uid));
+                if (serverUidsArr.length === 0 && localUids.length > 0) {
+                    console.log(`  [sync] ${accountId}/${folder.path}: reconcile skipped — server UID list empty but local has ${localUids.length} (treating as transient)`);
+                }
+                else if (localUids.length > 0 && toDelete.length / localUids.length > 0.5) {
+                    console.log(`  [sync] ${accountId}/${folder.path}: reconcile REFUSED — would delete ${toDelete.length}/${localUids.length} (${Math.round(toDelete.length / localUids.length * 100)}%) — probably a sync bug, skipping`);
+                }
+                else {
+                    for (const uid of toDelete) {
+                        const env = this.db.getMessageByUid(accountId, uid);
+                        const tag = env ? `msgid=${env.messageId || "?"} subj="${(env.subject || "").slice(0, 60)}"` : "unknown";
+                        console.log(`  [reconcile-delete] ${accountId}/${folder.path} uid=${uid} ${tag}`);
+                        this.unlinkBodyFile(accountId, uid, folderId).catch(() => { });
+                        this.db.deleteMessage(accountId, uid);
+                        deletedCount++;
+                    }
+                    if (deletedCount > 0)
+                        console.log(`    removed ${deletedCount} deleted messages`);
+                }
+            }
+            catch (e) {
+                console.error(`    deletion sync error: ${e.message}`);
+            }
+        }
+        // Update folder counts from local DB (after deletions + additions)
+        // Use recalcFolderCounts — single SQL query instead of fetching all messages
+        this.db.recalcFolderCounts(folderId);
+        this.emit("syncProgress", accountId, `sync:${folder.path}`, 100);
+        const syncedAt = Date.now();
+        // Notify client to refresh if anything changed
+        if (newCount > 0 || deletedCount > 0) {
+            const updatedFolder = this.db.getFolders(accountId).find(f => f.id === folderId);
+            this.emit("folderCountsChanged", accountId, {
+                [folderId]: { total: updatedFolder?.totalCount || 0, unread: updatedFolder?.unreadCount || 0 }
+            });
+        }
+        this.emit("folderSynced", accountId, folderId, syncedAt);
+        this.db.updateLastSync(accountId, syncedAt);
+        return newCount;
+    }
+    /** Sync all folders for all accounts */
+    async syncAll() {
+        if (this.syncing)
+            return; // Prevent concurrent syncs
+        this.syncing = true;
+        try {
+            await Promise.race([
+                this._syncAll(),
+                new Promise((_, reject) => setTimeout(() => reject(new Error("Global sync timeout (10min)")), 600000))
+            ]);
+        }
+        catch (e) {
+            console.error(`  syncAll error: ${e.message}`);
+        }
+        finally {
+            this.syncing = false;
+        }
+    }
+    async _syncAll() {
+        const priorityOrder = ["sent", "drafts", "archive", "junk", "trash"];
+        // Sync all accounts in parallel — each manages its own connection.
+        // Prefetch runs per-account immediately after that account's sync
+        // completes, NOT after all accounts finish. This way a slow account
+        // (bobma with 300s timeouts) doesn't block prefetch for a fast account
+        // (Gmail). The old code put prefetch after `allSettled`, but syncAll
+        // has a 10-minute wall-clock timeout that killed it first — so
+        // prefetch never ran.
+        const syncAndPrefetch = async (accountId) => {
+            try {
+                await this.syncAccount(accountId, priorityOrder);
+            }
+            catch {
+                // syncAccount already logs + emits syncError. Don't follow a
+                // failed sync with a body-prefetch storm into the same API:
+                // a 429 on listLabels means Gmail is in cooldown, so firing
+                // prefetch next would just re-trigger the same limit.
+                return;
+            }
+            if (getPrefetch()) {
+                this.prefetchBodies(accountId).catch(e => console.error(`  [prefetch] ${accountId}: ${e.message}`));
+            }
+        };
+        const syncPromises = [...this.configs.keys()].map(syncAndPrefetch);
+        await Promise.allSettled(syncPromises);
+    }
+    /** Sync a single account — manages its own connection lifecycle */
+    async syncAccount(accountId, priorityOrder) {
+        // Gmail: use REST API instead of IMAP
+        if (this.isGmailAccount(accountId)) {
+            return this.syncAccountViaApi(accountId, priorityOrder);
+        }
+        try {
+            // Step 1: Get folder list (fast — <1s typically)
+            let client = await this.getOpsClient(accountId);
+            const t0 = Date.now();
+            const folders = await this.syncFolders(accountId, client);
+            console.log(`  [timing] ${accountId}: folder list ${Date.now() - t0}ms (${folders.length} folders)`);
+            // Step 2: Sync INBOX first — keep retrying on failure (most important folder)
+            const inbox = folders.find(f => f.specialUse === "inbox");
+            if (inbox) {
+                console.log(`  [sync] ${accountId}: starting INBOX sync (folder ${inbox.id})`);
+                const maxAttempts = 5;
+                let inboxDone = false;
+                for (let attempt = 1; attempt <= maxAttempts && !inboxDone; attempt++) {
+                    try {
+                        client = await this.getOpsClient(accountId);
+                        if (attempt > 1)
+                            console.log(`  [sync] ${accountId}: INBOX retry #${attempt}`);
+                        await this.syncFolder(accountId, inbox.id, client);
+                        console.log(`  [sync] ${accountId}: INBOX sync complete`);
+                        inboxDone = true;
+                        // Kick off prefetch as soon as INBOX is fresh, not
+                        // after all 105 folders finish — bobma's full sync
+                        // can take 30+ minutes on a wide folder tree, and
+                        // INBOX is the only folder the user is staring at.
+                        // Uses the body client (separate connection from
+                        // ops), so it runs concurrently with the rest of the
+                        // folder sync without contending for the same socket.
+                        if (getPrefetch()) {
+                            this.prefetchBodies(accountId).catch(e => console.error(`  [prefetch] ${accountId}: ${e.message}`));
+                        }
+                    }
+                    catch (e) {
+                        console.error(`  Inbox sync error for ${accountId} (attempt ${attempt}/${maxAttempts}): ${e.message}`);
+                        await this.reconnectOps(accountId);
+                        if (attempt < maxAttempts) {
+                            const delay = Math.min(attempt * 5000, 15000);
+                            console.log(`  [sync] ${accountId}: waiting ${delay / 1000}s before INBOX retry`);
+                            await new Promise(r => setTimeout(r, delay));
+                        }
+                    }
+                }
+                if (!inboxDone) {
+                    console.error(`  [sync] ${accountId}: INBOX failed after ${maxAttempts} attempts — will retry next sync cycle`);
+                    this.emit("syncError", accountId, `INBOX sync failed after ${maxAttempts} attempts`);
+                    // Even when sync failed, try to prefetch bodies for messages
+                    // already in the local DB. Prefetch uses a separate body
+                    // client (not the ops client that just timed out), so a
+                    // sync timeout on SELECT/SEARCH doesn't necessarily mean
+                    // body fetches will also fail. Without this, a server
+                    // having a slow patch would leave every message with a
+                    // white "not-downloaded" dot indefinitely until sync
+                    // recovers — even though prior syncs already populated
+                    // headers that prefetch can flesh out independently.
+                    if (getPrefetch()) {
+                        this.prefetchBodies(accountId).catch(e => console.error(`  [prefetch] ${accountId}: ${e.message}`));
+                    }
+                }
+            }
+            else {
+                console.log(`  [sync] ${accountId}: no INBOX folder found`);
+            }
+            // Step 3: Sync remaining folders.
+            //
+            // Parallel pool (concurrency 2) with a per-folder wall-clock cap.
+            // Previous serial loop meant one slow Dovecot UID FETCH could park
+            // every other folder behind it for minutes — user observed "mailx
+            // says synced but 90 folders are empty" because the loop never
+            // progressed past the stalled FETCH before the next sync tick.
+            //
+            // Parallelism uses independent IMAP sockets from the ops-client
+            // pool, so one stalled socket doesn't block the others. The 60s
+            // timeout abandons a stalled command instead of waiting out
+            // Dovecot's 300s server-side inactivity timer; the next sync tick
+            // retries on a fresh socket.
+            const remaining = folders.filter(f => f.specialUse !== "inbox");
+            remaining.sort((a, b) => {
+                const pa = priorityOrder.indexOf(a.specialUse || "") >= 0 ? priorityOrder.indexOf(a.specialUse || "") : 5;
+                const pb = priorityOrder.indexOf(b.specialUse || "") >= 0 ? priorityOrder.indexOf(b.specialUse || "") : 5;
+                return pa - pb;
+            });
+            const CONCURRENCY = 2;
+            const PER_FOLDER_TIMEOUT_MS = 60_000;
+            const total = remaining.length;
+            let done = 0;
+            let idx = 0;
+            const syncOne = async (folder) => {
+                const isTrashChild = folder.path.includes("/") && folder.path.toLowerCase().startsWith("trash");
+                const highestUid = this.db.getHighestUid(accountId, folder.id);
+                if (isTrashChild && highestUid === 0)
+                    return;
+                try {
+                    const fresh = await this.getOpsClient(accountId);
+                    await Promise.race([
+                        this.syncFolder(accountId, folder.id, fresh),
+                        new Promise((_, reject) => setTimeout(() => reject(new Error(`per-folder timeout (${PER_FOLDER_TIMEOUT_MS / 1000}s): ${folder.path}`)), PER_FOLDER_TIMEOUT_MS)),
+                    ]);
+                }
+                catch (e) {
+                    if (e.responseText?.includes("doesn't exist")) {
+                        this.db.deleteFolder(folder.id);
+                    }
+                    else {
+                        console.error(`  Skipping ${folder.path}: ${e.message}`);
+                        this.recordError(accountId, e.message || String(e));
+                        // A timeout or stale-socket failure — drop the ops
+                        // client so the next iteration reconnects rather than
+                        // inheriting the doomed socket.
+                        await this.reconnectOps(accountId).catch(() => { });
+                    }
+                }
+            };
+            const worker = async () => {
+                while (true) {
+                    const myIdx = idx++;
+                    if (myIdx >= remaining.length)
+                        return;
+                    const folder = remaining[myIdx];
+                    this.emit("syncProgress", accountId, `folders:${folder.path}`, Math.round((done / Math.max(total, 1)) * 100));
+                    await syncOne(folder);
+                    done++;
+                    this.emit("syncProgress", accountId, `folders-done`, Math.round((done / Math.max(total, 1)) * 100));
+                    console.log(`  [sync] ${accountId}: folder ${done}/${total} done (${folder.path})`);
+                }
+            };
+            await Promise.all(Array.from({ length: Math.min(CONCURRENCY, remaining.length) }, () => worker()));
+            this.accountErrorShown.delete(accountId);
+            this.emit("syncComplete", accountId);
+        }
+        catch (e) {
+            const errMsg = imapError(e);
+            this.emit("syncError", accountId, errMsg);
+            this.recordError(accountId, errMsg);
+            console.error(`Sync error for ${accountId}: ${errMsg}`);
+            this.handleSyncError(accountId, errMsg);
+        }
+    }
+    /** Sync a Gmail account via REST API — no IMAP connections */
+    async syncAccountViaApi(accountId, priorityOrder) {
+        try {
+            const api = this.getGmailProvider(accountId);
+            const t0 = Date.now();
+            // Step 1: Sync folder list via API
+            console.log(`  [api] ${accountId}: listing labels...`);
+            const apiFolders = await api.listFolders();
+            console.log(`  [api] ${accountId}: ${apiFolders.length} labels in ${Date.now() - t0}ms`);
+            // Store folders in DB (same as IMAP path)
+            for (const f of apiFolders) {
+                const specialUse = f.specialUse || "";
+                this.db.upsertFolder(accountId, f.path, f.name, specialUse, f.delimiter);
+            }
+            this.emit("folderCountsChanged", accountId, {});
+            const dbFolders = this.db.getFolders(accountId);
+            // Step 2: Sync folders — INBOX first, then by priority
+            const inbox = dbFolders.find(f => f.specialUse === "inbox");
+            const remaining = dbFolders.filter(f => f.specialUse !== "inbox");
+            remaining.sort((a, b) => {
+                const pa = priorityOrder.indexOf(a.specialUse || "") >= 0 ? priorityOrder.indexOf(a.specialUse || "") : 5;
+                const pb = priorityOrder.indexOf(b.specialUse || "") >= 0 ? priorityOrder.indexOf(b.specialUse || "") : 5;
+                return pa - pb;
+            });
+            const foldersToSync = inbox ? [inbox, ...remaining] : remaining;
+            for (const folder of foldersToSync) {
+                try {
+                    await this.syncFolderViaApi(accountId, folder, api);
+                }
+                catch (e) {
+                    console.error(`  [api] ${accountId}/${folder.path}: ${e.message}`);
+                }
+            }
+            await api.close();
+            this.accountErrorShown.delete(accountId);
+            this.emit("syncComplete", accountId);
+        }
+        catch (e) {
+            const errMsg = e.message || String(e);
+            this.emit("syncError", accountId, errMsg);
+            console.error(`  [api] Sync error for ${accountId}: ${errMsg}`);
+            this.handleSyncError(accountId, errMsg);
+            // Propagate so the caller skips the prefetch that would otherwise
+            // fire straight into the same 429/cooldown and make it worse.
+            throw e;
+        }
+    }
+    /** Sync a single folder via Gmail/Outlook API */
+    async syncFolderViaApi(accountId, folder, api) {
+        const highestUid = this.db.getHighestUid(accountId, folder.id);
+        const historyDays = getHistoryDays(accountId);
+        const effectiveDays = (historyDays === 0 && highestUid === 0) ? 30 : historyDays;
+        const startDate = effectiveDays > 0 ? new Date(Date.now() - effectiveDays * 86400000) : new Date(0);
+        const tomorrow = new Date(Date.now() + 86400000);
+        this.emit("syncProgress", accountId, `sync:${folder.path}`, 0);
+        console.log(`  [api] ${accountId}/${folder.path}: syncing (highestUid=${highestUid})...`);
+        let messages;
+        if (highestUid > 0) {
+            // Incremental: fetch messages since last known UID.
+            // Gmail "UIDs" are hashed (not chronological), so fetchSince
+            // returns messages in hash order — they can be from ANY date.
+            // Pass the date window so the provider can page the whole range
+            // (otherwise Gmail's default 200-id cap truncates high-volume
+            // inboxes to ~10 days regardless of historyDays).
+            const fetchOpts = { source: false };
+            if (effectiveDays > 0)
+                fetchOpts.since = startDate;
+            messages = await api.fetchSince(folder.path, highestUid, fetchOpts);
+            if (effectiveDays > 0) {
+                const cutoff = startDate.getTime();
+                const before = messages.length;
+                messages = messages.filter(m => !m.date || m.date.getTime() >= cutoff);
+                if (messages.length < before) {
+                    console.log(`  [api] ${accountId}/${folder.path}: filtered ${before - messages.length} messages older than ${effectiveDays}d`);
+                }
+            }
+            // Backfill: if the history window reaches further back than our
+            // oldest local message, fetch the gap. Mirrors the IMAP path —
+            // otherwise a user who started with historyDays=30 and later
+            // sets it to 0 (or 365) never actually sees older mail. Cap
+            // each sync cycle at 90 days so unlimited-history accounts
+            // catch up incrementally instead of paging the whole mailbox.
+            const oldestDate = this.db.getOldestDate(accountId, folder.id);
+            if (oldestDate > 0 && startDate.getTime() < oldestDate) {
+                try {
+                    const CHUNK_MS = 90 * 86400000;
+                    const chunkStart = new Date(Math.max(startDate.getTime(), oldestDate - CHUNK_MS));
+                    const existingUids = new Set(this.db.getUidsForFolder(accountId, folder.id));
+                    const backfill = await api.fetchByDate(folder.path, chunkStart, new Date(oldestDate), { source: false });
+                    const newBackfill = backfill.filter(m => !existingUids.has(m.uid));
+                    if (newBackfill.length > 0) {
+                        console.log(`  [api] ${accountId}/${folder.path}: backfilling ${newBackfill.length} older messages (${chunkStart.toISOString().slice(0, 10)} → ${new Date(oldestDate).toISOString().slice(0, 10)})`);
+                        messages.push(...newBackfill);
+                    }
+                }
+                catch (e) {
+                    console.error(`  [api] ${accountId}/${folder.path}: backfill failed: ${e.message}`);
+                }
+            }
+        }
+        else {
+            // First sync: fetch by date range
+            messages = await api.fetchByDate(folder.path, startDate, tomorrow, { source: false }, (chunk) => {
+                // Stream chunks to DB for instant UI
+                const stored = this.storeApiMessages(accountId, folder.id, chunk, highestUid);
+                if (stored > 0) {
+                    this.db.recalcFolderCounts(folder.id);
+                    this.emit("folderCountsChanged", accountId, {});
+                }
+            });
+            // First sync chunks already stored via onChunk — just update counts
+            this.db.recalcFolderCounts(folder.id);
+            this.emit("folderCountsChanged", accountId, {});
+            this.emit("syncProgress", accountId, `sync:${folder.path}`, 100);
+            if (messages.length > 0)
+                console.log(`  [api] ${accountId}/${folder.path}: ${messages.length} messages`);
+            return;
+        }
+        if (messages.length > 0) {
+            console.log(`  [api] ${accountId}/${folder.path}: ${messages.length} new messages`);
+            this.storeApiMessages(accountId, folder.id, messages, highestUid);
+        }
+        // Reconcile deletions — messages present locally but not on the server.
+        // SAFETY: this used to silently wipe entire folders when getUids()
+        // returned a partial list (e.g. paginated fetch hit a rate limit and
+        // bailed). Multiple guards now:
+        //   1. getUids() flags partial results via _truncated — refuse to delete
+        //   2. If server list is empty but local isn't, assume a transient error
+        //   3. If reconcile would delete more than RECONCILE_DELETE_THRESHOLD of
+        //      local messages, log and skip — safer to keep phantoms than to lose
+        //      real messages. User can fix with `mailx -rebuild` if needed.
+        try {
+            const serverUidsArr = await api.getUids(folder.path);
+            const serverUids = new Set(serverUidsArr);
+            const localUids = this.db.getUidsForFolder(accountId, folder.id);
+            if (serverUidsArr._truncated) {
+                console.log(`  [api] ${accountId}/${folder.path}: reconcile skipped — server list truncated (${serverUidsArr.length} ids)`);
+            }
+            else if (serverUidsArr.length === 0 && localUids.length > 0) {
+                console.log(`  [api] ${accountId}/${folder.path}: reconcile skipped — server list empty but local has ${localUids.length}`);
+            }
+            else {
+                const toDelete = localUids.filter(uid => !serverUids.has(uid));
+                const RECONCILE_DELETE_THRESHOLD = 0.5; // refuse to delete >50% in one pass
+                if (localUids.length > 0 && toDelete.length / localUids.length > RECONCILE_DELETE_THRESHOLD) {
+                    console.log(`  [api] ${accountId}/${folder.path}: reconcile refused — would delete ${toDelete.length}/${localUids.length} (${Math.round(toDelete.length / localUids.length * 100)}%) — probably a sync bug, skipping`);
+                }
+                else {
+                    for (const uid of toDelete) {
+                        const env = this.db.getMessageByUid(accountId, uid);
+                        const tag = env ? `msgid=${env.messageId || "?"} subj="${(env.subject || "").slice(0, 60)}"` : "unknown";
+                        console.log(`  [reconcile-delete] ${accountId}/${folder.path} uid=${uid} ${tag}`);
+                        this.unlinkBodyFile(accountId, uid, folder.id).catch(() => { });
+                        this.db.deleteMessage(accountId, uid);
+                    }
+                    if (toDelete.length > 0)
+                        console.log(`  [api] ${accountId}/${folder.path}: ${toDelete.length} deleted`);
+                }
+            }
+        }
+        catch (e) {
+            console.error(`  [api] ${accountId}/${folder.path}: reconciliation error: ${e.message}`);
+        }
+        this.db.recalcFolderCounts(folder.id);
+        this.emit("folderCountsChanged", accountId, {});
+        this.emit("folderSynced", accountId, folder.id, Date.now());
+        this.emit("syncProgress", accountId, `sync:${folder.path}`, 100);
+    }
+    /** Store API-fetched messages to DB */
+    storeApiMessages(accountId, folderId, msgs, highestUid) {
+        // highestUid kept for signature compatibility but no longer used to
+        // filter — Gmail message IDs aren't monotonic, so `msg.uid <= highestUid`
+        // would drop brand-new messages whose hash happens to be smaller than
+        // the previous high. upsertMessage's primary-key dedup handles it.
+        void highestUid;
+        let stored = 0;
+        let errors = 0;
+        // Don't wrap the whole batch in one transaction: a single bad row
+        // would roll back the entire batch. E.g. a message with a malformed
+        // Date header gave `new Date(rawStr).getTime() === NaN`, SQLite
+        // coerced that to NULL, the NOT NULL constraint failed, and the
+        // whole Gmail sync lost 200 messages per tick. Now each row runs
+        // standalone — bad rows are logged and skipped.
+        for (const msg of msgs) {
+            try {
+                // Tombstone check — Gmail API sync was missing this so a
+                // locally-trashed Gmail message would reappear on the next
+                // listMessages tick if Gmail's eventual-consistency hadn't
+                // promoted the trash yet. Symmetric with the IMAP paths.
+                if (msg.messageId && this.db.hasTombstone(accountId, msg.messageId)) {
+                    continue;
+                }
+                const flags = [];
+                if (msg.seen)
+                    flags.push("\\Seen");
+                if (msg.flagged)
+                    flags.push("\\Flagged");
+                if (msg.answered)
+                    flags.push("\\Answered");
+                if (msg.draft)
+                    flags.push("\\Draft");
+                // Sanitize date: reject NaN (from malformed RFC 822 Date headers)
+                // and fall back to "now" so the message still lands in the DB.
+                let dateMs = Date.now();
+                if (msg.date instanceof Date) {
+                    const t = msg.date.getTime();
+                    if (Number.isFinite(t))
+                        dateMs = t;
+                }
+                this.db.upsertMessage({
+                    accountId, folderId, uid: msg.uid,
+                    messageId: msg.messageId || "",
+                    inReplyTo: msg.inReplyTo || "",
+                    references: msg.references || [],
+                    date: dateMs,
+                    subject: msg.subject || "",
+                    from: toEmailAddress(msg.from?.[0] || {}),
+                    to: toEmailAddresses(msg.to || []),
+                    cc: toEmailAddresses(msg.cc || []),
+                    flags, size: msg.size || 0, hasAttachments: false, preview: "", bodyPath: "",
+                    providerId: msg.providerId || "",
+                });
+                stored++;
+            }
+            catch (e) {
+                errors++;
+                if (errors <= 3) {
+                    console.error(`  [api] upsert ${accountId}/${folderId}/${msg.uid} (${msg.messageId}): ${e.message}`);
+                }
+            }
+        }
+        if (errors > 0)
+            console.error(`  [api] storeApiMessages: ${errors} of ${msgs.length} rows failed (${stored} stored)`);
+        return stored;
+    }
+    /** Kill and recreate the persistent ops connection */
+    async reconnectOps(accountId) {
+        const old = this.opsClients.get(accountId);
+        this.opsClients.delete(accountId);
+        if (old) {
+            try {
+                await (old._realLogout || old.logout)();
+            }
+            catch { /* */ }
+        }
+        console.log(`  [conn] ${accountId}: reconnecting`);
+    }
+    /** Handle sync errors — classify and emit appropriate UI events.
+     *  The connection-cap branch was removed: with the unified ops queue +
+     *  per-host semaphore, mailx alone can't exceed the server cap. If the
+     *  cap *is* hit, that means another client (Thunderbird, phone, sibling
+     *  process) is holding slots — punishing mailx with a multi-minute
+     *  blackout doesn't help the user, the next sync tick will retry. */
+    handleSyncError(accountId, errMsg) {
+        const config = this.configs.get(accountId);
+        const isOAuth = !!config?.tokenProvider;
+        const isTransient = /timeout|ECONNREFUSED|ECONNRESET|ETIMEDOUT|ENETUNREACH|Too many/i.test(errMsg);
+        const isAuth = /auth|login|credential|token|AUTHENTICATIONFAILED/i.test(errMsg);
+        if (isTransient) {
+            console.log(`  [transient] ${accountId}: ${errMsg} — will retry next cycle`);
+        }
+        else if (isAuth && isOAuth) {
+            const lastReauth = this.lastReauthAttempt.get(accountId) || 0;
+            if (Date.now() - lastReauth > 300000 && !this.reauthenticating.has(accountId)) {
+                this.lastReauthAttempt.set(accountId, Date.now());
+                this.reauthenticate(accountId).catch(() => { });
+            }
+            if (!this.accountErrorShown.has(accountId)) {
+                this.accountErrorShown.add(accountId);
+                this.emit("accountError", accountId, errMsg, "Authentication expired — re-authenticate", true);
+            }
+        }
+        else if (!this.accountErrorShown.has(accountId)) {
+            this.accountErrorShown.add(accountId);
+            this.emit("accountError", accountId, errMsg, errMsg, isOAuth);
+        }
+    }
+    /** Fetch ONLY new messages above highestUid for one account's INBOX —
+     *  the IDLE callback's hot path. Skips gap detection, backfill, and the
+     *  server reconcile (each of which fetches a full UID list — multi-second
+     *  on a large mailbox). The 5-minute STATUS poll path still runs full
+     *  `syncFolder` so deletions and gaps eventually reconcile. */
+    async syncInboxNewOnly(accountId) {
+        if (this.isGmailAccount(accountId))
+            return; // IDLE is IMAP-only
+        const inbox = this.db.getFolders(accountId).find(f => f.specialUse === "inbox");
+        if (!inbox)
+            return;
+        try {
+            await this.withConnection(accountId, async (client) => {
+                const highestUid = this.db.getHighestUid(accountId, inbox.id);
+                if (highestUid === 0) {
+                    // First sync — fall through to full path so the date-windowed
+                    // backfill runs. `syncFolder` handles the no-highestUid case.
+                    await this.syncFolder(accountId, inbox.id, client);
+                    return;
+                }
+                const fetched = await client.fetchMessagesSinceUid(inbox.path, highestUid, { source: false });
+                const fresh = fetched.filter((m) => m.uid > highestUid);
+                if (fresh.length === 0)
+                    return;
+                const stored = await this.storeMessages(accountId, inbox.id, inbox, fresh, highestUid);
+                if (stored > 0) {
+                    this.db.recalcFolderCounts(inbox.id);
+                    const updated = this.db.getFolders(accountId).find(f => f.id === inbox.id);
+                    this.emit("folderCountsChanged", accountId, {
+                        [inbox.id]: { total: updated?.totalCount || 0, unread: updated?.unreadCount || 0 }
+                    });
+                    this.emit("folderSynced", accountId, inbox.id, Date.now());
+                    console.log(`  [idle-fast] ${accountId}: stored ${stored} new message(s)`);
+                }
+            });
+        }
+        catch (e) {
+            console.error(`  [idle-fast] ${accountId}: ${e.message}`);
+        }
+    }
+    /** Sync just INBOX for each account (fast check for new mail) */
+    async syncInbox() {
+        if (this.inboxSyncing)
+            return;
+        this.inboxSyncing = true;
+        try {
+            for (const [accountId] of this.configs) {
+                try {
+                    const inbox = this.db.getFolders(accountId).find(f => f.specialUse === "inbox");
+                    if (!inbox)
+                        continue;
+                    // Gmail: use REST API, NOT IMAP. Mixing paths causes UID
+                    // mismatch — API uses hashed IDs, IMAP uses server-assigned
+                    // UIDs. The IMAP reconcile then deletes every API-synced
+                    // message because their UIDs don't appear in the IMAP list.
+                    if (this.isGmailAccount(accountId)) {
+                        const api = this.getGmailProvider(accountId);
+                        try {
+                            await this.syncFolderViaApi(accountId, inbox, api);
+                        }
+                        finally {
+                            try {
+                                await api.close();
+                            }
+                            catch { /* ignore */ }
+                        }
+                    }
+                    else {
+                        await this.withConnection(accountId, async (client) => {
+                            await this.syncFolder(accountId, inbox.id, client);
+                        });
+                    }
+                }
+                catch (e) {
+                    console.error(`  [inbox] Sync error for ${accountId}: ${e.message}`);
+                }
+            }
+        }
+        finally {
+            this.inboxSyncing = false;
+        }
+    }
+    /** Quick inbox check — per-account lightweight probe.
+     *  If the probe value changed since last time, triggers an inbox sync.
+     *  The marker is only advanced after a successful sync so that a failed
+     *  sync doesn't eat the "new mail" signal and make us stop retrying. */
+    lastInboxMarker = new Map();
+    quickCheckRunning = new Set(); // per-account guard
+    /** Shared quick-check skeleton: probe → compare → sync-if-changed → advance marker.
+     *  `probe` returns the current marker value; `sync` runs only when it differs
+     *  from the previously stored value. Marker is advanced only after sync resolves. */
+    async quickCheck(accountId, probe, sync) {
+        if (this.quickCheckRunning.has(accountId))
+            return;
+        if (this.reauthenticating.has(accountId))
+            return;
+        this.quickCheckRunning.add(accountId);
+        try {
+            const current = await probe();
+            if (current === null || current === "")
+                return;
+            const prev = this.lastInboxMarker.get(accountId);
+            if (prev === undefined || current !== prev) {
+                await sync(current, prev);
+            }
+            // Only advance after sync succeeds — a thrown error skips this line
+            // and the next tick will see the same delta and retry.
+            this.lastInboxMarker.set(accountId, current);
+        }
+        catch {
+            // Lightweight check — silently ignore errors
+        }
+        finally {
+            this.quickCheckRunning.delete(accountId);
+        }
+    }
+    /** Check a single account's inbox — uses its own connection, never blocked by sync */
+    async quickInboxCheckAccount(accountId) {
+        if (this.isGmailAccount(accountId))
+            return this.quickGmailCheck(accountId);
+        return this.quickImapCheck(accountId);
+    }
+    async quickImapCheck(accountId) {
+        const inbox = this.db.getFolders(accountId).find(f => f.specialUse === "inbox");
+        if (!inbox)
+            return;
+        let client = null;
+        try {
+            await this.quickCheck(accountId, async () => {
+                client = await this.newClient(accountId, "quickCheck");
+                return await client.getMessagesCount("INBOX");
+            }, async (count, prev) => {
+                if (prev !== undefined)
+                    console.log(`  [check] ${accountId} INBOX: ${prev} → ${count}`);
+                await this.syncFolder(accountId, inbox.id, client);
+            });
+        }
+        finally {
+            if (client) {
+                try {
+                    await client.logout();
+                }
+                catch { /* */ }
+            }
+        }
+    }
+    async quickGmailCheck(accountId) {
+        const config = this.configs.get(accountId);
+        if (!config?.tokenProvider)
+            return;
+        const inbox = this.db.getFolders(accountId).find(f => f.specialUse === "inbox");
+        if (!inbox)
+            return;
+        await this.quickCheck(accountId, async () => {
+            const token = await config.tokenProvider();
+            const res = await globalThis.fetch(`https://gmail.googleapis.com/gmail/v1/users/me/messages?q=in:inbox&maxResults=1`, { headers: { "Authorization": `Bearer ${token}` } });
+            if (!res.ok)
+                return null;
+            const data = await res.json();
+            return data.messages?.[0]?.id || null;
+        }, async (_topId, prev) => {
+            if (prev !== undefined)
+                console.log(`  [check] ${accountId} INBOX: new message detected`);
+            const api = this.getGmailProvider(accountId);
+            await this.syncFolderViaApi(accountId, inbox, api);
+            this.db.recalcFolderCounts(inbox.id);
+            this.emit("folderCountsChanged", accountId, {});
+            await api.close();
+        });
+    }
+    /** Check all accounts (used by legacy callers) */
+    async quickInboxCheck() {
+        for (const [accountId] of this.configs) {
+            await this.quickInboxCheckAccount(accountId);
+        }
+    }
+    /** Start periodic sync */
+    startPeriodicSync(intervalMinutes) {
+        this.stopPeriodicSync();
+        // Per-account quick inbox check — adapts to server constraints.
+        // Accounts with IDLE running get a long interval (5 min) because IDLE
+        // already pushes instant notifications — the STATUS poll is just a
+        // safety net. Non-IDLE accounts (rare) use a shorter interval.
+        //
+        // CRITICAL: the previous value (2500ms for everyone) was hammering
+        // Dovecot with 24 logins per minute. That's what tripped the server
+        // operator's fail2ban on mail1, and was still flooding the desktop
+        // connection. Each STATUS poll creates a disposable connection
+        // (TLS + auth + STATUS + close), not a lightweight keep-alive.
+        for (const [accountId] of this.configs) {
+            // Gmail uses API sync, not IMAP STATUS. IMAP accounts use IDLE
+            // which gives instant push — the STATUS poll is just a fallback
+            // in case IDLE silently dropped.
+            const isGmail = this.isGmailAccount(accountId);
+            // IMAP accounts: IDLE gives instant push; STATUS poll is just a
+            // safety net for silent IDLE drops — keep it infrequent.
+            // Gmail accounts: no IDLE (Gmail API doesn't expose it), so the
+            // quick poll IS the primary path to new-mail latency. Drop to 30s
+            // so Gmail mail appears in ~15s average. Gmail quota budget is
+            // huge (250 units/sec per user, 1.2B/day) — 120 polls/hour × 5
+            // units ≈ 600/hour, trivial. Dovecot accounts stay at 5min to
+            // respect connection limits (each poll = fresh connection).
+            const interval = isGmail ? 30000 : 300000; // Gmail: 30s; IMAP: 5min
+            const timer = setInterval(() => {
+                this.quickInboxCheckAccount(accountId).catch(() => { });
+            }, interval);
+            this.syncIntervals.set(`quick:${accountId}`, timer);
+            console.log(`  [periodic] ${accountId}: STATUS check every ${interval / 1000}s (${isGmail ? "API" : "IMAP+IDLE"})`);
+        }
+        // Sync actions (sends + flags/deletes/moves) every 30 seconds — skip during active sync
+        const actionsInterval = setInterval(async () => {
+            if (this.syncing)
+                return;
+            for (const [accountId] of this.configs) {
+                this.processSendActions(accountId).catch(() => { });
+                this.processSyncActions(accountId).catch(() => { });
+            }
+        }, 30000);
+        this.syncIntervals.set("actions", actionsInterval);
+        // Body prefetch as a first-class background task — independent of
+        // sync success. Prefetch was previously only triggered from inside
+        // sync, so any account with slow/failing IMAP had its "not downloaded"
+        // dots stuck forever even though body fetches use a separate
+        // connection that might succeed. Every 60s, for every account, fire
+        // prefetchBodies() (cheap when body_path is already populated — just a
+        // DB query that returns 0 rows; the prefetchingAccounts guard
+        // short-circuits concurrent triggers).
+        if (getPrefetch()) {
+            const kickPrefetch = () => {
+                for (const [accountId] of this.configs) {
+                    this.prefetchBodies(accountId).catch(e => console.error(`  [prefetch] ${accountId}: ${e?.message || e}`));
+                }
+            };
+            // Fire once now so the "not downloaded" dots start filling in
+            // immediately on app start, don't make the user wait a minute.
+            setTimeout(kickPrefetch, 2000);
+            const prefetchInterval = setInterval(kickPrefetch, 60000);
+            this.syncIntervals.set("prefetch", prefetchInterval);
+            console.log(`  [periodic] body prefetch every 60s (independent of sync)`);
+        }
+        // Tombstone prune: age out local-delete records older than 30 days.
+        // Runs hourly — cheap (one indexed DELETE).
+        const TOMBSTONE_RETENTION_DAYS = 30;
+        const pruneTombstones = () => {
+            const cutoff = Date.now() - TOMBSTONE_RETENTION_DAYS * 86400_000;
+            const n = this.db.pruneTombstones(cutoff);
+            if (n > 0)
+                console.log(`  [tombstones] pruned ${n} older than ${TOMBSTONE_RETENTION_DAYS} days`);
+        };
+        setTimeout(pruneTombstones, 30_000); // first run after startup settles
+        this.syncIntervals.set("tombstone-prune", setInterval(pruneTombstones, 3600_000));
+        // Full sync (all folders + IDLE restart) at configured interval
+        const fullInterval = setInterval(async () => {
+            console.log(`  [periodic] Full sync at ${new Date().toLocaleTimeString()}`);
+            await this.syncAll();
+            await this.stopWatching();
+            await this.startWatching();
+        }, intervalMinutes * 60000);
+        this.syncIntervals.set("all", fullInterval);
+    }
+    /** Stop periodic sync */
+    stopPeriodicSync() {
+        for (const [key, interval] of this.syncIntervals) {
+            clearInterval(interval);
+        }
+        this.syncIntervals.clear();
+    }
+    /** Check if an account is OAuth (Gmail/Outlook — generous connection limits) */
+    isOAuthAccount(accountId) {
+        const config = this.configs.get(accountId);
+        return !!config?.tokenProvider;
+    }
+    /** Start IMAP IDLE watchers for INBOX on each account */
+    async startWatching() {
+        for (const [accountId] of this.configs) {
+            if (this.watchers.has(accountId))
+                continue;
+            try {
+                // IDLE keeps its own dedicated socket — once the connection
+                // is parked in IDLE, it's unusable for any other command, so
+                // it can't share the ops queue. Counts against the per-host
+                // semaphore (one slot for the IDLE socket).
+                const watchClient = await this.createClient(accountId, "idle");
+                const stop = await watchClient.watchMailbox("INBOX", (newCount) => {
+                    console.log(`  [idle] ${accountId}: ${newCount} new message(s)`);
+                    // Fetch only the new UIDs — the heavyweight gap/reconcile
+                    // path runs on the 5-minute STATUS poll, so EXISTS lands
+                    // in the UI in roughly one round-trip.
+                    this.syncInboxNewOnly(accountId).catch(e => console.error(`  [idle] sync error: ${e.message}`));
+                });
+                this.watchers.set(accountId, async () => {
+                    await stop();
+                    await watchClient.logout();
+                });
+                console.log(`  [idle] Watching INBOX for ${accountId}`);
+            }
+            catch (e) {
+                console.error(`  [idle] Failed to watch ${accountId}: ${e.message}`);
+            }
+        }
+    }
+    /** Stop all IDLE watchers */
+    async stopWatching() {
+        for (const [id, stop] of this.watchers) {
+            try {
+                await stop();
+            }
+            catch { /* ignore */ }
+        }
+        this.watchers.clear();
+    }
+    /** Unlink the on-disk body file for a message by reading its `body_path`
+     *  from the DB. Safe to call either before or after `db.deleteMessage`
+     *  — read body_path first, store it, then unlink whenever. */
+    async unlinkBodyFile(accountId, uid, folderId) {
+        try {
+            const row = this.db.getMessageByUid(accountId, uid, folderId);
+            const p = row?.bodyPath;
+            if (p)
+                await this.bodyStore.unlinkByPath(p);
+        }
+        catch { /* row already gone / file already gone — both fine */ }
+    }
+    /** Fetch a single message body on demand, caching in the store.
+     *
+     *  Cache lookup is folder-agnostic: when a UID exists in multiple folders
+     *  (Gmail labels, copy-instead-of-move) the prefetcher may have populated
+     *  body_path on only one row. Looking up by (account, uid) without the
+     *  folder filter finds the cached `.eml` regardless of which folder
+     *  context the UI passed.
+     *
+     *  Server fetch goes through the unified ops queue on the fast lane —
+     *  the user clicked, they're waiting, this jumps ahead of any background
+     *  prefetch sitting in the slow lane. */
+    async fetchMessageBody(accountId, folderId, uid) {
+        const envelope = this.db.getMessageByUid(accountId, uid, folderId);
+        let storedPath = envelope?.bodyPath || "";
+        if (!storedPath)
+            storedPath = this.db.getMessageBodyPath(accountId, uid) || "";
+        if (storedPath && await this.bodyStore.hasByPath(storedPath)) {
+            return this.bodyStore.readByPath(storedPath);
+        }
+        if (!this.configs.has(accountId))
+            return null;
+        const folder = this.db.getFolders(accountId).find(f => f.id === folderId);
+        if (!folder)
+            return null;
+        // Gmail: REST API, no IMAP connection involved.
+        if (this.isGmailAccount(accountId)) {
+            return this.fetchMessageBodyViaApi(accountId, folderId, uid, folder.path);
+        }
+        // IMAP: fast lane on the ops queue. One try; if the socket is stale,
+        // withConnection's discard-on-error logic drops the client so the
+        // next attempt (caller-driven retry) gets a fresh one.
+        try {
+            const raw = await this.withConnection(accountId, async (client) => {
+                const msg = await client.fetchMessageByUid(folder.path, uid, { source: true });
+                if (!msg)
+                    throw makeNotFoundError(accountId, folderId, uid);
+                if (!msg.source)
+                    return null;
+                return Buffer.from(msg.source, "utf-8");
+            });
+            if (!raw)
+                return null;
+            const bodyPath = await this.bodyStore.putMessage(accountId, folderId, uid, raw);
+            this.db.updateBodyPath(accountId, uid, bodyPath);
+            this.emit("bodyCached", accountId, uid);
+            return raw;
+        }
+        catch (e) {
+            if (e?.isNotFound)
+                throw e;
+            console.error(`  Body fetch error (${accountId}/${uid}): ${e?.message || e}`);
+            return null;
+        }
+    }
+    /** Fetch message body via Gmail/Outlook API.
+     *  Throws `MessageNotFoundError` when the server says the message is gone
+     *  (deleted from another device, for example). The caller uses that to
+     *  delete the stale row locally instead of showing a generic error. */
+    async fetchMessageBodyViaApi(accountId, folderId, uid, folderPath) {
+        try {
+            const api = this.getGmailProvider(accountId);
+            // Read provider_id from the local row so fetchOne can skip the
+            // listMessageIds pagination (the dominant Gmail rate-limit cost).
+            const env = this.db.getMessageByUid(accountId, uid, folderId);
+            const providerId = env?.providerId;
+            const msg = await api.fetchOne(folderPath, uid, { source: true, providerId });
+            await api.close();
+            if (!msg) {
+                // fetchOne returned null — message doesn't exist on the server anymore
+                throw makeNotFoundError(accountId, folderId, uid);
+            }
+            if (!msg.source) {
+                // Gmail returned a message object but no raw bytes. Seen when:
+                //  (a) the message exists but is larger than the format=raw cap (~10MB),
+                //  (b) UID→Gmail-ID resolution picked a collision and the target
+                //      exists only as a stub, or (c) the listMessageIds top-1000
+                //      didn't include our UID and fetchOne returned null above —
+                //      wait, that would hit the !msg branch. So (a)/(b) remain.
+                // Log enough to distinguish; surface the reason up via a non-null
+                // return so the UI stops showing a generic "fetch returned nothing".
+                console.error(`  [api] Body fetch empty source (${accountId}/${uid}): Gmail returned no raw body — likely too-large-for-format-raw or UID hash collision`);
+                return null;
+            }
+            const raw = Buffer.from(msg.source, "utf-8");
+            const bodyPath = await this.bodyStore.putMessage(accountId, folderId, uid, raw);
+            this.db.updateBodyPath(accountId, uid, bodyPath);
+            this.emit("bodyCached", accountId, uid);
+            return raw;
+        }
+        catch (e) {
+            // Gmail API 404 → the message was deleted on the server
+            if (e?.isNotFound || /Gmail API 404|404|not found/i.test(e?.message || "")) {
+                throw makeNotFoundError(accountId, folderId, uid);
+            }
+            console.error(`  [api] Body fetch error (${accountId}/${uid}): ${e.message}`);
+            return null;
+        }
+    }
+    /** Background body prefetch — download bodies for messages that don't have them.
+     *  Server-side deletions (isNotFound) aren't errors here: we delete the
+     *  stale row locally and keep going. Only unrelated errors (network,
+     *  auth, rate limits) count against the error budget, and the budget is
+     *  generous so a few transient failures don't kill the whole run. */
+    /** Guard against concurrent prefetchBodies for the same account — mirror of
+     *  `sendingAccounts`. Without this, every periodic-sync tick spawns a new
+     *  prefetch session alongside any still in flight, blowing through Gmail's
+     *  per-minute quota and racing on disk writes. One prefetch per account. */
+    prefetchingAccounts = new Set();
+    /** Per-folder error cooldowns — `accountId:folderPath` → [timestamps].
+     *  Used to skip folders that repeatedly time out (Dovecot on slow shared
+     *  hosting SELECTs big `_Spam` / archive folders at 300s+ latency; the
+     *  prefetch error budget was burning out on a handful of bad folders
+     *  before the INBOX could finish). A folder with 2+ errors in the last
+     *  15 minutes is skipped until the cooldown passes. User-reported via
+     *  log analysis 2026-04-23: bobma prefetch timing out on Added2.organizations,
+     *  Added2.technews, _Spam, "Prefirst.Jerry's Retreat", Added2.zines. */
+    folderErrorCooldown = new Map();
+    FOLDER_ERROR_WINDOW_MS = 15 * 60_000;
+    FOLDER_ERROR_THRESHOLD = 2;
+    shouldSkipFolder(accountId, folderPath) {
+        const key = `${accountId}:${folderPath}`;
+        const now = Date.now();
+        const errors = (this.folderErrorCooldown.get(key) || [])
+            .filter(t => now - t < this.FOLDER_ERROR_WINDOW_MS);
+        this.folderErrorCooldown.set(key, errors);
+        return errors.length >= this.FOLDER_ERROR_THRESHOLD;
+    }
+    recordFolderError(accountId, folderPath) {
+        const key = `${accountId}:${folderPath}`;
+        const arr = this.folderErrorCooldown.get(key) || [];
+        arr.push(Date.now());
+        this.folderErrorCooldown.set(key, arr);
+    }
+    clearFolderErrors(accountId, folderPath) {
+        this.folderErrorCooldown.delete(`${accountId}:${folderPath}`);
+    }
+    async prefetchBodies(accountId) {
+        if (this.prefetchingAccounts.has(accountId))
+            return;
+        this.prefetchingAccounts.add(accountId);
+        try {
+            await this._prefetchBodies(accountId);
+        }
+        finally {
+            this.prefetchingAccounts.delete(accountId);
+        }
+    }
+    async _prefetchBodies(accountId) {
+        const counters = { totalFetched: 0, deleted: 0, errors: 0 };
+        const ERROR_BUDGET = 20;
+        const RATE_LIMIT_PAUSE_MS = 30000;
+        const BATCH_SIZE = 100;
+        const isGmail = this.isGmailAccount(accountId);
+        // Gmail still uses per-message fetch (HTTP /batch is a separate TODO in this file's
+        // governing unit). IMAP uses the batched `fetchBodiesBatch` path via iflow-direct —
+        // one SELECT + one UID FETCH per folder per tick instead of N round trips.
+        let announced = false;
+        while (true) {
+            const missing = this.db.getMessagesWithoutBody(accountId, BATCH_SIZE);
+            if (missing.length === 0)
+                break;
+            if (!announced) {
+                console.log(`  [prefetch] ${accountId}: ${missing.length}+ bodies to fetch`);
+                announced = true;
+            }
+            let madeProgress = false;
+            if (isGmail) {
+                // Gmail batch path: group by label (what mailx calls "folder"),
+                // list once per label, bounded-concurrency fetch. Far fewer
+                // HTTP round trips than the old one-listMessageIds-per-body path.
+                // Note on the model: Gmail has labels, not folders. A message in
+                // multiple labels gets fetched twice under current grouping. A
+                // deeper label-native redesign is tracked as a separate TODO.
+                const byFolder = new Map();
+                for (const m of missing) {
+                    let arr = byFolder.get(m.folderId);
+                    if (!arr) {
+                        arr = [];
+                        byFolder.set(m.folderId, arr);
+                    }
+                    arr.push(m.uid);
+                }
+                const folders = this.db.getFolders(accountId);
+                const api = this.getGmailProvider(accountId);
+                try {
+                    for (const [folderId, uidsInFolder] of byFolder) {
+                        const folder = folders.find(f => f.id === folderId);
+                        if (!folder)
+                            continue;
+                        const received = new Set();
+                        const pending = [];
+                        let batchSucceeded = false;
+                        try {
+                            await api.fetchBodiesBatch(folder.path, uidsInFolder, (uid, source) => {
+                                received.add(uid);
+                                pending.push((async () => {
+                                    try {
+                                        const raw = Buffer.from(source, "utf-8");
+                                        const bodyPath = await this.bodyStore.putMessage(accountId, folderId, uid, raw);
+                                        this.db.updateBodyPath(accountId, uid, bodyPath);
+                                        this.emit("bodyCached", accountId, uid);
+                                        counters.totalFetched++;
+                                        madeProgress = true;
+                                    }
+                                    catch (e) {
+                                        console.error(`  [prefetch] ${accountId}/${uid}: store write failed: ${e.message}`);
+                                    }
+                                })());
+                            });
+                            batchSucceeded = true;
+                        }
+                        catch (e) {
+                            const isRate = /429|rate|too many/i.test(String(e?.message || ""));
+                            if (isRate) {
+                                console.log(`  [prefetch] ${accountId}: rate-limited — pausing ${RATE_LIMIT_PAUSE_MS / 1000}s`);
+                                await new Promise(r => setTimeout(r, RATE_LIMIT_PAUSE_MS));
+                            }
+                            else {
+                                console.error(`  [prefetch] ${accountId} folder ${folder.path}: Gmail batch fetch failed: ${e.message}`);
+                                counters.errors++;
+                            }
+                        }
+                        await Promise.all(pending);
+                        // CRITICAL: only prune as "server-deleted" when the batch
+                        // actually completed. If the batch threw (403, 429, network
+                        // error, etc.) NOTHING was received, and treating every
+                        // requested UID as deleted silently wipes 100 messages per
+                        // batch. That's a data-loss bug. Earlier version did this
+                        // and pruned 296 messages on a 403 auth error.
+                        if (batchSucceeded) {
+                            for (const uid of uidsInFolder) {
+                                if (received.has(uid))
+                                    continue;
+                                try {
+                                    this.unlinkBodyFile(accountId, uid, folderId).catch(() => { });
+                                    this.db.deleteMessage(accountId, uid);
+                                    counters.deleted++;
+                                    madeProgress = true;
+                                }
+                                catch { /* ignore */ }
+                            }
+                        }
+                        if (counters.errors >= ERROR_BUDGET)
+                            break;
+                    }
+                }
+                finally {
+                    try {
+                        await api.close();
+                    }
+                    catch { /* ignore */ }
+                }
+                if (counters.errors >= ERROR_BUDGET) {
+                    console.error(`  [prefetch] ${accountId}: stopping after ${counters.errors} errors (${counters.totalFetched} cached, ${counters.deleted} pruned)`);
+                    return;
+                }
+            }
+            else {
+                // IMAP batch path: one UID FETCH per folder, each on its own
+                // turn through the slow lane. Yielding between folders is
+                // crucial — a click-to-view body should jump ahead of the
+                // next folder's batch via the fast lane, not wait for all
+                // folders to finish.
+                const byFolder = new Map();
+                for (const m of missing) {
+                    let arr = byFolder.get(m.folderId);
+                    if (!arr) {
+                        arr = [];
+                        byFolder.set(m.folderId, arr);
+                    }
+                    arr.push(m.uid);
+                }
+                const folders = this.db.getFolders(accountId);
+                // INBOX-first ordering so the folder the user actually looks at
+                // gets its bodies even if a later folder eats the error budget.
+                const orderedFolders = Array.from(byFolder.entries()).sort(([aid], [bid]) => {
+                    const af = folders.find(f => f.id === aid);
+                    const bf = folders.find(f => f.id === bid);
+                    const ai = af?.specialUse === "inbox" ? 0 : 1;
+                    const bi = bf?.specialUse === "inbox" ? 0 : 1;
+                    return ai - bi;
+                });
+                for (const [folderId, uids] of orderedFolders) {
+                    const folder = folders.find(f => f.id === folderId);
+                    if (!folder)
+                        continue;
+                    if (this.shouldSkipFolder(accountId, folder.path)) {
+                        console.log(`  [prefetch] ${accountId}: skipping ${folder.path} (recent timeouts — cooling down)`);
+                        continue;
+                    }
+                    const received = new Set();
+                    let batchSucceeded = false;
+                    try {
+                        // Slow lane: prefetch is the textbook "this might take
+                        // a while" case — let interactive ops slip ahead.
+                        await this.withConnection(accountId, async (client) => {
+                            const pending = [];
+                            await client.fetchBodiesBatch(folder.path, uids, (uid, source) => {
+                                received.add(uid);
+                                pending.push((async () => {
+                                    try {
+                                        const raw = Buffer.from(source, "utf-8");
+                                        const bodyPath = await this.bodyStore.putMessage(accountId, folderId, uid, raw);
+                                        this.db.updateBodyPath(accountId, uid, bodyPath);
+                                        this.emit("bodyCached", accountId, uid);
+                                        counters.totalFetched++;
+                                        madeProgress = true;
+                                    }
+                                    catch (e) {
+                                        console.error(`  [prefetch] ${accountId}/${uid}: store write failed: ${e.message}`);
+                                    }
+                                })());
+                            });
+                            await Promise.all(pending);
+                        }, { slow: true });
+                        batchSucceeded = true;
+                        this.clearFolderErrors(accountId, folder.path);
+                    }
+                    catch (e) {
+                        const msg = String(e?.message || "");
+                        console.error(`  [prefetch] ${accountId} folder ${folder.path}: batch fetch failed: ${msg}`);
+                        counters.errors++;
+                        this.recordFolderError(accountId, folder.path);
+                        if (counters.errors >= ERROR_BUDGET)
+                            break;
+                    }
+                    // CRITICAL: only prune when the batch actually completed.
+                    // A thrown batch means NOTHING was received; treating
+                    // absence as server-deletion lost 296 messages once.
+                    if (batchSucceeded)
+                        for (const uid of uids) {
+                            if (received.has(uid))
+                                continue;
+                            try {
+                                this.unlinkBodyFile(accountId, uid, folderId).catch(() => { });
+                                this.db.deleteMessage(accountId, uid);
+                                counters.deleted++;
+                                madeProgress = true;
+                            }
+                            catch { /* ignore */ }
+                        }
+                }
+                if (counters.errors >= ERROR_BUDGET) {
+                    console.error(`  [prefetch] ${accountId}: stopping after ${counters.errors} errors (${counters.totalFetched} cached, ${counters.deleted} pruned)`);
+                    return;
+                }
+            }
+            // Safety: zero progress this tick → bail rather than loop forever.
+            if (!madeProgress)
+                break;
+            // Emit so the UI refreshes the open-circle → filled-teal indicator
+            // without waiting for the next sync cycle.
+            this.emit("folderCountsChanged", accountId, {});
+        }
+        if (counters.totalFetched > 0 || counters.deleted > 0) {
+            console.log(`  [prefetch] ${accountId}: ${counters.totalFetched} bodies cached, ${counters.deleted} stale rows pruned (done)`);
+            this.emit("folderCountsChanged", accountId, {});
+        }
+    }
+    /** Get the body store for direct access */
+    getBodyStore() {
+        return this.bodyStore;
+    }
+    /** Bulk trash messages — local-first, single IMAP connection for all */
+    async trashMessages(accountId, messages) {
+        if (messages.length === 0)
+            return;
+        const trash = this.findFolder(accountId, "trash");
+        // Local first — remove all from DB immediately
+        for (const msg of messages) {
+            this.unlinkBodyFile(accountId, msg.uid, msg.folderId).catch(() => { });
+            this.db.deleteMessage(accountId, msg.uid);
+        }
+        console.log(`  Deleted ${messages.length} messages locally`);
+        // Queue IMAP actions
+        for (const msg of messages) {
+            if (trash && trash.id !== msg.folderId) {
+                this.db.queueSyncAction(accountId, "move", msg.uid, msg.folderId, { targetFolderId: trash.id });
+            }
+            else {
+                this.db.queueSyncAction(accountId, "delete", msg.uid, msg.folderId);
+            }
+        }
+        // Recalc folder counts so the tree badge updates immediately instead
+        // of showing stale numbers until the next full sync.
+        const sourceFolderIds = new Set(messages.map(m => m.folderId));
+        for (const fid of sourceFolderIds)
+            this.db.recalcFolderCounts(fid);
+        if (trash)
+            this.db.recalcFolderCounts(trash.id);
+        this.emit("folderCountsChanged", accountId, {});
+        // Process all queued actions in one IMAP session
+        this.debounceSyncActions(accountId);
+    }
+    /** Bulk move messages — queues the IMAP action only. The service layer
+     *  (MailxService.moveMessages) owns the local DB mutation via
+     *  updateMessageFolder; this method used to ALSO deleteMessage here,
+     *  which wiped the row the service just updated — the message vanished
+     *  on the next reconcile and "spam folder empty" was the symptom. */
+    async moveMessages(accountId, messages, targetFolderId) {
+        if (messages.length === 0)
+            return;
+        for (const msg of messages) {
+            this.db.queueSyncAction(accountId, "move", msg.uid, msg.folderId, { targetFolderId });
+        }
+        console.log(`  [move] ${accountId}: queued IMAP MOVE for ${messages.length} message(s) → folder ${targetFolderId}`);
+        this.debounceSyncActions(accountId);
+    }
+    /** Debounced sync actions — batches rapid local changes into one IMAP operation */
+    syncActionTimers = new Map();
+    debounceSyncActions(accountId) {
+        const existing = this.syncActionTimers.get(accountId);
+        if (existing)
+            clearTimeout(existing);
+        this.syncActionTimers.set(accountId, setTimeout(() => {
+            this.syncActionTimers.delete(accountId);
+            this.processSyncActions(accountId).catch(() => { });
+        }, 1000));
+    }
+    /** Move a message to Trash (delete) — local-first, queues IMAP sync */
+    async trashMessage(accountId, folderId, uid) {
+        const trash = this.findFolder(accountId, "trash");
+        // Local first — remove from DB immediately
+        this.unlinkBodyFile(accountId, uid, folderId).catch(() => { });
+        this.db.deleteMessage(accountId, uid);
+        // Queue IMAP action + log the resolution so "I deleted a message and
+        // now it's in neither trash nor deleted" is diagnosable from the log.
+        if (trash && trash.id !== folderId) {
+            const trashFolder = this.db.getFolders(accountId).find(f => f.id === trash.id);
+            this.db.queueSyncAction(accountId, "move", uid, folderId, { targetFolderId: trash.id });
+            console.log(`  [trash] ${accountId} UID ${uid}: queued MOVE to "${trashFolder?.path || trash.path}" (id=${trash.id}, specialUse=trash)`);
+        }
+        else {
+            this.db.queueSyncAction(accountId, "delete", uid, folderId);
+            console.log(`  [trash] ${accountId} UID ${uid}: queued EXPUNGE in folder ${folderId} (already in trash or no trash configured)`);
+        }
+        // Debounced sync — batches multiple deletes into one IMAP session
+        this.debounceSyncActions(accountId);
+    }
+    /** Move a message between folders — queues IMAP sync only. Service
+     *  layer owns the local DB update (see MailxService.moveMessage). */
+    async moveMessage(accountId, uid, fromFolderId, toFolderId) {
+        this.db.queueSyncAction(accountId, "move", uid, fromFolderId, { targetFolderId: toFolderId });
+        console.log(`  [move] ${accountId}: queued IMAP MOVE UID ${uid} folder ${fromFolderId} → ${toFolderId}`);
+        this.debounceSyncActions(accountId);
+    }
+    /** Move message across accounts using iflow's moveMessageToServer */
+    async moveMessageCrossAccount(fromAccountId, uid, fromFolderId, toAccountId, toFolderId) {
+        const fromFolders = this.db.getFolders(fromAccountId);
+        const fromFolder = fromFolders.find(f => f.id === fromFolderId);
+        if (!fromFolder)
+            throw new Error(`Source folder ${fromFolderId} not found`);
+        const toFolders = this.db.getFolders(toAccountId);
+        const toFolder = toFolders.find(f => f.id === toFolderId);
+        if (!toFolder)
+            throw new Error(`Target folder ${toFolderId} not found`);
+        // Two accounts, two ops connections. Cross-account move is rare
+        // and requires both sockets to be live concurrently (we APPEND to
+        // target while still authenticated to source), so this can't fold
+        // into a single withConnection call.
+        await this.withConnection(fromAccountId, async (sourceClient) => {
+            await this.withConnection(toAccountId, async (targetClient) => {
+                const msg = await sourceClient.fetchMessageByUid(fromFolder.path, uid, { source: true });
+                if (!msg)
+                    throw new Error(`Message UID ${uid} not found in ${fromFolder.path}`);
+                await sourceClient.moveMessageToServer(msg, fromFolder.path, targetClient, toFolder.path);
+                this.db.deleteMessage(fromAccountId, uid);
+                console.log(`  Cross-account move: ${fromAccountId}/${fromFolder.path} UID ${uid} → ${toAccountId}/${toFolder.path}`);
+            });
+        });
+    }
+    /** Undelete — move from Trash back to original folder */
+    async undeleteMessage(accountId, uid, originalFolderId) {
+        const trash = this.findFolder(accountId, "trash");
+        if (!trash)
+            throw new Error("No Trash folder found");
+        await this.moveMessage(accountId, uid, trash.id, originalFolderId);
+    }
+    /** Update flags — local-first, queues IMAP sync */
+    async updateFlagsLocal(accountId, uid, folderId, flags) {
+        this.db.updateMessageFlags(accountId, uid, flags);
+        this.db.queueSyncAction(accountId, "flags", uid, folderId, { flags });
+        // User-visible pink-dot pending state stays until the action drains.
+        // The 30-second periodic tick was too slow — opening one message to
+        // auto-mark-as-read left it pink for half a minute. Same 1-second
+        // debounce as moves/deletes batches rapid flag churn without the
+        // visual lag.
+        this.debounceSyncActions(accountId);
+    }
+    /** Process pending sync actions for an account */
+    async processSyncActions(accountId) {
+        const actions = this.db.getPendingSyncActions(accountId);
+        if (actions.length === 0)
+            return;
+        const startCount = actions.length;
+        const folders = this.db.getFolders(accountId);
+        // Gmail path: push flag/label changes through the REST provider so
+        // they actually reach the server. Earlier this method always went
+        // through withConnection → IMAP, which silently no-op'd for Gmail
+        // accounts (REST-only, no IMAP connection) and left local-only stars
+        // that vanished on the next full sync.
+        if (this.isGmailAccount(accountId)) {
+            const api = this.getGmailProvider(accountId);
+            try {
+                for (const action of actions) {
+                    const folder = folders.find(f => f.id === action.folderId);
+                    if (!folder) {
+                        this.db.completeSyncAction(action.id);
+                        continue;
+                    }
+                    try {
+                        if (action.action === "flags" && api.setFlags) {
+                            await api.setFlags(folder.path, action.uid, action.flags || []);
+                            console.log(`  [api] ${accountId}: flags synced UID ${action.uid}`);
+                        }
+                        else if ((action.action === "delete" || action.action === "trash") && api.trashMessage) {
+                            await api.trashMessage(folder.path, action.uid);
+                            console.log(`  [api] ${accountId}: trashed UID ${action.uid} from ${folder.path}`);
+                        }
+                        else if (action.action === "move" && api.moveMessage) {
+                            const target = folders.find(f => f.id === action.targetFolderId);
+                            if (!target) {
+                                // Unreachable target — drop the action rather than loop.
+                                console.error(`  [api] ${accountId}: move target folder ${action.targetFolderId} missing — dropping UID ${action.uid}`);
+                                this.db.completeSyncAction(action.id);
+                                continue;
+                            }
+                            await api.moveMessage(folder.path, action.uid, target.path);
+                            console.log(`  [api] ${accountId}: moved UID ${action.uid} ${folder.path} → ${target.path}`);
+                        }
+                        else {
+                            // Unsupported action on Gmail. After 5 retries, drop it
+                            // so stale rows don't mark messages pending-reconcile
+                            // forever. Previously "continue" here caused the pink
+                            // rows that shouldn't have been pink.
+                            if (action.attempts >= 5) {
+                                console.warn(`  [api] ${accountId}: dropping stale action "${action.action}" UID ${action.uid} after ${action.attempts} attempts (unsupported on Gmail API path)`);
+                                this.db.completeSyncAction(action.id);
+                            }
+                            else {
+                                this.db.failSyncAction(action.id, `unsupported Gmail action: ${action.action}`);
+                            }
+                            continue;
+                        }
+                        this.db.completeSyncAction(action.id);
+                    }
+                    catch (e) {
+                        console.error(`  [api] ${accountId}: flag sync failed UID ${action.uid}: ${e.message}`);
+                        this.db.failSyncAction(action.id, e.message);
+                        if (action.attempts >= 5)
+                            this.db.completeSyncAction(action.id);
+                    }
+                }
+            }
+            finally {
+                try {
+                    await api.close();
+                }
+                catch { /* */ }
+            }
+            // Nudge the UI so rows that were pending-reconcile re-query their
+            // pending state (pink dot was sticky until this event fired).
+            const remaining = this.db.getPendingSyncActions(accountId).length;
+            if (remaining < startCount)
+                this.emit("folderCountsChanged", accountId, {});
+            return;
+        }
+        await this.withConnection(accountId, async (client) => {
+            for (const action of actions) {
+                const folder = folders.find(f => f.id === action.folderId);
+                if (!folder) {
+                    this.db.completeSyncAction(action.id);
+                    continue;
+                }
+                try {
+                    switch (action.action) {
+                        case "delete":
+                            await client.deleteMessageByUid(folder.path, action.uid);
+                            console.log(`  [sync] Deleted UID ${action.uid} from ${folder.path}`);
+                            break;
+                        case "move": {
+                            const target = folders.find(f => f.id === action.targetFolderId);
+                            if (!target) {
+                                // Target folder gone — treat as permanent failure so the
+                                // action doesn't loop forever. User must re-delete manually.
+                                console.error(`  [sync] Move target folder ${action.targetFolderId} missing — dropping action UID ${action.uid}`);
+                                throw new Error(`move target folder ${action.targetFolderId} not found`);
+                            }
+                            const msg = await client.fetchMessageByUid(folder.path, action.uid, { source: false });
+                            if (!msg) {
+                                // Message no longer in source folder. Two real cases:
+                                //   (a) another client already moved/deleted it — nothing to do,
+                                //       just mark the action done.
+                                //   (b) the server is lying (transient SELECT miss) — the retry
+                                //       will pick it up. We can't tell these apart from one fetch,
+                                //       so log loud and treat as (a) after the first failure; the
+                                //       attempts counter handles (b) via the failSyncAction path.
+                                console.log(`  [sync] Move UID ${action.uid} in ${folder.path}: message gone (attempt ${action.attempts + 1}); dropping action`);
+                                break;
+                            }
+                            await client.moveMessage(msg, folder.path, target.path);
+                            console.log(`  [sync] Moved UID ${action.uid}: ${folder.path} → ${target.path}`);
+                            break;
+                        }
+                        case "flags":
+                            if (action.flags.length > 0) {
+                                await client.addFlags(folder.path, action.uid, action.flags.filter(f => !f.startsWith("-")));
+                                const toRemove = action.flags.filter(f => f.startsWith("-")).map(f => f.slice(1));
+                                if (toRemove.length > 0) {
+                                    await client.removeFlags(folder.path, action.uid, toRemove);
+                                }
+                                console.log(`  [sync] Updated flags UID ${action.uid}`);
+                            }
+                            break;
+                        case "append": {
+                            if (action.rawMessage) {
+                                await client.appendMessage(folder.path, action.rawMessage, action.flags);
+                                console.log(`  [sync] Appended to ${folder.path}`);
+                            }
+                            break;
+                        }
+                    }
+                    this.db.completeSyncAction(action.id);
+                }
+                catch (e) {
+                    console.error(`  [sync] Failed action ${action.action} UID ${action.uid}: ${e.message}`);
+                    this.db.failSyncAction(action.id, e.message);
+                    this.emit("syncActionFailed", accountId, action.action, action.uid, e.message);
+                    if (action.attempts >= 5) {
+                        console.error(`  [sync] Giving up on action ${action.id} after 5 attempts`);
+                        this.db.completeSyncAction(action.id);
+                        this.emit("syncActionFailed", accountId, action.action, action.uid, `Gave up after 5 attempts: ${e.message}`);
+                    }
+                }
+            }
+        });
+        // IMAP path: same nudge as the Gmail branch above. Any action that
+        // drained (successful or gave-up-after-5) decrements the pending
+        // count, which flips the pink dot off on the next re-query.
+        const remaining = this.db.getPendingSyncActions(accountId).length;
+        if (remaining < startCount)
+            this.emit("folderCountsChanged", accountId, {});
+    }
+    /** Find a folder by specialUse, case-insensitive */
+    findFolder(accountId, specialUse) {
+        const folders = this.db.getFolders(accountId);
+        return folders.find(f => f.specialUse === specialUse ||
+            f.path.toLowerCase() === specialUse.toLowerCase()) || null;
+    }
+    /** Optimistic local-first Sent insert: write a row into the local DB's
+     *  Sent folder the moment the user hits Send, so the list reflects it
+     *  immediately instead of waiting for SMTP + IMAP-APPEND + syncFolder
+     *  (five server round-trips against a Dovecot that caps at 20 conns).
+     *
+     *  Uses a synthetic negative UID so it can't collide with a real APPENDUID
+     *  (which is always positive). When the real sync eventually picks the
+     *  message up in Sent with the server's UID, `db.upsertMessage` spots
+     *  the Message-ID match and rebinds the existing row's UID — no duplicate.
+     *  Negative UID also makes the row render pink (getMessages flags uid<0
+     *  as pending) so the user sees it's not-yet-reconciled.
+     *
+     *  Best-effort — any failure path (no Sent folder yet, parse error, store
+     *  write error) is logged and swallowed; the send itself is unaffected. */
+    async insertOptimisticSentRow(accountId, envelope, rawMessage) {
+        try {
+            const sent = this.findFolder(accountId, "sent");
+            if (!sent) {
+                console.log(`  [sent-local] no Sent folder for ${accountId}; skipping optimistic row`);
+                return;
+            }
+            // Synthetic UID — negative ms timestamp is monotonic + won't
+            // collide with server UIDs. When the real APPENDUID returns via
+            // sync, upsertMessage's Message-ID rebind swaps this for the
+            // real positive value.
+            const synthUid = -Date.now();
+            const bodyPath = await this.bodyStore.putMessage(accountId, sent.id, synthUid, Buffer.from(rawMessage, "utf-8"));
+            const parsed = await extractPreview(rawMessage);
+            this.db.upsertMessage({
+                accountId,
+                folderId: sent.id,
+                uid: synthUid,
+                messageId: envelope.messageId,
+                inReplyTo: envelope.inReplyTo,
+                references: envelope.references,
+                date: envelope.date,
+                subject: envelope.subject,
+                from: envelope.from,
+                to: envelope.to,
+                cc: envelope.cc,
+                flags: ["\\Seen"],
+                size: rawMessage.length,
+                hasAttachments: parsed.hasAttachments,
+                preview: parsed.preview,
+                bodyPath,
+            });
+            // Folder-tree badge refresh + message-list reload if the user
+            // is currently on Sent — same event the sync path emits.
+            this.db.recalcFolderCounts(sent.id);
+            this.emit("folderCountsChanged", { accountId, folderId: sent.id });
+            console.log(`  [sent-local] wrote optimistic row in Sent (uid=${synthUid}) for ${accountId}: ${envelope.subject}`);
+        }
+        catch (e) {
+            // Non-fatal — send continues, Sent folder just won't show the
+            // row until the real APPEND-then-sync cycle completes.
+            console.error(`  [sent-local] optimistic insert failed: ${e?.message || e}`);
+        }
+    }
+    /** Copy sent message to the Sent folder via IMAP APPEND */
+    async copyToSent(accountId, rawMessage) {
+        const sent = this.findFolder(accountId, "sent");
+        if (!sent) {
+            console.error(`  [sent] No Sent folder found for ${accountId}`);
+            return;
+        }
+        await this.withConnection(accountId, async (client) => {
+            await client.appendMessage(sent.path, rawMessage, ["\\Seen"]);
+            console.log(`  [sent] Copied to ${sent.path}`);
+        });
+    }
+    /** Save a draft to the Drafts folder via IMAP APPEND.
+     *  Returns the UID of the saved draft (for replacing on next save). */
+    async saveDraft(accountId, rawMessage, previousDraftUid, draftId) {
+        const drafts = this.findFolder(accountId, "drafts");
+        if (!drafts) {
+            console.error(`  [drafts] No Drafts folder found for ${accountId}`);
+            return null;
+        }
+        return this.withConnection(accountId, async (client) => {
+            // Delete previous draft — try UID first (fast path), and ALWAYS also try
+            // searchByHeader(X-Mailx-Draft-ID) as a safety net. Running both catches
+            // orphans from a crash-mid-save or a UID delete that failed silently.
+            if (previousDraftUid) {
+                try {
+                    await client.deleteMessageByUid(drafts.path, previousDraftUid);
+                }
+                catch (e) {
+                    console.error(`  [drafts] Delete prev UID ${previousDraftUid} failed: ${e.message}`);
+                }
+            }
+            if (draftId) {
+                try {
+                    const uids = await client.searchByHeader(drafts.path, "X-Mailx-Draft-ID", draftId);
+                    for (const uid of uids) {
+                        try {
+                            await client.deleteMessageByUid(drafts.path, uid);
+                        }
+                        catch { /* next */ }
+                    }
+                    if (uids.length > 0)
+                        console.log(`  [drafts] Deleted ${uids.length} stale draft(s) by ID ${draftId}`);
+                }
+                catch (e) {
+                    console.error(`  [drafts] searchByHeader for ${draftId} failed: ${e.message}`);
+                }
+            }
+            // Append new draft. If the server returns [TRYCREATE] (RFC 3501 §7.1),
+            // the folder doesn't exist on the server even though mailx's DB has
+            // it. Create it and retry once.
+            let result;
+            try {
+                result = await client.appendMessage(drafts.path, rawMessage, ["\\Draft", "\\Seen"]);
+            }
+            catch (e) {
+                const msg = String(e?.message || e);
+                if (/TRYCREATE/i.test(msg)) {
+                    console.log(`  [drafts] APPEND got TRYCREATE for "${drafts.path}" — creating folder and retrying`);
+                    try {
+                        await client.createmailbox(drafts.path);
+                    }
+                    catch (ce) {
+                        if (!/already exists/i.test(String(ce?.message || ""))) {
+                            console.error(`  [drafts] Folder create failed for "${drafts.path}": ${ce.message}`);
+                        }
+                    }
+                    result = await client.appendMessage(drafts.path, rawMessage, ["\\Draft", "\\Seen"]);
+                }
+                else {
+                    throw e;
+                }
+            }
+            const uid = typeof result === "number" ? result : result?.uid || null;
+            return uid;
+        });
+    }
+    /** Delete a draft (or all drafts with a stable X-Mailx-Draft-ID) after successful send.
+     *  Tries the specific UID first, then falls back to searchByHeader so orphaned copies
+     *  from earlier failed autosaves are cleaned up at the same time. */
+    async deleteDraft(accountId, draftUid, draftId) {
+        const drafts = this.findFolder(accountId, "drafts");
+        if (!drafts)
+            return;
+        if (!draftUid && !draftId)
+            return;
+        await this.withConnection(accountId, async (client) => {
+            if (draftUid) {
+                try {
+                    await client.deleteMessageByUid(drafts.path, draftUid);
+                    console.log(`  [drafts] Deleted draft UID ${draftUid}`);
+                }
+                catch (e) {
+                    console.error(`  [drafts] Delete by UID ${draftUid} failed: ${e.message}`);
+                }
+            }
+            if (draftId) {
+                try {
+                    const uids = await client.searchByHeader(drafts.path, "X-Mailx-Draft-ID", draftId);
+                    for (const uid of uids) {
+                        try {
+                            await client.deleteMessageByUid(drafts.path, uid);
+                        }
+                        catch { /* next */ }
+                    }
+                    if (uids.length > 0)
+                        console.log(`  [drafts] Deleted ${uids.length} draft(s) by ID ${draftId}`);
+                }
+                catch (e) {
+                    console.error(`  [drafts] searchByHeader for ${draftId} failed: ${e.message}`);
+                }
+            }
+        });
+    }
+    /** Queue outgoing message locally — never fails, worker handles IMAP+SMTP.
+     *  Single path: write `~/.mailx/outbox/<acct>/*.ltr` synchronously, then
+     *  kick processLocalQueue. The file IS the queue — durable across crashes,
+     *  visible in the filesystem, consumed by the existing outbox worker that
+     *  handles both IMAP-APPEND (non-Gmail) and direct SMTP (Gmail). The old
+     *  sync_actions "send" branch was removed because it duplicated the same
+     *  work and risked double-send when both paths fired on the same message. */
+    queueOutgoingLocal(accountId, rawMessage) {
+        // Loud logging so a "vanished message" report is diagnosable from the log alone.
+        // ALWAYS leave a backup copy in sending/<acct>/attempted/ first — unconditionally,
+        // before the outbox write. The outbox .ltr may be claimed/consumed by the worker
+        // within milliseconds; this copy survives regardless of SMTP success, IMAP
+        // append, worker crash, or any other downstream failure. User asked for this
+        // as a fallback because "there isn't even the backup copy in sent".
+        this.saveSendingCopy(accountId, rawMessage, "attempted");
+        const outboxDir = path.join(getConfigDir(), "outbox", accountId);
+        try {
+            fs.mkdirSync(outboxDir, { recursive: true });
+        }
+        catch (e) {
+            console.error(`  [outbox] FAIL mkdirSync ${outboxDir}: ${e?.message || e}`);
+            throw new Error(`Cannot create outbox dir ${outboxDir}: ${e?.message || e}`);
+        }
+        const now = new Date();
+        const pad2 = (n) => String(n).padStart(2, "0");
+        const filename = `${now.getFullYear()}${pad2(now.getMonth() + 1)}${pad2(now.getDate())}_${pad2(now.getHours())}${pad2(now.getMinutes())}${pad2(now.getSeconds())}-${String(Math.floor(Math.random() * 10000)).padStart(4, "0")}.ltr`;
+        const filePath = path.join(outboxDir, filename);
+        try {
+            fs.writeFileSync(filePath, rawMessage);
+        }
+        catch (e) {
+            console.error(`  [outbox] FAIL writeFileSync ${filePath}: ${e?.message || e}`);
+            throw new Error(`Cannot write outbox file ${filePath}: ${e?.message || e}`);
+        }
+        // Immediate readback verification — if this DOESN'T print, the user's
+        // "neither in outbox nor file system" report has a real explanation.
+        const written = fs.existsSync(filePath);
+        const size = written ? fs.statSync(filePath).size : 0;
+        console.log(`  [outbox] WROTE ${filePath} (${size} bytes, exists=${written})`);
+        this.emitOutboxStatus();
+        // CRITICAL: defer to next tick. processLocalQueue runs ~30+ lines
+        // of synchronous fs work BEFORE its first await — calling it inline
+        // blocks the IPC ack on all that work.
+        setImmediate(() => {
+            this.processLocalQueue(accountId)
+                .catch((e) => console.error(`  [outbox] processLocalQueue error: ${e?.message || e}`))
+                .finally(() => this.emitOutboxStatus());
+        });
+    }
+    /** Scan the local outbox + sending/queued dirs and return counts + age.
+     *  Cheap — a handful of readdir + head-read per file. Called by both the
+     *  polling UI (status bar) and emitted as an event after queue mutations. */
+    getOutboxStatus() {
+        const configDir = getConfigDir();
+        const perAccount = {};
+        let total = 0;
+        let retrying = 0;
+        let claimed = 0;
+        let oldestMs = 0;
+        let maxAttempts = 0;
+        const now = Date.now();
+        const scan = (accountId, dir) => {
+            if (!fs.existsSync(dir))
+                return;
+            for (const f of fs.readdirSync(dir)) {
+                const isClaim = /\.sending-[^-]+-\d+$/.test(f);
+                const isActive = isClaim || f.endsWith(".ltr") || f.endsWith(".eml");
+                if (!isActive)
+                    continue;
+                total++;
+                const acctSlot = perAccount[accountId] ||= { total: 0, retrying: 0, claimed: 0 };
+                acctSlot.total++;
+                if (isClaim) {
+                    claimed++;
+                    acctSlot.claimed++;
+                }
+                const fp = path.join(dir, f);
+                try {
+                    const st = fs.statSync(fp);
+                    const age = now - st.mtimeMs;
+                    if (age > oldestMs)
+                        oldestMs = age;
+                    // Only read header region to count retry attempts — tiny I/O.
+                    const fd = fs.openSync(fp, "r");
+                    try {
+                        const buf = Buffer.alloc(4096);
+                        const n = fs.readSync(fd, buf, 0, 4096, 0);
+                        const head = buf.slice(0, n).toString("utf-8");
+                        const info = parseRetryInfo(head);
+                        if (info.attemptCount > 0) {
+                            retrying++;
+                            acctSlot.retrying++;
+                        }
+                        if (info.attemptCount > maxAttempts)
+                            maxAttempts = info.attemptCount;
+                    }
+                    finally {
+                        fs.closeSync(fd);
+                    }
+                }
+                catch { /* ignore per-file errors */ }
+            }
+        };
+        const outboxRoot = path.join(configDir, "outbox");
+        const sendingRoot = path.join(configDir, "sending");
+        try {
+            if (fs.existsSync(outboxRoot)) {
+                for (const acct of fs.readdirSync(outboxRoot))
+                    scan(acct, path.join(outboxRoot, acct));
+            }
+            if (fs.existsSync(sendingRoot)) {
+                for (const acct of fs.readdirSync(sendingRoot)) {
+                    scan(acct, path.join(sendingRoot, acct, "queued"));
+                }
+            }
+        }
+        catch { /* */ }
+        return {
+            total, retrying, claimed,
+            oldestAgeSec: Math.floor(oldestMs / 1000),
+            maxAttempts,
+            perAccount,
+        };
+    }
+    /** Emit outboxStatus now. Call after any queue mutation. */
+    emitOutboxStatus() {
+        try {
+            this.emit("outboxStatus", this.getOutboxStatus());
+        }
+        catch { /* */ }
+    }
+    /** Guard against concurrent processSendActions for the same account */
+    sendingAccounts = new Set();
+    /** Process local send actions — APPEND to Outbox, which the outbox worker then sends */
+    async processSendActions(accountId) {
+        if (this.sendingAccounts.has(accountId))
+            return; // already processing
+        this.sendingAccounts.add(accountId);
+        try {
+            await this._processSendActions(accountId);
+        }
+        finally {
+            this.sendingAccounts.delete(accountId);
+        }
+    }
+    async _processSendActions(accountId) {
+        const actions = this.db.getPendingSyncActions(accountId)
+            .filter(a => a.action === "send");
+        if (actions.length === 0)
+            return;
+        for (const action of actions) {
+            if (!action.rawMessage) {
+                this.db.completeSyncAction(action.id);
+                continue;
+            }
+            // Abandon after 10 failed attempts — don't retry forever
+            if (action.attempts >= 10) {
+                console.error(`  [outbox] Abandoning send action ${action.id} after ${action.attempts} attempts: ${action.rawMessage?.substring(0, 100)}`);
+                this.db.completeSyncAction(action.id);
+                this.emit("accountError", accountId, `Send permanently failed after ${action.attempts} attempts`, "Message removed from queue", false);
+                continue;
+            }
+            try {
+                await this.queueOutgoing(accountId, action.rawMessage);
+                this.db.completeSyncAction(action.id);
+            }
+            catch (e) {
+                console.error(`  [outbox] Local→IMAP failed (attempt ${action.attempts + 1}): ${e.message}`);
+                this.db.failSyncAction(action.id, e.message);
+            }
+        }
+    }
+    // ── Outbox ──
+    outboxInterval = null;
+    hostname = os.hostname();
+    /** Ensure Outbox folder exists, create if needed */
+    async ensureOutbox(accountId) {
+        let outbox = this.findFolder(accountId, "outbox");
+        if (outbox)
+            return outbox.path;
+        // Look for existing folder named Outbox (case-insensitive)
+        const folders = this.db.getFolders(accountId);
+        const existing = folders.find(f => f.path.toLowerCase() === "outbox");
+        if (existing)
+            return existing.path;
+        try {
+            await this.withConnection(accountId, async (client) => {
+                await client.createmailbox("Outbox");
+                await this.syncFolders(accountId, client);
+            });
+        }
+        catch (e) {
+            // Might already exist — benign
+            if (!e.message?.includes("already exists"))
+                throw e;
+        }
+        outbox = this.findFolder(accountId, "outbox");
+        return outbox?.path || "Outbox";
+    }
+    /** Save a copy of outgoing mail — label is a subdirectory (editing/queued/sent) */
+    saveSendingCopy(accountId, rawMessage, label) {
+        try {
+            const dir = path.join(getConfigDir(), "sending", accountId, label);
+            fs.mkdirSync(dir, { recursive: true });
+            const now = new Date();
+            const pad2 = (n) => String(n).padStart(2, "0");
+            const ts = `${now.getFullYear()}${pad2(now.getMonth() + 1)}${pad2(now.getDate())}_${pad2(now.getHours())}${pad2(now.getMinutes())}${pad2(now.getSeconds())}`;
+            fs.writeFileSync(path.join(dir, `${ts}.eml`), rawMessage);
+            console.log(`  [sending] ${label}/${ts}.eml`);
+        }
+        catch (e) {
+            console.error(`  [sending] Failed to save copy: ${e.message}`);
+        }
+    }
+    /** Queue a message for sending. Tries IMAP Outbox, falls back to local file. */
+    async queueOutgoing(accountId, rawMessage) {
+        // IMPORTANT: do NOT save a "debug copy" to sending/<acct>/queued/ here.
+        // processLocalQueue also scans sending/<acct>/queued/, so writing there
+        // on every send caused the same message to be re-APPENDed to the IMAP
+        // Outbox on the next outbox tick — resulting in a duplicate send.
+        // The only two legitimate queue locations are:
+        //   - IMAP Outbox (primary, populated by APPEND below)
+        //   - ~/.mailx/outbox/<acct>/*.ltr (fallback when IMAP is unreachable)
+        try {
+            const outboxPath = await this.ensureOutbox(accountId);
+            await this.withConnection(accountId, async (client) => {
+                await client.appendMessage(outboxPath, rawMessage, ["\\Seen"]);
+                console.log(`  [outbox] Queued message in ${outboxPath}`);
+            });
+            const outboxFolder = this.findFolder(accountId, "outbox");
+            if (outboxFolder) {
+                this.syncFolder(accountId, outboxFolder.id).catch(() => { });
+            }
+            return;
+        }
+        catch (e) {
+            console.error(`  [outbox] IMAP queue failed: ${e.message} — saving locally`);
+        }
+        // Fallback: save to local file queue (processLocalQueue picks these up)
+        const localQueue = path.join(getConfigDir(), "outbox", accountId);
+        fs.mkdirSync(localQueue, { recursive: true });
+        const now = new Date();
+        const pad2 = (n) => String(n).padStart(2, "0");
+        const filename = `${now.getFullYear()}${pad2(now.getMonth() + 1)}${pad2(now.getDate())}_${pad2(now.getHours())}${pad2(now.getMinutes())}${pad2(now.getSeconds())}-${String(Math.floor(Math.random() * 10000)).padStart(4, "0")}.ltr`;
+        fs.writeFileSync(path.join(localQueue, filename), rawMessage);
+        console.log(`  [outbox] Saved locally: ${filename}`);
+    }
+    /** Process local file queue — scan both outbox/ (IMAP-unreachable fallback)
+     *  and sending/<acct>/queued/ (manual drop-in, crash recovery). The earlier
+     *  double-send bug was caused by queueOutgoing() WRITING a debug copy to
+     *  sending/queued/ on every send — that write is gone now, so scanning the
+     *  directory is safe again. Any legitimate files that land there (crash
+     *  recovery, manual drop) will get sent. */
+    async processLocalQueue(accountId) {
+        const outboxDir = path.join(getConfigDir(), "outbox", accountId);
+        const queuedDir = path.join(getConfigDir(), "sending", accountId, "queued");
+        // Recovery sweep: any *.sending-<host>-<pid> on THIS host whose PID is
+        // dead (process crashed mid-send) gets unclaimed so the next tick can
+        // retry. Foreign hosts are left alone — we have no way to know if their
+        // process is alive. Cross-host stale recovery is the IMAP-folder path's
+        // job (sweeper looks at server-side claim flags, not local files).
+        for (const dir of [outboxDir, queuedDir]) {
+            if (!fs.existsSync(dir))
+                continue;
+            for (const f of fs.readdirSync(dir)) {
+                const m = f.match(/^(.+)\.sending-([^-]+)-(\d+)$/);
+                if (!m)
+                    continue;
+                const [, original, host, pidStr] = m;
+                if (host !== this.hostname)
+                    continue;
+                const pid = parseInt(pidStr);
+                let alive = false;
+                try {
+                    process.kill(pid, 0);
+                    alive = true;
+                }
+                catch { /* dead */ }
+                if (alive)
+                    continue; // live claim — owner (sibling or self) still has it
+                try {
+                    fs.renameSync(path.join(dir, f), path.join(dir, original));
+                    console.log(`  [outbox] Recovered stale claim ${f} → ${original}`);
+                }
+                catch { /* ignore */ }
+            }
+        }
+        const filesToSend = [];
+        for (const dir of [outboxDir, queuedDir]) {
+            if (!fs.existsSync(dir))
+                continue;
+            for (const file of fs.readdirSync(dir).filter(f => f.endsWith(".ltr") || f.endsWith(".eml"))) {
+                filesToSend.push({ dir, file });
+            }
+        }
+        if (filesToSend.length === 0)
+            return;
+        // Gmail/API accounts: send directly via SMTP from local queue (no IMAP outbox)
+        const sentDir = path.join(getConfigDir(), "sending", accountId, "sent");
+        fs.mkdirSync(sentDir, { recursive: true });
+        if (this.isGmailAccount(accountId)) {
+            const nowMs = Date.now();
+            for (const { dir, file } of filesToSend) {
+                const filePath = path.join(dir, file);
+                // Atomic claim: rename to <file>.sending-<host>-<pid> so a sibling
+                // process scanning the same dir can't grab the same .ltr. Filesystem
+                // rename is atomic; loser sees ENOENT and skips. Without this, two
+                // mailx instances on one machine (or two ticks within one process)
+                // could both pass the Message-ID dedup check and both call SMTP.
+                const claimSuffix = `.sending-${this.hostname}-${process.pid}`;
+                const claimedPath = filePath + claimSuffix;
+                try {
+                    fs.renameSync(filePath, claimedPath);
+                }
+                catch (e) {
+                    if (e.code === "ENOENT")
+                        continue; // another process won
+                    throw e;
+                }
+                let raw = fs.readFileSync(claimedPath, "utf-8");
+                // Per-message rate limit: if a prior attempt set X-Mailx-Retry-After
+                // in the future, skip this file for now. Minimizes the race where the
+                // SMTP server actually accepted DATA but we lost the ack and would
+                // otherwise retry immediately on the next 10s tick.
+                const retryInfo = parseRetryInfo(raw);
+                if (retryInfo.nextAttemptAt > nowMs) {
+                    // Release claim — let next tick reconsider
+                    try {
+                        fs.renameSync(claimedPath, filePath);
+                    }
+                    catch { /* ignore */ }
+                    continue;
+                }
+                // Record this attempt: strip internal X-Mailx-Retry-After, append a new
+                // X-Mailx-Retry: N <ISO-timestamp> line to the headers. The updated file
+                // is written back *before* the send so a crash mid-send doesn't lose state.
+                const attempt = retryInfo.attemptCount + 1;
+                raw = stripHeaderField(raw, "X-Mailx-Retry-After");
+                raw = insertHeaderBeforeBody(raw, `X-Mailx-Retry: ${attempt} ${new Date().toISOString()}`);
+                fs.writeFileSync(claimedPath, raw, "utf-8");
+                try {
+                    await this.sendRawViaSMTP(accountId, raw);
+                    fs.renameSync(claimedPath, path.join(sentDir, file));
+                    console.log(`  [outbox] Sent ${file} via SMTP → sent/ (attempt ${attempt})`);
+                }
+                catch (e) {
+                    // Persist a next-attempt timestamp and release the claim so the
+                    // file is visible to the scan loop again.
+                    const nextAt = new Date(nowMs + OUTBOX_RETRY_DELAY_MS).toISOString();
+                    const withDelay = insertHeaderBeforeBody(raw, `X-Mailx-Retry-After: ${nextAt}`);
+                    fs.writeFileSync(claimedPath, withDelay, "utf-8");
+                    try {
+                        fs.renameSync(claimedPath, filePath);
+                    }
+                    catch { /* file stays claimed; recovery sweeper will handle */ }
+                    console.error(`  [outbox] Send failed for ${file} (attempt ${attempt}, retry after ${nextAt}): ${e.message}`);
+                }
+            }
+            return;
+        }
+        // IMAP accounts: append to IMAP Outbox for multi-machine interlock.
+        //
+        // Atomic claim (same pattern as the Gmail path above): rename the file
+        // to <file>.sending-<host>-<pid> BEFORE reading it, so two concurrent
+        // mailx instances scanning the same dir can't both APPEND the same
+        // message to IMAP Outbox and end up with a duplicate. Filesystem rename
+        // is atomic; the loser sees ENOENT and skips. On APPEND success, move
+        // the claimed file to sending/sent/; on APPEND failure, release the
+        // claim so the recovery sweeper picks it up next tick.
+        try {
+            const outboxPath = await this.ensureOutbox(accountId);
+            const client = await this.createClientWithLimit(accountId);
+            try {
+                for (const { dir, file } of filesToSend) {
+                    const filePath = path.join(dir, file);
+                    const claimSuffix = `.sending-${this.hostname}-${process.pid}`;
+                    const claimedPath = filePath + claimSuffix;
+                    try {
+                        fs.renameSync(filePath, claimedPath);
+                    }
+                    catch (e) {
+                        if (e.code === "ENOENT")
+                            continue; // sibling claimed first
+                        throw e;
+                    }
+                    try {
+                        const raw = fs.readFileSync(claimedPath, "utf-8");
+                        await client.appendMessage(outboxPath, raw, ["\\Seen"]);
+                        fs.renameSync(claimedPath, path.join(sentDir, file));
+                        console.log(`  [outbox] Moved ${file} to IMAP Outbox → sent/`);
+                    }
+                    catch (e) {
+                        // APPEND failed (connection dropped mid-send, server
+                        // busy, etc.) — release the claim so next tick can
+                        // retry. Don't swallow: rethrow after release so the
+                        // outer catch ("IMAP still unreachable") bails out of
+                        // the remaining files too — whatever broke will break
+                        // the next file the same way.
+                        try {
+                            fs.renameSync(claimedPath, filePath);
+                        }
+                        catch { /* recovery sweeper will handle */ }
+                        throw e;
+                    }
+                }
+            }
+            finally {
+                try {
+                    await client.logout();
+                }
+                catch { /* ignore */ }
+            }
+        }
+        catch {
+            // IMAP still unreachable — leave files for next attempt
+        }
+    }
+    /** Send a raw RFC 2822 message via SMTP for a given account.
+     *  Uses @bobfrankston/smtp-direct with the same TransportFactory as IMAP —
+     *  same TCP byte-stream interface, no nodemailer dependency. */
+    async sendRawViaSMTP(accountId, raw) {
+        const settings = loadSettings();
+        const account = settings.accounts.find(a => a.id === accountId);
+        if (!account?.smtp)
+            throw new Error(`No SMTP config for ${accountId}`);
+        const smtpPort = account.smtp.port || SMTP_PORT_STARTTLS;
+        const smtpHost = account.smtp.host || account.imap?.host;
+        if (!smtpHost)
+            throw new Error(`No SMTP host for ${accountId}`);
+        // SMTP auth: explicit SMTP creds, fall back to IMAP creds for password auth.
+        const smtpAuthType = account.smtp.auth || (account.imap?.password ? "password" : undefined);
+        const smtpUser = account.smtp.user || account.imap?.user || account.email;
+        let auth;
+        if (smtpAuthType === "password") {
+            const pass = account.smtp.password || account.imap?.password;
+            if (!pass)
+                throw new Error("SMTP password not configured");
+            auth = { method: "PLAIN", user: smtpUser, pass };
+        }
+        else if (smtpAuthType === "oauth2") {
+            const token = await this.getOAuthToken(accountId);
+            if (!token)
+                throw new Error("OAuth token not available");
+            auth = { method: "XOAUTH2", user: smtpUser, token };
+        }
+        const parseAddrs = (s) => s.match(/[\w.+-]+@[\w.-]+/g) || [];
+        const toMatch = raw.match(/^To:\s*(.+)$/mi);
+        const ccMatch = raw.match(/^Cc:\s*(.+)$/mi);
+        const bccMatch = raw.match(/^Bcc:\s*(.+)$/mi);
+        const fromMatch = raw.match(/^From:\s*(.+)$/mi);
+        const subjectMatch = raw.match(/^Subject:\s*(.+)$/mi);
+        const messageIdMatch = raw.match(/^Message-ID:\s*(<[^>]+>)/mi);
+        const recipients = [
+            ...(toMatch ? parseAddrs(toMatch[1]) : []),
+            ...(ccMatch ? parseAddrs(ccMatch[1]) : []),
+            ...(bccMatch ? parseAddrs(bccMatch[1]) : []),
+        ];
+        const sender = fromMatch ? (parseAddrs(fromMatch[1])[0] || account.email) : account.email;
+        if (recipients.length === 0)
+            throw new Error("No recipients");
+        // Dedup: skip if this Message-ID has already been sent. Prevents the
+        // outbox from re-sending the same file across crash/restart cycles.
+        const messageId = messageIdMatch ? messageIdMatch[1] : "";
+        if (messageId && this.db.hasSentMessage(messageId)) {
+            console.log(`  [smtp] ${accountId}: SKIP ${messageId} — already in sent_log`);
+            return;
+        }
+        const rawToSend = raw.replace(/^Bcc:.*\r?\n/mi, "");
+        this.saveSendingCopy(accountId, rawToSend, "sent");
+        const smtp = new SmtpClient({
+            host: smtpHost,
+            port: smtpPort,
+            secure: smtpPort === SMTP_PORT_IMPLICIT_TLS,
+            auth,
+            localname: os.hostname(),
+        }, this.transportFactory);
+        try {
+            await smtp.connect();
+            const result = await smtp.sendMail({ from: sender, to: recipients }, rawToSend);
+            if (result.rejected.length > 0) {
+                console.log(`  [smtp] ${accountId}: ${result.rejected.length} recipient(s) rejected: ${result.rejected.map(r => `${r.address} (${r.code})`).join(", ")}`);
+            }
+        }
+        finally {
+            try {
+                await smtp.quit();
+            }
+            catch { /* ignore */ }
+        }
+        if (messageId) {
+            this.db.recordSent(messageId, accountId, subjectMatch?.[1]?.trim() || "", recipients);
+        }
+        console.log(`  [smtp] ${accountId}: sent to ${recipients.join(", ")}`);
+    }
+    /** Process Outbox — send pending messages with flag-based interlock.
+     *  Each per-UID step is its own withConnection({slow}) call so the queue
+     *  yields between messages: a click-to-view body in the middle of a
+     *  10-message outbox drain doesn't wait for all 10 to finish. */
+    async processOutbox(accountId) {
+        const outboxFolder = this.findFolder(accountId, "outbox");
+        if (!outboxFolder)
+            return;
+        // Gmail: skip IMAP outbox check — sending handled by processLocalQueue which sends directly via SMTP
+        if (this.isGmailAccount(accountId))
+            return;
+        const settings = loadSettings();
+        const account = settings.accounts.find(a => a.id === accountId);
+        if (!account)
+            return;
+        // List UIDs first — quick command, fast lane.
+        const uids = await this.withConnection(accountId, (client) => client.getUids(outboxFolder.path));
+        if (uids.length === 0)
+            return;
+        const STALE_CLAIM_MS = 3600_000; // 1 hour — longer than any reasonable SMTP send
+        const nowSec = Math.floor(Date.now() / 1000);
+        const sendingFlag = `$Sending-${this.hostname}-${nowSec}`;
+        const sentFolder = this.findFolder(accountId, "sent");
+        for (const uid of uids) {
+            // Each iteration is one slow-lane turn — fast-lane work can run
+            // between iterations, so a body click during a long outbox drain
+            // gets serviced promptly.
+            const result = await this.withConnection(accountId, async (client) => {
+                const flags = await client.getFlags(outboxFolder.path, uid);
+                // Sweep stale claims. $Sending-<host>-<sec> with old timestamp,
+                // or legacy $Sending-<host> without timestamp (treated as
+                // stale; if the real owner is alive it'll re-claim next tick).
+                const claimFlags = flags.filter((f) => f.startsWith("$Sending"));
+                for (const cf of claimFlags) {
+                    const m = cf.match(/^\$Sending-(.+?)(?:-(\d+))?$/);
+                    if (!m)
+                        continue;
+                    const tsSec = m[2] ? parseInt(m[2]) : 0;
+                    const ageSec = nowSec - tsSec;
+                    if (ageSec * 1000 > STALE_CLAIM_MS) {
+                        try {
+                            await client.removeFlags(outboxFolder.path, uid, [cf]);
+                            console.log(`  [outbox] Swept stale claim ${cf} on UID ${uid} (age ${Math.round(ageSec / 60)}m)`);
+                        }
+                        catch { /* ignore */ }
+                    }
+                }
+                const flagsNow = (claimFlags.length > 0)
+                    ? await client.getFlags(outboxFolder.path, uid)
+                    : flags;
+                if (flagsNow.some((f) => f.startsWith("$Sending")))
+                    return { skip: true };
+                if (flagsNow.includes("$PermanentFailure"))
+                    return { skip: true };
+                if (flagsNow.includes("$Failed")) {
+                    await client.removeFlags(outboxFolder.path, uid, ["$Failed"]);
+                }
+                await client.addFlags(outboxFolder.path, uid, [sendingFlag]);
+                // TOCTOU re-check: if two devices addFlags concurrently both
+                // see ≥2 sending flags. Fail-safe: both back off, next tick
+                // one wins.
+                const flagsAfter = await client.getFlags(outboxFolder.path, uid);
+                const sendingFlags = flagsAfter.filter((f) => f.startsWith("$Sending"));
+                if (sendingFlags.length > 1 || (sendingFlags.length === 1 && sendingFlags[0] !== sendingFlag)) {
+                    await client.removeFlags(outboxFolder.path, uid, [sendingFlag]);
+                    return { skip: true };
+                }
+                const msg = await client.fetchMessageByUid(outboxFolder.path, uid, { source: true });
+                if (!msg?.source) {
+                    await client.removeFlags(outboxFolder.path, uid, [sendingFlag]);
+                    return { skip: true };
+                }
+                return { source: msg.source };
+            }, { slow: true });
+            if (result.skip)
+                continue;
+            const source = result.source;
+            // SMTP send is its own connection — not an IMAP op, doesn't go
+            // through withConnection.
+            try {
+                await this.sendRawViaSMTP(accountId, source);
+                console.log(`  [outbox] Sent UID ${uid}`);
+                // Delete from Outbox + copy to Sent. Done in two separate
+                // withConnection calls so other work can interleave.
+                await this.withConnection(accountId, async (client) => {
+                    // Delete FIRST to prevent double-send if Sent-copy fails.
+                    await client.deleteMessageByUid(outboxFolder.path, uid);
+                }, { slow: true });
+                if (sentFolder) {
+                    try {
+                        await this.withConnection(accountId, async (client) => {
+                            await client.appendMessage(sentFolder.path, source, ["\\Seen"]);
+                        }, { slow: true });
+                        this.syncFolder(accountId, sentFolder.id).catch(() => { });
+                    }
+                    catch (sentErr) {
+                        console.error(`  [outbox] Failed to copy to Sent: ${sentErr.message} — message was sent successfully`);
+                    }
+                    this.syncFolder(accountId, outboxFolder.id).catch(() => { });
+                }
+            }
+            catch (e) {
+                const errMsg = e.message || String(e);
+                console.error(`  [outbox] Send failed UID ${uid}: ${errMsg}`);
+                try {
+                    await this.withConnection(accountId, async (client) => {
+                        await client.removeFlags(outboxFolder.path, uid, [sendingFlag]);
+                        await client.addFlags(outboxFolder.path, uid, ["$Failed"]);
+                    }, { slow: true });
+                }
+                catch { /* best-effort */ }
+                this.emit("accountError", accountId, `Send failed: ${errMsg}`, "Message kept in Outbox", false);
+                if (/auth|login|credential|invalid/i.test(errMsg)) {
+                    this.outboxBackoff.set(accountId, Date.now() + 3600000); // 1 hour
+                    console.error(`  [outbox] Auth failure for ${accountId} — outbox paused for 1 hour`);
+                }
+            }
+        }
+    }
+    /** Start background Outbox worker — runs immediately then every 10 seconds */
+    outboxBackoff = new Map(); // accountId → next retry timestamp
+    outboxBackoffDelay = new Map(); // accountId → current delay ms
+    startOutboxWorker() {
+        if (this.outboxInterval)
+            return;
+        const processAll = async () => {
+            const now = Date.now();
+            for (const [accountId] of this.configs) {
+                // Skip accounts in backoff
+                const retryAfter = this.outboxBackoff.get(accountId) || 0;
+                if (now < retryAfter)
+                    continue;
+                try {
+                    await this.processLocalQueue(accountId);
+                    await this.processOutbox(accountId);
+                    // Success — clear backoff
+                    this.outboxBackoff.delete(accountId);
+                    this.outboxBackoffDelay.delete(accountId);
+                }
+                catch (e) {
+                    // Stale-socket errors (Dovecot silently drops idle connections,
+                    // or the sync path timed out and destroyed the socket): force a
+                    // fresh ops client so the next tick doesn't keep hitting the same
+                    // dead socket. Without reconnectOps, the dead client stays in the
+                    // opsClients map and every subsequent processOutbox call fails
+                    // immediately with "Not connected" — forever.
+                    const msg = String(e?.message || e);
+                    if (/Not connected|ECONNRESET|socket hang up|EPIPE|write after end/i.test(msg)) {
+                        this.reconnectOps(accountId).catch(() => { });
+                        console.error(`  [outbox] Stale connection for ${accountId}: ${msg} — reconnecting`);
+                    }
+                    else {
+                        // Exponential backoff: 60s → 120s → 300s (max 5min)
+                        const prevDelay = this.outboxBackoffDelay.get(accountId) || 0;
+                        const delay = prevDelay ? Math.min(prevDelay * 2, 300000) : 60000;
+                        this.outboxBackoffDelay.set(accountId, delay);
+                        this.outboxBackoff.set(accountId, now + delay);
+                        console.error(`  [outbox] Error for ${accountId}: ${imapError(e)} (retry in ${Math.round(delay / 1000)}s)`);
+                    }
+                }
+            }
+            // After each full tick, refresh the UI indicator.
+            this.emitOutboxStatus();
+        };
+        // First tick at 500ms so any stale .sending-HOST-DEAD_PID claim file
+        // left behind by a prior crash gets recovered (renamed back to .ltr)
+        // within half a second of startup — otherwise the status-queue pill
+        // shows a red "1 queued" to the user until the first 10s tick passes.
+        setTimeout(() => processAll(), 500);
+        this.outboxInterval = setInterval(processAll, 10000);
+    }
+    /** Stop Outbox worker */
+    stopOutboxWorker() {
+        if (this.outboxInterval) {
+            clearInterval(this.outboxInterval);
+            this.outboxInterval = null;
+        }
+    }
+    // ── Config file watcher ──
+    configWatchers = [];
+    cloudPollTimers = [];
+    /** Watch the local config files for external changes. On change, emit
+     *  configChanged so the UI can show a "restart to apply" banner. Uses
+     *  a debounce to coalesce rapid writes from save tools. */
+    watchConfigFiles() {
+        const files = ["accounts.jsonc", "allowlist.jsonc", "clients.jsonc", "config.jsonc", "contacts.jsonc"];
+        const configDir = getConfigDir();
+        const debounce = new Map();
+        // Cache the last-seen normalized content per file. fs.watch fires on
+        // metadata-only events (atime, attrib change) AND on no-op rewrites
+        // that land identical bytes — both would fire a spurious banner.
+        // Compare after the debounce window and only emit on a real change.
+        const normalize = (s) => s.replace(/^\uFEFF/, "").replace(/\r\n/g, "\n").replace(/[ \t\r\n]+$/, "");
+        const lastContent = new Map();
+        for (const filename of files) {
+            const full = path.join(configDir, filename);
+            if (!fs.existsSync(full))
+                continue;
+            try {
+                lastContent.set(filename, normalize(fs.readFileSync(full, "utf-8")));
+            }
+            catch { /* */ }
+            try {
+                const watcher = fs.watch(full, () => {
+                    const prev = debounce.get(filename);
+                    if (prev)
+                        clearTimeout(prev);
+                    debounce.set(filename, setTimeout(() => {
+                        debounce.delete(filename);
+                        let current = "";
+                        try {
+                            current = normalize(fs.readFileSync(full, "utf-8"));
+                        }
+                        catch { /* missing */ }
+                        const previous = lastContent.get(filename) || "";
+                        if (current === previous) {
+                            console.log(`  [watch] ${filename} fs.watch fired but content unchanged — no banner`);
+                            return;
+                        }
+                        // Log a short diff hint so repeat-firings are diagnosable.
+                        const prevSize = previous.length;
+                        const curSize = current.length;
+                        const firstDiff = (() => {
+                            const n = Math.min(prevSize, curSize);
+                            for (let i = 0; i < n; i++)
+                                if (previous[i] !== current[i])
+                                    return i;
+                            return n;
+                        })();
+                        const prevSnip = previous.slice(Math.max(0, firstDiff - 20), firstDiff + 40).replace(/\n/g, "\\n");
+                        const curSnip = current.slice(Math.max(0, firstDiff - 20), firstDiff + 40).replace(/\n/g, "\\n");
+                        console.log(`  [watch] ${filename} changed: size ${prevSize}→${curSize}, first diff at byte ${firstDiff}`);
+                        console.log(`  [watch]   was: ${JSON.stringify(prevSnip)}`);
+                        console.log(`  [watch]   now: ${JSON.stringify(curSnip)}`);
+                        lastContent.set(filename, current);
+                        this.emit("configChanged", filename);
+                    }, 500));
+                });
+                this.configWatchers.push(watcher);
+            }
+            catch (e) {
+                console.error(`  [watch] Failed to watch ${filename}: ${e.message}`);
+            }
+        }
+        // GDrive has no push/watch for arbitrary Drive files, so edits on
+        // another device (or via Drive web) never fire fs.watch locally.
+        // Poll the cloud copies of the replicated-to-cloud config files
+        // (accounts.jsonc, allowlist.jsonc, clients.jsonc) every 3 minutes,
+        // compare to local, and write-through on difference. The local
+        // fs.watch above then picks up the write and emits configChanged.
+        // config.jsonc is per-machine / local-only — never polled.
+        const cloudFiles = ["accounts.jsonc", "allowlist.jsonc", "clients.jsonc", "contacts.jsonc"];
+        const CLOUD_POLL_MS = 3 * 60 * 1000;
+        // normalize() reused from the fs.watch block above — same intent:
+        // cloud round-trips that re-wrap newlines / add a trailing newline are
+        // semantically identical; don't overwrite local on those.
+        const pollCloud = async () => {
+            let cloudRead;
+            let parseJsonc;
+            try {
+                ({ cloudRead } = await import("@bobfrankston/mailx-settings"));
+                ({ parseJsonc } = await import("jsonc-parser").then(m => ({ parseJsonc: m.parse })));
+            }
+            catch {
+                return; /* cloud module unavailable */
+            }
+            for (const filename of cloudFiles) {
+                try {
+                    const cloudContent = await cloudRead(filename);
+                    if (!cloudContent)
+                        continue;
+                    const localPath = path.join(configDir, filename);
+                    let localContent = null;
+                    try {
+                        localContent = fs.readFileSync(localPath, "utf-8");
+                    }
+                    catch { /* missing */ }
+                    if (localContent !== null) {
+                        if (normalize(localContent) === normalize(cloudContent))
+                            continue;
+                        // Semantic check: parse both as JSONC and compare structures.
+                        // Catches reorderings that normalize() doesn't (e.g. JSON with
+                        // same keys in different order after a cloud-side re-serialize).
+                        try {
+                            const a = parseJsonc(localContent);
+                            const b = parseJsonc(cloudContent);
+                            if (a !== undefined && b !== undefined &&
+                                JSON.stringify(a) === JSON.stringify(b))
+                                continue;
+                        }
+                        catch { /* fall through to write */ }
+                    }
+                    fs.writeFileSync(localPath, cloudContent);
+                    console.log(`  [cloud-poll] ${filename} updated from cloud copy`);
+                }
+                catch (e) {
+                    console.log(`  [cloud-poll] ${filename} check skipped: ${e?.message || e}`);
+                }
+            }
+        };
+        // First poll ~10s after startup, then every 3 min.
+        setTimeout(() => {
+            pollCloud();
+            const interval = setInterval(pollCloud, CLOUD_POLL_MS);
+            this.cloudPollTimers.push(interval);
+        }, 10_000);
+    }
+    /** Stop all config file watchers */
+    stopWatchingConfig() {
+        for (const w of this.configWatchers) {
+            try {
+                w.close();
+            }
+            catch { /* ignore */ }
+        }
+        this.configWatchers = [];
+        for (const t of this.cloudPollTimers) {
+            try {
+                clearInterval(t);
+            }
+            catch { /* ignore */ }
+        }
+        this.cloudPollTimers = [];
+    }
+    // ── Google Contacts Sync (incremental via People API syncToken) ──
+    /** Per-account in-flight guard so concurrent calls (startup + periodic
+     *  timer + manual button) share one round-trip instead of stacking. */
+    contactsSyncing = new Map();
+    /** Get an OAuth token for Google APIs (contacts, calendar, etc.)
+     *  Uses the SAME token as IMAP — scopes are combined in one grant */
+    async getContactsToken(accountId) {
+        // Reuse the IMAP token — it now includes contacts.readonly scope
+        return this.getOAuthToken(accountId);
+    }
+    /** Sync contacts from Google People API. Incremental: persists
+     *  `nextSyncToken` per account in the kv table (`scope='contacts'`,
+     *  `key=accountId`) so subsequent calls only fetch changed/deleted rows.
+     *  First-ever call passes `requestSyncToken=true` so Google returns a
+     *  token to use next time; without that, the first response has no
+     *  `nextSyncToken` and incremental never kicks in. Returns the number of
+     *  contacts added or removed in this run. */
+    async syncGoogleContacts(accountId) {
+        // Coalesce concurrent calls for the same account.
+        const inFlight = this.contactsSyncing.get(accountId);
+        if (inFlight)
+            return inFlight;
+        const promise = this.syncGoogleContactsImpl(accountId)
+            .finally(() => this.contactsSyncing.delete(accountId));
+        this.contactsSyncing.set(accountId, promise);
+        return promise;
+    }
+    async syncGoogleContactsImpl(accountId) {
+        const token = await this.getContactsToken(accountId);
+        if (!token)
+            return 0;
+        let changed = 0;
+        let nextPageToken;
+        const now = Date.now();
+        // Per-account persisted sync token (survives restarts). Empty means
+        // we've never completed an initial sync for this account.
+        let syncToken = this.db.getKv("contacts", accountId) || "";
+        try {
+            do {
+                const params = new URLSearchParams({
+                    personFields: "names,emailAddresses,organizations,photos",
+                    pageSize: "100",
+                });
+                if (nextPageToken)
+                    params.set("pageToken", nextPageToken);
+                if (syncToken) {
+                    params.set("syncToken", syncToken);
+                }
+                else {
+                    // First-ever sync for this account — ask Google to give us
+                    // a token in the response so the NEXT call can be cheap.
+                    params.set("requestSyncToken", "true");
+                }
+                const url = `https://people.googleapis.com/v1/people/me/connections?${params}`;
+                const res = await fetch(url, {
+                    headers: { Authorization: `Bearer ${token}` },
+                });
+                if (res.status === 410) {
+                    // Sync token expired (Google retains tokens for ~7 days).
+                    // Drop the stored token and recurse for a full sync — the
+                    // in-flight guard is on syncGoogleContacts (the public
+                    // wrapper), not Impl, so recursion is safe.
+                    this.db.setKv("contacts", accountId, null);
+                    return this.syncGoogleContactsImpl(accountId);
+                }
+                if (!res.ok) {
+                    const err = await res.text();
+                    console.error(`  [contacts] API error for ${accountId}: ${res.status} ${err}`);
+                    return changed;
+                }
+                const data = await res.json();
+                if (data.connections) {
+                    for (const person of data.connections) {
+                        const googleId = person.resourceName || "";
+                        // Incremental responses tag deleted contacts via
+                        // metadata.deleted=true (and emit no other fields).
+                        // Drop those rows so autocomplete stops surfacing them.
+                        if (person.metadata?.deleted) {
+                            const removed = this.db.deleteContactByGoogleId(googleId);
+                            if (removed > 0)
+                                changed += removed;
+                            continue;
+                        }
+                        const emails = person.emailAddresses || [];
+                        const names = person.names || [];
+                        const orgs = person.organizations || [];
+                        const name = names[0]?.displayName || "";
+                        const org = orgs[0]?.name || "";
+                        for (const emailEntry of emails) {
+                            const email = emailEntry.value?.toLowerCase();
+                            if (!email)
+                                continue;
+                            const existing = this.db.searchContacts(email, 1);
+                            const wasNew = !(existing.length > 0 && existing[0].email === email);
+                            this.db.recordSentAddress(name, email);
+                            if (wasNew)
+                                changed++;
+                            try {
+                                this.db.db.prepare("UPDATE contacts SET source = 'google', google_id = ?, organization = ?, updated_at = ? WHERE email = ?").run(googleId, org, now, email);
+                            }
+                            catch { /* ignore */ }
+                        }
+                    }
+                }
+                nextPageToken = data.nextPageToken;
+                // Google only returns nextSyncToken on the LAST page of a
+                // sync run (sentinel that the snapshot is consistent). When
+                // it appears, persist it for next time.
+                if (data.nextSyncToken) {
+                    this.db.setKv("contacts", accountId, data.nextSyncToken);
+                    syncToken = data.nextSyncToken;
+                }
+            } while (nextPageToken);
+            console.log(`  [contacts] ${accountId}: ${changed} change(s) (${syncToken ? "incremental" : "full"})`);
+        }
+        catch (e) {
+            console.error(`  [contacts] Sync error for ${accountId}: ${e.message}`);
+        }
+        return changed;
+    }
+    /** Sync contacts for all OAuth accounts */
+    async syncAllContacts() {
+        const settings = loadSettings();
+        for (const account of settings.accounts) {
+            if (account.imap.auth === "oauth2" && (account.enabled || account.syncContacts)) {
+                await this.syncGoogleContacts(account.id);
+            }
+        }
+    }
+    /** Shut down all watchers and timers */
+    async shutdown() {
+        this.stopPeriodicSync();
+        this.stopOutboxWorker();
+        await this.stopWatching();
+        // Disconnect all persistent operational connections
+        for (const [accountId] of this.opsClients) {
+            await this.disconnectOps(accountId);
+        }
+    }
+}
+//# sourceMappingURL=index.js.map