@bobfrankston/mailx 1.0.466 → 1.0.500

package/packages/mailx-imap/index.ts

@@ -1,3652 +0,0 @@
-/**
- * @bobfrankston/mailx-imap
- * Multi-account IMAP management wrapping iflow.
- * Syncs messages to local store, emits events for new mail.
- */
-
-import { createAutoImapConfig, CompatImapClient } from "@bobfrankston/iflow-direct";
-import type { TransportFactory } from "@bobfrankston/tcp-transport";
-import { authenticateOAuth } from "@bobfrankston/oauthsupport";
-import { MailxDB, FileMessageStore } from "@bobfrankston/mailx-store";
-import { loadSettings, getStorePath, getConfigDir, getHistoryDays, getPrefetch } from "@bobfrankston/mailx-settings";
-import type { AccountConfig, MessageEnvelope, EmailAddress, Folder } from "@bobfrankston/mailx-types";
-import { EventEmitter } from "node:events";
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { simpleParser } from "mailparser";
-import { GmailApiProvider } from "./providers/gmail-api.js";
-import type { MailProvider, ProviderMessage } from "./providers/types.js";
-import { SmtpClient } from "@bobfrankston/smtp-direct";
-import * as os from "node:os";
-import { fileURLToPath } from "node:url";
-
-// Well-known ports — no magic numbers
-const SMTP_PORT_STARTTLS = 587;
-const SMTP_PORT_IMPLICIT_TLS = 465;
-
-type OpsTask = () => Promise<void>;
-interface OpsQueue {
-    fast: OpsTask[];
-    slow: OpsTask[];
-    running: boolean;
-}
-interface HostSemaphore {
-    permits: number;
-    waiters: Array<() => void>;
-}
-
-/** Per-message SMTP retry delay: if a send attempt fails, wait this long before
- *  the same file is retried. Gives the server time to settle so a retry after a
- *  lost-ack doesn't arrive while the first copy is still being processed. */
-const OUTBOX_RETRY_DELAY_MS = 60000;
-
-/** Parse X-Mailx-Retry* tracking headers from a raw RFC822 message. */
-function parseRetryInfo(raw: string): { attemptCount: number; nextAttemptAt: number } {
-    const headerEnd = raw.search(/\r?\n\r?\n/);
-    const headers = headerEnd >= 0 ? raw.slice(0, headerEnd) : raw;
-    const attemptCount = (headers.match(/^X-Mailx-Retry:/gmi) || []).length;
-    const nextMatch = headers.match(/^X-Mailx-Retry-After:\s*(.+)$/mi);
-    const parsed = nextMatch ? Date.parse(nextMatch[1].trim()) : NaN;
-    return { attemptCount, nextAttemptAt: Number.isFinite(parsed) ? parsed : 0 };
-}
-
-/** Remove every occurrence of a header field from a raw RFC822 message. */
-function stripHeaderField(raw: string, name: string): string {
-    const re = new RegExp(`^${name.replace(/[.*+?^${}()|[\\]\\\\]/g, "\\\\$&")}:.*\\r?\\n`, "gmi");
-    return raw.replace(re, "");
-}
-
-/** Insert a header line just before the header/body blank line. Preserves CRLF vs LF. */
-function insertHeaderBeforeBody(raw: string, line: string): string {
-    const m = raw.match(/\r?\n\r?\n/);
-    if (!m) return raw + "\r\n" + line + "\r\n";
-    const nl = m[0].startsWith("\r\n") ? "\r\n" : "\n";
-    return raw.slice(0, m.index!) + nl + line + raw.slice(m.index!);
-}
-
-/** Error thrown when a message body can't be fetched because the server says
- *  the message is gone (deleted from another device, expunged, etc.). The
- *  caller uses this to remove the stale local row instead of showing a
- *  generic "fetch failed" error to the user. */
-function makeNotFoundError(accountId: string, folderId: number, uid: number): Error {
-    const err = new Error(`Message ${accountId}/${folderId}/${uid} not found on server`);
-    (err as any).isNotFound = true;
-    return err;
-}
-
-/** Extract full error detail with provenance */
-function imapError(err: any): string {
-    const msg = err.message || err.reason || err.code || (typeof err === "string" ? err : "");
-    const parts: string[] = [];
-    if (msg) parts.push(msg);
-    if (err.responseText) parts.push(err.responseText);
-    if (err.responseStatus) parts.push(`[${err.responseStatus}]`);
-    if (err.code && err.code !== msg) parts.push(`[${err.code}]`);
-    if (parts.length === 0) parts.push(`Unexpected error: ${JSON.stringify(err).slice(0, 200)}`);
-    // Add source location if available
-    if (err.stack) {
-        const frame = err.stack.split("\n").find((l: string) => l.includes("imap") || l.includes("transport") || l.includes("compat"));
-        if (frame) parts.push(`(${frame.trim().replace(/^at\s+/, "")})`);
-    }
-    return parts.join(" — ");
-}
-
-/** Events emitted by the IMAP manager */
-export interface ImapManagerEvents {
-    newMessage: (accountId: string, folderId: number, envelope: MessageEnvelope) => void;
-    syncProgress: (accountId: string, phase: string, progress: number) => void;
-    syncComplete: (accountId: string) => void;
-    syncError: (accountId: string, error: string) => void;
-    folderCountsChanged: (accountId: string, counts: Record<number, { total: number; unread: number }>) => void;
-    accountError: (accountId: string, error: string, hint: string, isOAuth: boolean) => void;
-    configChanged: (filename: string) => void;
-    /** Fired after a message body has been written to the local store — lets
-     *  the UI flip a row's "not-downloaded" indicator without re-rendering. */
-    bodyCached: (accountId: string, uid: number) => void;
-    syncActionFailed: (accountId: string, action: string, uid: number, error: string) => void;
-    /** Fired whenever the outbox queue depth or state changes (file added,
-     *  file sent and removed, retry attempted). Lets the UI show a persistent
-     *  queue-status indicator without polling. Aggregate status across all
-     *  accounts is included so the listener doesn't have to reassemble it. */
-    outboxStatus: (status: OutboxStatus) => void;
-    /** Per-account health counter update. Fires when an inactivity timeout,
-     *  connection-cap hit, or rate-limit wait happens. */
-    diagnostics: (accountId: string, snapshot: AccountDiagnostics) => void;
-}
-
-/** Per-account diagnostic counters — tracks "something's wrong" events the
- *  user should be able to see without opening the log. */
-export interface AccountDiagnostics {
-    accountId: string;
-    inactivityTimeouts: number;   // IMAP server dropped the socket mid-command
-    connCapHits: number;          // "Maximum number of connections" rejections
-    rateLimitWaits: number;       // Gmail API 429 cooldowns
-    lastTimeoutAt: number;        // epoch ms of most recent inactivity timeout
-    lastCommand: string;          // IMAP command that last timed out (e.g. "A471 UID STORE 4956119 +FLAGS.SILENT")
-    lastError: string;            // full error message (truncated)
-}
-
-/** Per-account outbox queue breakdown, plus totals for the UI. */
-export interface OutboxStatus {
-    total: number;              // messages waiting to send across all accounts
-    retrying: number;           // subset of total that have at least one X-Mailx-Retry attempt
-    claimed: number;            // subset of total currently in flight (*.sending-host-pid)
-    oldestAgeSec: number;       // age of the oldest pending file, 0 if none
-    maxAttempts: number;        // highest attempt count across all pending files
-    perAccount: Record<string, { total: number; retrying: number; claimed: number }>;
-}
-
-/** Convert iflow address objects to our EmailAddress */
-function toEmailAddress(addr: { name?: string; address?: string }): EmailAddress {
-    return {
-        name: addr?.name || "",
-        address: addr?.address || ""
-    };
-}
-
-/** Convert array of iflow addresses */
-function toEmailAddresses(addrs: { name?: string; address?: string }[]): EmailAddress[] {
-    if (!addrs) return [];
-    return addrs.map(toEmailAddress);
-}
-
-/** Decode HTML entities (&#8199; &amp; etc.) to plain characters */
-function decodeEntities(text: string): string {
-    return text
-        .replace(/&#(\d+);/g, (_, n) => String.fromCodePoint(Number(n)))
-        .replace(/&#x([0-9a-fA-F]+);/g, (_, h) => String.fromCodePoint(parseInt(h, 16)))
-        .replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">")
-        .replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&nbsp;/g, " ");
-}
-
-/** Extract a plain-text preview from message source */
-async function extractPreview(source: string): Promise<{ bodyHtml: string; bodyText: string; preview: string; hasAttachments: boolean }> {
-    try {
-        const parsed = await simpleParser(source);
-        const bodyText = parsed.text || "";
-        const bodyHtml = parsed.html || "";
-        // Use text part; fall back to stripping HTML tags if text is empty
-        let raw = bodyText || bodyHtml.replace(/<[^>]+>/g, " ");
-        const preview = decodeEntities(raw).replace(/\s+/g, " ").trim().slice(0, 200);
-        const hasAttachments = (parsed.attachments?.length || 0) > 0;
-        return { bodyHtml, bodyText, preview, hasAttachments };
-    } catch {
-        return { bodyHtml: "", bodyText: "", preview: "", hasAttachments: false };
-    }
-}
-
-/** Race a promise against a timeout. On timeout, forcibly logout the client to prevent hanging. */
-async function withTimeout<T>(promise: Promise<T>, ms: number, client: any, label: string): Promise<T> {
-    let timer: ReturnType<typeof setTimeout>;
-    const timeout = new Promise<never>((_, reject) => {
-        timer = setTimeout(() => {
-            // Force-close the client to unblock the hanging promise
-            try { client.logout?.(); } catch { /* ignore */ }
-            reject(new Error(`${label} timeout (${ms / 1000}s)`));
-        }, ms);
-    });
-    try {
-        return await Promise.race([promise, timeout]);
-    } finally {
-        clearTimeout(timer!);
-    }
-}
-
-export class ImapManager extends EventEmitter {
-    private configs: Map<string, ReturnType<typeof createAutoImapConfig>> = new Map();
-    private watchers: Map<string, () => void> = new Map();
-    private fetchClients: Map<string, any> = new Map();
-    private db: MailxDB;
-    private bodyStore: FileMessageStore;
-    private syncIntervals: Map<string, ReturnType<typeof setInterval>> = new Map();
-    /** Track which accounts have already shown an error banner — only emit once per session */
-    private accountErrorShown = new Set<string>();
-    private syncing = false;
-    private inboxSyncing = false;
-    /** Use native IMAP client instead of imapflow. Set to true to enable. */
-    useNativeClient = false;
-    // Connection management: see withConnection() below.
-    // Cap-hit backoff machinery removed — bounded per-account concurrency
-    // (one ops socket + one IDLE socket) keeps mailx well under any
-    // reasonable server cap, so the recovery timer was dead weight that
-    // mostly served to lock the UI for minutes after a transient failure.
-
-    /** Per-account health counters. Incremented when the server misbehaves
-     *  in ways that suggest a problem the user should know about (inactivity
-     *  timeouts, connection-cap hits, rate-limit waits). Surfaced via a
-     *  `diagnostics` event + `getDiagnostics` IPC so the UI can show a ⚠
-     *  badge instead of burying the issue in the log. */
-    private diagnostics = new Map<string, AccountDiagnostics>();
-
-    private getDiagnosticsEntry(accountId: string): AccountDiagnostics {
-        let d = this.diagnostics.get(accountId);
-        if (!d) {
-            d = { accountId, inactivityTimeouts: 0, connCapHits: 0, rateLimitWaits: 0, lastTimeoutAt: 0, lastCommand: "", lastError: "" };
-            this.diagnostics.set(accountId, d);
-        }
-        return d;
-    }
-
-    /** Classify an error message and bump the relevant counter; emit the
-     *  updated diagnostics snapshot. Call this from every catch in the sync
-     *  paths so the UI can count "something's wrong" in real time. */
-    private recordError(accountId: string, errMsg: string): void {
-        const d = this.getDiagnosticsEntry(accountId);
-        if (/inactivity timeout/i.test(errMsg)) {
-            d.inactivityTimeouts++;
-            d.lastTimeoutAt = Date.now();
-            const m = errMsg.match(/A\d+ [A-Z ]+.*$/);
-            if (m) d.lastCommand = m[0].slice(0, 120);
-        } else if (/UNAVAILABLE|Maximum number of connections|too many connections/i.test(errMsg)) {
-            d.connCapHits++;
-        } else if (/429|rate limit/i.test(errMsg)) {
-            d.rateLimitWaits++;
-        } else {
-            return; // not a known diagnostic class — don't emit
-        }
-        d.lastError = errMsg.slice(0, 200);
-        this.emit("diagnostics", accountId, { ...d });
-    }
-
-    /** Public read for the IPC surface: snapshot of all account diagnostics. */
-    getDiagnosticsSnapshot(): AccountDiagnostics[] {
-        return Array.from(this.diagnostics.values()).map(d => ({ ...d }));
-    }
-
-    private transportFactory: TransportFactory;
-
-    constructor(db: MailxDB, transportFactory: TransportFactory) {
-        super();
-        this.db = db;
-        this.transportFactory = transportFactory;
-        const storePath = getStorePath();
-        this.bodyStore = new FileMessageStore(storePath);
-    }
-
-    /** Get OAuth access token for an account (for SMTP auth) */
-    async getOAuthToken(accountId: string): Promise<string | null> {
-        const config = this.configs.get(accountId);
-        if (!config || !config.tokenProvider) return null;
-        return config.tokenProvider();
-    }
-
-    /** Accounts currently re-authenticating — all operations skip these */
-    private reauthenticating = new Set<string>();
-    /** Last reauth attempt timestamp per account — prevents reauth loops (5 min cooldown) */
-    private lastReauthAttempt = new Map<string, number>();
-
-    /** Force re-authentication for an OAuth account — deletes cached IMAP token, triggers browser consent */
-    async reauthenticate(accountId: string): Promise<boolean> {
-        if (this.reauthenticating.has(accountId)) return false; // already in progress
-        this.reauthenticating.add(accountId);
-
-        try {
-            const settings = loadSettings();
-            const account = settings.accounts.find(a => a.id === accountId);
-            if (!account) return false;
-
-            // Stop IDLE watcher for this account
-            const stopWatcher = this.watchers.get(accountId);
-            if (stopWatcher) { try { await stopWatcher(); } catch { /* */ } this.watchers.delete(accountId); }
-
-            // Delete only the IMAP token (not contacts — separate scope, separate consent)
-            const accountDir = account.imap.user.replace(/[@.]/g, "_");
-            const tokenDir = path.join(getConfigDir(), "tokens", accountDir);
-            const tokenPath = path.join(tokenDir, "token.json");
-            if (fs.existsSync(tokenPath)) { fs.unlinkSync(tokenPath); console.log(`  [reauth] Deleted ${tokenPath}`); }
-
-            // Re-register the account to get a fresh config with new tokenProvider
-            this.configs.delete(accountId);
-            await this.addAccount(account);
-
-            // addAccount already pre-validates the token (opens browser if needed)
-            const config = this.configs.get(accountId);
-            if (config?.tokenProvider) {
-                console.log(`  [reauth] ${accountId}: success`);
-                this.accountErrorShown.delete(accountId);
-                this.syncInbox().catch(() => {});
-                return true;
-            }
-        } catch (e: any) {
-            console.error(`  [reauth] ${accountId}: ${e.message}`);
-        } finally {
-            this.reauthenticating.delete(accountId);
-        }
-        return false;
-    }
-
-    /** Delete a message directly on the IMAP server (for stuck outbox messages not in local DB) */
-    async deleteOnServer(accountId: string, folderPath: string, uid: number): Promise<void> {
-        return this.withConnection(accountId, async (client) => {
-            await client.deleteMessageByUid(folderPath, uid);
-            console.log(`  Deleted UID ${uid} from ${folderPath} on server`);
-        });
-    }
-
-    /** Search messages on the IMAP server — returns matching UIDs */
-    async searchOnServer(accountId: string, mailboxPath: string, criteria: any): Promise<number[]> {
-        return this.withConnection(accountId, async (client) => {
-            return await client.searchMessages(mailboxPath, criteria);
-        });
-    }
-
-    /** Server-side search that also materializes any UIDs we don't yet have
-     *  locally. Returns the full result after upsert, so the caller can
-     *  render hits that fall outside the history window. The fetch loop
-     *  can be long for big hit-sets, so this runs on the slow lane and
-     *  yields between chunks (each chunk is a separate withConnection)
-     *  so an interactive body fetch can interleave. */
-    async searchAndFetchOnServer(accountId: string, folderId: number, mailboxPath: string, criteria: any): Promise<number[]> {
-        const uids = await this.withConnection(accountId, async (client) => {
-            return await client.searchMessages(mailboxPath, criteria) as number[];
-        });
-        if (uids.length === 0) return [];
-        const have = new Set(this.db.getUidsForFolder(accountId, folderId));
-        const missing = uids.filter(u => !have.has(u));
-        if (missing.length > 0) {
-            const folder = this.db.getFolders(accountId).find(f => f.id === folderId);
-            if (folder) {
-                const CHUNK = 500;
-                for (let i = 0; i < missing.length; i += CHUNK) {
-                    const range = missing.slice(i, i + CHUNK).join(",");
-                    await this.withConnection(accountId, async (client) => {
-                        const fetched = await (client as any).fetchMessages(mailboxPath, range, { source: false });
-                        if (fetched?.length) {
-                            await this.storeMessages(accountId, folderId, folder, fetched, 0);
-                        }
-                    }, { slow: true });
-                }
-                this.db.recalcFolderCounts(folderId);
-            }
-        }
-        return uids;
-    }
-
-    /** Create a fresh IMAP client for an account (public access for API endpoints) */
-    async createPublicClient(accountId: string): Promise<any> {
-        return this.createClient(accountId);
-    }
-
-    // Legacy fallback disabled — was doubling connections without helping.
-    // To re-enable: uncomment legacyFallbacks logic in createClient and _syncAll.
-    // private legacyFallbacks = new Set<string>();
-
-    // ── Connection management: one persistent connection per account ──
-    // All operations on an account are serialized through an operation queue.
-    // No semaphore, no pool, no per-operation connect/disconnect.
-    // IDLE uses a separate connection (see startWatching).
-
-    /** Persistent operational connections — one per account, reused for all operations.
-     *  Body fetch, sync, prefetch, outbox-append, flag/move all serialize through
-     *  this single client per account via withConnection(). The priority lane
-     *  in the queue lets interactive clicks jump ahead of background prefetch. */
-    private opsClients = new Map<string, any>();
-    /** Two-lane operation queue per account — interactive ops (body fetch on
-     *  click, flag toggle) drain before background ops (sync, prefetch). FIFO
-     *  within each lane. The single ops connection means there's never a race
-     *  on which folder is SELECTed; commands run strictly sequentially. */
-    private opsQueues = new Map<string, OpsQueue>();
-    /** Per-host semaphore — caps simultaneous IMAP socket opens to one server.
-     *  Defensive guardrail: with the single-ops-per-account model an individual
-     *  user's mailx never hits more than (#accounts × 2) sockets per host, well
-     *  under any reasonable server cap. Exists for the multi-account-on-one-host
-     *  case (e.g. bobma + bobma2 both on imap.iecc.com). */
-    private hostSemaphores = new Map<string, HostSemaphore>();
-    private static readonly HOST_PERMITS = 4;
-
-    /** Get (or create) the persistent operational connection for an account.
-     *  logout() is wrapped as a no-op so legacy callers don't close it. */
-    private async getOpsClient(accountId: string): Promise<any> {
-        let client = this.opsClients.get(accountId);
-        if (client) {
-            // C38: health-check the cached client before returning. If the
-            // underlying socket is dead (Dovecot silently dropped IDLE after
-            // the inactivity timeout, or we lost connectivity), the next
-            // command would fail with "Not connected" — and nothing would
-            // recover it until an explicit reconnectOps was called from the
-            // catch handler. Cheap pre-check here catches it earlier.
-            const sock = client?.native?.transport?.socket;
-            const dead = sock?.destroyed || sock?.readyState === "closed" || client?._dead;
-            if (!dead) return client;
-            try { await (client._realLogout || client.logout)(); } catch { /* */ }
-            this.opsClients.delete(accountId);
-            console.log(`  [conn] ${accountId}: stale ops client detected in getOpsClient — reconnecting`);
-            client = undefined as any;
-        }
-        client = await this.newClient(accountId, "ops");
-        // Wrap logout as no-op — this is a persistent connection. The
-        // newClient wrapper's close-counter runs on `_realLogout`.
-        const realLogout = client.logout.bind(client);
-        client.logout = async () => { /* no-op — persistent connection */ };
-        client._realLogout = realLogout;
-        this.opsClients.set(accountId, client);
-        return client;
-    }
-
-    /** Run an operation on the account's connection — queued, sequential, no concurrency */
-    /** Run an operation against the account's single ops connection. Tasks
-     *  queue strictly sequentially per account — only one IMAP command in
-     *  flight at a time. This eliminates the SELECT-races and "stale client
-     *  recovery" paths the old multi-client design needed.
-     *
-     *  Default lane is `fast` — covers virtually everything (body fetch,
-     *  flag toggle, move, incremental sync). Pass `slow: true` only for
-     *  operations the caller knows will take a long time and shouldn't
-     *  block the user (multi-folder prefetch batches, large backfills).
-     *  When both lanes have tasks, fast drains first.
-     *
-     *  Within a lane, FIFO. The running task always finishes — IMAP can't
-     *  preempt a command mid-flight. */
-    async withConnection<T>(
-        accountId: string,
-        fn: (client: any) => Promise<T>,
-        opts: { slow?: boolean; timeoutMs?: number } = {},
-    ): Promise<T> {
-        let queue = this.opsQueues.get(accountId);
-        if (!queue) {
-            queue = { fast: [], slow: [], running: false };
-            this.opsQueues.set(accountId, queue);
-        }
-        // Per-task wall-clock cap. Without one, a wedged IMAP command (TCP
-        // half-open, server stalled mid-FETCH) keeps the queue's running flag
-        // set forever and every subsequent fast-lane task — including the
-        // retry button the user just hit — waits behind it. Default is
-        // generous; callers driving user-visible reads pass a tighter value.
-        const timeoutMs = opts.timeoutMs ?? 90_000;
-        return new Promise<T>((resolve, reject) => {
-            const task: OpsTask = async () => {
-                let timer: any;
-                try {
-                    const client = await this.getOpsClient(accountId);
-                    const result = await Promise.race<T>([
-                        fn(client),
-                        new Promise<T>((_, rej) => {
-                            timer = setTimeout(() => rej(new Error(`ops timeout after ${Math.round(timeoutMs / 1000)}s — discarding client`)), timeoutMs);
-                        }),
-                    ]);
-                    clearTimeout(timer);
-                    resolve(result);
-                } catch (e: any) {
-                    clearTimeout(timer);
-                    // Discard client on any error — keeping a half-broken
-                    // socket poisoned every subsequent request. Destroy
-                    // synchronously kills the in-flight command's socket so
-                    // the underlying promise rejects and stops holding state.
-                    const stale = this.opsClients.get(accountId);
-                    this.opsClients.delete(accountId);
-                    if (stale) {
-                        try { await (stale._realLogout || stale.logout)(); } catch { /* */ }
-                        try { stale.destroy?.(); } catch { /* */ }
-                    }
-                    reject(e);
-                }
-            };
-            (opts.slow ? queue!.slow : queue!.fast).push(task);
-            this.drainOpsQueue(accountId);
-        });
-    }
-
-    /** Run the next queued task. Fast lane drains before slow.
-     *  Idempotent — safe to call after each task completes; the running
-     *  flag prevents reentrant draining. */
-    private drainOpsQueue(accountId: string): void {
-        const queue = this.opsQueues.get(accountId);
-        if (!queue || queue.running) return;
-        const next = queue.fast.shift() || queue.slow.shift();
-        if (!next) return;
-        queue.running = true;
-        next().finally(() => {
-            queue.running = false;
-            this.drainOpsQueue(accountId);
-        });
-    }
-
-    /** Acquire one slot of the per-host connection semaphore. Returns a release
-     *  function — call exactly once when the socket is closed. Used by
-     *  newClient to cap simultaneous IMAP connections to a single server
-     *  across all mailx accounts. */
-    private acquireHostSlot(host: string): Promise<() => void> {
-        let sem = this.hostSemaphores.get(host);
-        if (!sem) {
-            sem = { permits: ImapManager.HOST_PERMITS, waiters: [] };
-            this.hostSemaphores.set(host, sem);
-        }
-        const semRef = sem;
-        return new Promise<() => void>(resolve => {
-            const grant = () => {
-                semRef.permits--;
-                let released = false;
-                resolve(() => {
-                    if (released) return;
-                    released = true;
-                    semRef.permits++;
-                    const next = semRef.waiters.shift();
-                    if (next) next();
-                });
-            };
-            if (semRef.permits > 0) grant();
-            else semRef.waiters.push(grant);
-        });
-    }
-
-    /** Open IMAP clients per account, used to trace who's opening sockets
-     *  when we hit the Dovecot per-user+IP connection cap. */
-    private openClients: Map<string, Set<any>> = new Map();
-
-    /** Create a new IMAP client (internal — callers use getOpsClient or withConnection).
-     *  Acquires one slot of the per-host semaphore before constructing the
-     *  client; the slot is released when logout() or destroy() runs.
-     *  `purpose` is a short tag printed alongside the `[conn+]` log so we can
-     *  tell which code path (ops/idle/etc.) opened each connection. */
-    private async newClient(accountId: string, purpose = "?"): Promise<any> {
-        if (this.reauthenticating.has(accountId)) throw new Error(`Account ${accountId} is re-authenticating`);
-        const config = this.configs.get(accountId);
-        if (!config) throw new Error(`No config for account ${accountId}`);
-        const host = config.server || accountId;
-        const releaseHostSlot = await this.acquireHostSlot(host);
-        let client: any;
-        try {
-            client = new CompatImapClient(config, this.transportFactory);
-        } catch (e) {
-            releaseHostSlot();
-            throw e;
-        }
-        let open = this.openClients.get(accountId);
-        if (!open) { open = new Set(); this.openClients.set(accountId, open); }
-        open.add(client);
-        console.log(`  [conn+] ${accountId} (${purpose}) — ${open.size} open`);
-        let closed = false;
-        const markClosed = (how: string) => {
-            if (closed) return;
-            closed = true;
-            open!.delete(client);
-            releaseHostSlot();
-            console.log(`  [conn-] ${accountId} (${purpose}/${how}) — ${open!.size} open`);
-        };
-        const origLogout = client.logout?.bind(client);
-        if (origLogout) {
-            client.logout = async () => {
-                try { await origLogout(); }
-                finally { markClosed("logout"); }
-            };
-        }
-        const origDestroy = client.destroy?.bind(client);
-        if (origDestroy) {
-            client.destroy = () => {
-                try { origDestroy(); }
-                finally { markClosed("destroy"); }
-            };
-        }
-        return client;
-    }
-
-    /** Force-close every IMAP socket for an account — ops + any lingering
-     *  ones in openClients (e.g. an IDLE watcher in flight). Used during
-     *  account removal and disconnectOps so the server's connection slots
-     *  free immediately rather than waiting for socket idle timeouts. */
-    async closeAllClients(accountId: string): Promise<void> {
-        const ops = this.opsClients.get(accountId);
-        this.opsClients.delete(accountId);
-        if (ops) { try { await (ops._realLogout || ops.logout)(); } catch { /* */ } try { ops.destroy?.(); } catch { /* */ } }
-        const open = this.openClients.get(accountId);
-        if (open) {
-            for (const c of Array.from(open)) {
-                try { await (c._realLogout || c.logout)?.(); } catch { /* */ }
-                try { c.destroy?.(); } catch { /* */ }
-            }
-            open.clear();
-        }
-    }
-
-    /** Disconnect the persistent operational connection for an account */
-    async disconnectOps(accountId: string): Promise<void> {
-        const client = this.opsClients.get(accountId);
-        this.opsClients.delete(accountId);
-        if (client) {
-            // Force-close: don't wait for LOGOUT on a possibly dead socket
-            try {
-                const timeout = new Promise(r => setTimeout(r, 2000));
-                await Promise.race([(client._realLogout || client.logout)(), timeout]);
-            } catch { /* */ }
-            // Destroy underlying socket if still open
-            try { client.destroy?.(); } catch { /* */ }
-            console.log(`  [conn] ${accountId}: disconnected`);
-        }
-    }
-
-    /** Legacy entry: returns the shared persistent ops client. Most callers
-     *  should be using `withConnection()` instead — that gives proper
-     *  queueing and lets fast operations jump ahead of slow ones. */
-    async createClientWithLimit(accountId: string): Promise<any> {
-        return this.getOpsClient(accountId);
-    }
-    /** Disposable fresh client — only used by the IDLE watcher, which holds
-     *  its own socket so the fast/slow ops queue isn't blocked by IDLE
-     *  parking the connection in a wait-for-server state. */
-    private async createClient(accountId: string, purpose = "misc"): Promise<any> {
-        return this.newClient(accountId, purpose);
-    }
-    private trackLogout(_accountId: string): void { /* no-op — connection stays alive */ }
-
-    /** Number of registered IMAP accounts */
-    getAccountCount(): number { return this.configs.size; }
-
-    /** Register an account */
-    async addAccount(account: AccountConfig): Promise<void> {
-        if (this.configs.has(account.id)) return;
-
-        // createAutoImapConfig auto-detects Gmail from server/username and sets up OAuth
-        // For OAuth accounts, provide a tokenProvider using oauthsupport
-        let tokenProvider: (() => Promise<string>) | undefined;
-        if (account.imap.auth === "oauth2" || (!account.imap.password && account.imap.host?.includes("gmail"))) {
-            // Find Google OAuth credentials — check ~/.mailx first, then iflow-direct package
-            let credPath = path.join(getConfigDir(), "google-credentials.json");
-            if (!fs.existsSync(credPath)) {
-                try {
-                    // Use fileURLToPath, NOT string-replace on "file://" — on Linux,
-                    // file:///usr/local/... loses its leading slash via .replace("file:///",
-                    // "") and becomes relative, so fs.existsSync silently fails.
-                    const pkgDir = path.dirname(fileURLToPath(import.meta.resolve("@bobfrankston/iflow-direct")));
-                    for (const name of ["iflow-credentials.json"]) {
-                        const p = path.join(pkgDir, name);
-                        if (fs.existsSync(p)) { credPath = p; break; }
-                    }
-                } catch { /* iflow-direct not resolvable */ }
-            }
-            const tokenDir = path.join(getConfigDir(), "tokens", account.imap.user.replace(/[@.]/g, "_"));
-            tokenProvider = async () => {
-                // Wall-clock timeout on OAuth. Use a longer timeout when no
-                // cached token exists (first auth needs user to click through
-                // the browser consent screen — 30s is too tight).
-                const hasToken = fs.existsSync(path.join(tokenDir, "oauth-token.json"));
-                const TOKEN_FETCH_TIMEOUT_MS = hasToken ? 30_000 : 120_000;
-                const authPromise = authenticateOAuth(credPath, {
-                    // Scope set covers two-way sync of all mailx-managed local
-                    // stores: mail (mail.google.com), contacts (full, not
-                    // readonly — we write edits back), calendar (full), tasks
-                    // (full), drive (for shared accounts.jsonc).
-                    scope: "https://mail.google.com/ https://www.googleapis.com/auth/contacts https://www.googleapis.com/auth/calendar https://www.googleapis.com/auth/tasks https://www.googleapis.com/auth/drive",
-                    tokenDirectory: tokenDir,
-                    credentialsKey: "installed",
-                    loginHint: account.imap.user,
-                });
-                const timeoutPromise = new Promise<never>((_, reject) =>
-                    setTimeout(() => reject(new Error(`OAuth token fetch timeout (${TOKEN_FETCH_TIMEOUT_MS / 1000}s)`)), TOKEN_FETCH_TIMEOUT_MS)
-                );
-                const result = await Promise.race([authPromise, timeoutPromise]);
-                return result?.access_token || "";
-            };
-        }
-        // Non-Gmail accounts (typically Dovecot / generic IMAP) get a smaller
-        // fetch chunk size (10 vs 25) and longer inactivity timeout (300s) so
-        // multi-body FETCH batches don't trip the connection-dead detector on
-        // slow servers. Gmail stays at the defaults since it's fast and has
-        // its own rate limits to respect.
-        const isGmail = account.imap.host?.includes("gmail") || account.email.endsWith("@gmail.com");
-        const config = createAutoImapConfig({
-            server: account.imap.host,
-            port: account.imap.port,
-            username: account.imap.user,
-            password: account.imap.password,
-            tokenProvider,
-            inactivityTimeout: isGmail ? 60000 : 300000,
-            fetchChunkSize: isGmail ? 25 : 10,
-            fetchChunkSizeMax: isGmail ? 500 : 100,
-        });
-
-        this.configs.set(account.id, config);
-
-        // Register account in DB
-        this.db.upsertAccount(account.id, account.name, account.email, JSON.stringify(account));
-
-        // Pre-validate OAuth token (so browser consent happens now, not during a timed sync)
-        if (config.tokenProvider) {
-            try {
-                await config.tokenProvider();
-                console.log(`  [auth] ${account.id}: token valid`);
-            } catch (e: any) {
-                const errMsg = imapError(e);
-                console.error(`  [auth] ${account.id}: ${errMsg}`);
-                const isTransient = /timeout|ECONNREFUSED|ECONNRESET|ETIMEDOUT|ENETUNREACH/i.test(errMsg);
-                if (isTransient) {
-                    console.log(`  [transient] ${account.id}: ${errMsg} — will retry on first sync`);
-                } else if (!this.accountErrorShown.has(account.id)) {
-                    this.accountErrorShown.add(account.id);
-                    const config = this.configs.get(account.id);
-                    this.emit("accountError", account.id, errMsg, errMsg, !!config?.tokenProvider);
-                }
-            }
-        }
-    }
-
-    /** Check if an account uses Gmail (should use API instead of IMAP) */
-    private isGmailAccount(accountId: string): boolean {
-        const settings = loadSettings();
-        const account = settings.accounts.find(a => a.id === accountId);
-        if (!account) return false;
-        return account.imap?.host?.includes("gmail") || account.email?.endsWith("@gmail.com") || false;
-    }
-
-    /** Get a Gmail API provider for an account (reuses tokenProvider from IMAP config) */
-    private getGmailProvider(accountId: string): GmailApiProvider {
-        const config = this.configs.get(accountId);
-        if (!config?.tokenProvider) throw new Error(`No tokenProvider for ${accountId}`);
-        return new GmailApiProvider(config.tokenProvider);
-    }
-
-    /** Convert ProviderMessage to the shape expected by storeMessages/upsertMessage */
-    private providerMsgToLocal(msg: ProviderMessage): any {
-        return {
-            uid: msg.uid,
-            messageId: msg.messageId,
-            date: msg.date || new Date(),
-            subject: msg.subject,
-            from: msg.from,
-            to: msg.to,
-            cc: msg.cc,
-            seen: msg.seen,
-            flagged: msg.flagged,
-            answered: msg.answered,
-            draft: msg.draft,
-            size: msg.size,
-            source: msg.source,
-            providerId: msg.providerId,
-        };
-    }
-
-    /** Sync folder list for an account */
-    async syncFolders(accountId: string, client?: any): Promise<Folder[]> {
-        if (!client) client = await this.getOpsClient(accountId);
-
-        this.emit("syncProgress", accountId, "folders", 0);
-
-        const t0 = Date.now();
-        console.log(`  [diag] ${accountId}: getFolderList starting...`);
-        const folders = await client.getFolderList();
-        console.log(`  [diag] ${accountId}: getFolderList done in ${Date.now() - t0}ms (${folders.length} folders)`);
-        const specialFolders = client.getSpecialFolders(folders);
-
-        // Collect server paths so we can prune anything the server no longer
-        // has (user-renamed / -deleted / case-flipped a folder from another
-        // client). IMAP paths are case-sensitive, so "Foo" → "foo" is a real
-        // delete+create of two distinct mailboxes.
-        const serverPaths = new Set<string>();
-
-        for (const folder of folders) {
-            // Skip non-selectable folders (virtual parents like "Added", "Added2")
-            const flags = (folder as any).flags as Set<string> | string[] | undefined;
-            const flagArr = flags instanceof Set ? [...flags] : (flags || []);
-            if (flagArr.some((f: string) => f.toLowerCase() === "\\noselect" || f.toLowerCase() === "\\nonexistent")) continue;
-
-            let specialUse: string = null as any;
-            if (specialFolders.inbox === folder.path) specialUse = "inbox";
-            else if (specialFolders.sent === folder.path) specialUse = "sent";
-            else if (specialFolders.trash === folder.path) specialUse = "trash";
-            else if (specialFolders.drafts === folder.path) specialUse = "drafts";
-            else if (specialFolders.spam === folder.path || specialFolders.junk === folder.path) specialUse = "junk";
-            else if (specialFolders.archive === folder.path) specialUse = "archive";
-
-            this.db.upsertFolder(
-                accountId,
-                folder.path,
-                folder.name || folder.path.split(folder.delimiter || "/").pop() || folder.path,
-                specialUse,
-                folder.delimiter || "/"
-            );
-            serverPaths.add(folder.path);
-        }
-
-        // Prune: any local folder whose exact path (case-sensitive) isn't in
-        // the server's list has been deleted or renamed server-side. Safety
-        // rails: only prune when the server returned a non-empty list (empty
-        // result is more likely a transient protocol / auth error than "all
-        // your folders were deleted"). Never prune INBOX under any
-        // circumstances — even a broken server response shouldn't make us
-        // drop the account's primary mailbox. All other special-use folders
-        // ARE prunable: if the user actually deleted Sent on the server,
-        // we should reflect that locally, and the next sync will re-detect
-        // the server's real Sent folder and re-upsert.
-        if (folders.length > 0) {
-            const localFolders = this.db.getFolders(accountId);
-            const stale = localFolders.filter(f =>
-                !serverPaths.has(f.path) &&
-                f.specialUse !== "inbox"
-            );
-            for (const f of stale) {
-                console.log(`  [sync] ${accountId}: pruning stale folder "${f.path}" (id=${f.id}) — no longer on server`);
-                try { this.db.deleteFolder(f.id); }
-                catch (e: any) { console.error(`  [sync] ${accountId}: prune failed for "${f.path}": ${e.message}`); }
-            }
-            if (stale.length > 0) {
-                this.emit("folderCountsChanged", accountId, {});
-            }
-        }
-
-        this.emit("syncProgress", accountId, "folders", 100);
-        // Notify UI that folder structure changed — triggers tree re-render
-        const dbFolders = this.db.getFolders(accountId);
-        this.emit("folderCountsChanged", accountId, {});
-        return dbFolders;
-    }
-
-    /** Store a batch of messages to DB immediately — used by onChunk for incremental sync */
-    private async storeMessages(accountId: string, folderId: number, folder: any, msgs: any[], highestUid: number): Promise<number> {
-        let stored = 0;
-        this.db.beginTransaction();
-        try {
-            for (const msg of msgs) {
-                // Debug: log subjects with non-ASCII to trace encoding issues
-                if (msg.subject && /[^\x00-\x7F]/.test(msg.subject)) {
-                    const hex = Buffer.from(msg.subject, "utf-8").subarray(0, 40).toString("hex");
-                    console.log(`  [encoding] subject: "${msg.subject.substring(0, 60)}" hex: ${hex}`);
-                }
-                if (msg.uid <= highestUid) continue; // already have it
-                // Tombstone check: if the user locally deleted this Message-ID,
-                // don't re-import it. Server-side EXPUNGE may lag, or reconcile
-                // may find the message in an old list snapshot. Without this,
-                // deleted messages reappear on the next sync pass.
-                if (msg.messageId && this.db.hasTombstone(accountId, msg.messageId)) {
-                    console.log(`  [tombstone] ${accountId}: skipping ${msg.messageId} (locally deleted)`);
-                    continue;
-                }
-                const source = msg.source || "";
-                let bodyPath = "";
-                let preview = "";
-                let hasAttachments = false;
-                if (source) {
-                    bodyPath = await this.bodyStore.putMessage(
-                        accountId, folderId, msg.uid,
-                        Buffer.from(source, "utf-8")
-                    );
-                    const parsed = await extractPreview(source);
-                    preview = parsed.preview;
-                    hasAttachments = parsed.hasAttachments;
-                }
-                const flags: string[] = [];
-                if (msg.seen) flags.push("\\Seen");
-                if (msg.flagged) flags.push("\\Flagged");
-                if (msg.answered) flags.push("\\Answered");
-                if (msg.draft) flags.push("\\Draft");
-                this.db.upsertMessage({
-                    accountId, folderId, uid: msg.uid,
-                    messageId: msg.messageId || "",
-                    inReplyTo: (msg as any).inReplyTo || "",
-                    references: [],
-                    date: msg.date instanceof Date ? msg.date.getTime() : (typeof msg.date === "number" ? msg.date : Date.now()),
-                    subject: msg.subject || "",
-                    from: toEmailAddress(msg.from?.[0] || {}),
-                    to: toEmailAddresses(msg.to || []),
-                    cc: toEmailAddresses(msg.cc || []),
-                    flags, size: msg.size || 0, hasAttachments, preview, bodyPath
-                });
-                stored++;
-            }
-            this.db.commitTransaction();
-        } catch (e: any) {
-            this.db.rollbackTransaction();
-            console.error(`  storeMessages error: ${e.message}`);
-        }
-        return stored;
-    }
-
-    /** Sync messages for a specific folder */
-    async syncFolder(accountId: string, folderId: number, client?: any): Promise<number> {
-        if (!client) client = await this.getOpsClient(accountId);
-        const prefetch = getPrefetch();
-
-        const folders = this.db.getFolders(accountId);
-        const folder = folders.find(f => f.id === folderId);
-        if (!folder) throw new Error(`Folder ${folderId} not found`);
-
-        this.emit("syncProgress", accountId, `sync:${folder.path}`, 0);
-
-        // Get the highest UID we already have for this folder
-        const highestUid = this.db.getHighestUid(accountId, folderId);
-        console.log(`  [sync] ${accountId}/${folder.path}: highestUid=${highestUid}, fetching...`);
-
-        let messages: any[];
-        const firstSync = highestUid === 0;
-        const historyDays = getHistoryDays(accountId);
-        // historyDays=0 means "all". On first sync we still cap at 30 days
-        // so the UI isn't empty for minutes while SEARCH SINCE 1970 runs
-        // through a years-old mailbox. Once we have any local messages, the
-        // backfill below extends the window in 90-day chunks per sync cycle.
-        let effectiveDays = historyDays;
-        if (effectiveDays === 0 && firstSync) effectiveDays = 30;
-        const startDate = effectiveDays > 0
-            ? new Date(Date.now() - effectiveDays * 86400000)
-            : new Date(0);
-
-        if (highestUid > 0) {
-            // Incremental: fetch new messages — prefetch bodies for offline access
-            const fetched = await client.fetchMessagesSinceUid(folder.path, highestUid, { source: false });
-            // Filter out the last known message (IMAP * always returns at least one)
-            messages = fetched.filter((m: any) => m.uid > highestUid);
-
-            // Gap detection: check for missing UIDs within the range we've already synced
-            // Only reconcile between our lowest and highest UID — don't try to fetch the entire folder history
-            const existingUids = this.db.getUidsForFolder(accountId, folderId);
-            if (existingUids.length > 0) {
-                try {
-                    const lowestUid = Math.min(...existingUids);
-                    // Fetch UIDs in our known range from IMAP
-                    const rangeUids = await (client as any).getUids(folder.path);
-                    const rangeInScope = rangeUids.filter((uid: number) => uid >= lowestUid && uid <= highestUid);
-                    const existingSet = new Set(existingUids);
-                    const newSet = new Set(messages.map(m => m.uid));
-                    const missingUids = rangeInScope.filter((uid: number) => !existingSet.has(uid) && !newSet.has(uid));
-                    if (missingUids.length > 0 && missingUids.length <= 5000) {
-                        console.log(`  ${folder.path}: gap detected — ${missingUids.length} missing UIDs in range ${lowestUid}..${highestUid}`);
-                        const chunkSize = 500;
-                        let recoveredTotal = 0;
-                        for (let i = 0; i < missingUids.length; i += chunkSize) {
-                            const chunk = missingUids.slice(i, i + chunkSize);
-                            const range = chunk.join(",");
-                            const recovered = await (client as any).fetchMessages(folder.path, range, { source: false });
-                            messages.push(...recovered);
-                            recoveredTotal += recovered.length;
-                            console.log(`  ${folder.path}: gap-fill ${recoveredTotal}/${missingUids.length}`);
-                        }
-                    } else if (missingUids.length > 5000) {
-                        console.log(`  ${folder.path}: ${missingUids.length} missing UIDs — too many, skipping reconciliation (delete DB to force full re-sync)`);
-                    }
-                } catch (e: any) {
-                    console.error(`  ${folder.path}: gap detection failed: ${e.message}`);
-                }
-            }
-
-            // Backfill: if the history window reaches further back than our
-            // oldest local message, fetch the gap. Chunk 90 days per sync
-            // cycle so historyDays=0 catches up incrementally instead of
-            // asking Dovecot for SEARCH SINCE 1970 in one go.
-            const oldestDate = this.db.getOldestDate(accountId, folderId);
-            if (oldestDate > 0 && startDate.getTime() < oldestDate) {
-                try {
-                    const CHUNK_MS = 90 * 86400000;
-                    const chunkStart = new Date(Math.max(startDate.getTime(), oldestDate - CHUNK_MS));
-                    const existingUids = new Set(this.db.getUidsForFolder(accountId, folderId));
-                    const backfill = await client.fetchMessageByDate(folder.path, chunkStart, new Date(oldestDate), { source: false });
-                    const newBackfill = backfill.filter((m: any) => !existingUids.has(m.uid));
-                    if (newBackfill.length > 0) {
-                        console.log(`  ${folder.path}: backfilling ${newBackfill.length} older messages (${chunkStart.toISOString().slice(0,10)} → ${new Date(oldestDate).toISOString().slice(0,10)})`);
-                        messages.push(...newBackfill);
-                    }
-                } catch (e: any) {
-                    console.error(`  ${folder.path}: backfill failed: ${e.message}`);
-                }
-            }
-        } else {
-            // First sync: fetch in chunks, store each chunk immediately for instant UI
-            let totalStored = 0;
-            const onChunk = async (chunk: any[]) => {
-                const stored = await this.storeMessages(accountId, folderId, folder, chunk, highestUid);
-                totalStored += stored;
-                if (stored > 0) {
-                    this.db.recalcFolderCounts(folderId);
-                    this.emit("folderCountsChanged", accountId, {});
-                }
-            };
-            const tomorrow = new Date(Date.now() + 86400000); // IMAP BEFORE is exclusive
-            // First sync: metadata only for fast UI — bodies prefetched in background after
-            messages = await (client as any).fetchMessageByDate(folder.path, startDate, tomorrow, { source: false }, onChunk);
-            if (totalStored > 0) {
-                console.log(`  ${folder.path}: ${totalStored} messages (streamed)`);
-                this.db.recalcFolderCounts(folderId);
-                this.emit("folderCountsChanged", accountId, {});
-                this.emit("syncProgress", accountId, `sync:${folder.path}`, 100);
-                return totalStored;
-            }
-        }
-        if (messages.length > 0) console.log(`  ${folder.path}: ${messages.length} new messages`);
-
-        let newCount = 0;
-        const batchSize = 50;
-
-        for (let batchStart = 0; batchStart < messages.length; batchStart += batchSize) {
-            const batchEnd = Math.min(batchStart + batchSize, messages.length);
-            this.db.beginTransaction();
-            try {
-                for (let i = batchStart; i < batchEnd; i++) {
-                    const msg = messages[i];
-
-                    // Skip if we already have this UID
-                    if (msg.uid <= highestUid) {
-                        // But update flags in case they changed
-                        const flags: string[] = [];
-                        if (msg.seen) flags.push("\\Seen");
-                        if (msg.flagged) flags.push("\\Flagged");
-                        if (msg.answered) flags.push("\\Answered");
-                        if (msg.draft) flags.push("\\Draft");
-                        this.db.updateMessageFlags(accountId, msg.uid, flags);
-                        continue;
-                    }
-
-                    // Tombstone check — same reason as the streamy onChunk path
-                    // at storeMessages: a locally-deleted message that the server
-                    // hasn't EXPUNGEd yet would otherwise reappear on next sync.
-                    // User-visible symptom: "I deleted it but it came back."
-                    if (msg.messageId && this.db.hasTombstone(accountId, msg.messageId)) {
-                        console.log(`  [tombstone] ${accountId}: skipping ${msg.messageId} in syncFolder (locally deleted)`);
-                        continue;
-                    }
-
-                    // Store body
-                    const source = msg.source || "";
-                    let bodyPath = "";
-                    if (source) {
-                        bodyPath = await this.bodyStore.putMessage(
-                            accountId, folderId, msg.uid,
-                            Buffer.from(source, "utf-8")
-                        );
-                    }
-
-                    // Parse for preview and attachment info
-                    const parsed = await extractPreview(source);
-
-                    // Build flags array
-                    const flags: string[] = [];
-                    if (msg.seen) flags.push("\\Seen");
-                    if (msg.flagged) flags.push("\\Flagged");
-                    if (msg.answered) flags.push("\\Answered");
-                    if (msg.draft) flags.push("\\Draft");
-
-                    // Store metadata
-                    this.db.upsertMessage({
-                        accountId,
-                        folderId,
-                        uid: msg.uid,
-                        messageId: msg.messageId || "",
-                        inReplyTo: (msg as any).inReplyTo || "",
-                        references: [],
-                        date: msg.date instanceof Date ? msg.date.getTime() : (typeof msg.date === "number" ? msg.date : Date.now()),
-                        subject: msg.subject || "",
-                        from: toEmailAddress(msg.from?.[0] || {}),
-                        to: toEmailAddresses(msg.to || []),
-                        cc: toEmailAddresses(msg.cc || []),
-                        flags,
-                        size: msg.size || 0,
-                        hasAttachments: parsed.hasAttachments,
-                        preview: parsed.preview,
-                        bodyPath
-                    });
-
-                    newCount++;
-                }
-                this.db.commitTransaction();
-            } catch (e: any) {
-                console.error(`    transaction error: ${e.message}`);
-                this.db.rollbackTransaction();
-                throw e;
-            }
-
-            // Emit progress and notify client after each batch
-            this.emit("syncProgress", accountId, `sync:${folder.path}`,
-                Math.round((batchEnd / messages.length) * 100));
-
-            // On first sync, emit folderCountsChanged per batch so newest messages appear immediately
-            if (firstSync && newCount > 0) {
-                this.db.recalcFolderCounts(folderId);
-                const folderInfo = this.db.getFolders(accountId).find(f => f.id === folderId);
-                this.emit("folderCountsChanged", accountId, {
-                    [folderId]: { total: folderInfo?.totalCount || 0, unread: folderInfo?.unreadCount || 0 }
-                });
-            }
-        }
-        if (newCount > 0) console.log(`    stored ${newCount} new messages`);
-
-        // Remove messages deleted on the server (skip on first sync — nothing to reconcile).
-        //
-        // SAFETY (same three guards the Gmail API path uses, see ~line 1388):
-        //   1. Skip if server returned an empty list but we have local messages
-        //      (transient Dovecot error / connection hiccup returning empty UID SEARCH
-        //      must not wipe the folder).
-        //   2. Refuse to delete more than 50% in one pass — indicates a sync bug,
-        //      never a real user action. User can fix with `mailx -rebuild` if real.
-        //   3. Log every deletion with Message-ID + subject so future reports have
-        //      data (the "ubiquiti letter disappeared after reply" case had no trace).
-        let deletedCount = 0;
-        if (!firstSync) {
-            try {
-                const serverUidsArr = await client.getUids(folder.path);
-                const serverUids = new Set(serverUidsArr);
-                const localUids = this.db.getUidsForFolder(accountId, folderId);
-                const toDelete = localUids.filter(uid => !serverUids.has(uid));
-                if (serverUidsArr.length === 0 && localUids.length > 0) {
-                    console.log(`  [sync] ${accountId}/${folder.path}: reconcile skipped — server UID list empty but local has ${localUids.length} (treating as transient)`);
-                } else if (localUids.length > 0 && toDelete.length / localUids.length > 0.5) {
-                    console.log(`  [sync] ${accountId}/${folder.path}: reconcile REFUSED — would delete ${toDelete.length}/${localUids.length} (${Math.round(toDelete.length / localUids.length * 100)}%) — probably a sync bug, skipping`);
-                } else {
-                    for (const uid of toDelete) {
-                        const env = this.db.getMessageByUid(accountId, uid);
-                        const tag = env ? `msgid=${env.messageId || "?"} subj="${(env.subject || "").slice(0, 60)}"` : "unknown";
-                        console.log(`  [reconcile-delete] ${accountId}/${folder.path} uid=${uid} ${tag}`);
-                        this.unlinkBodyFile(accountId, uid, folderId).catch(() => {});
-                        this.db.deleteMessage(accountId, uid);
-                        deletedCount++;
-                    }
-                    if (deletedCount > 0) console.log(`    removed ${deletedCount} deleted messages`);
-                }
-            } catch (e: any) {
-                console.error(`    deletion sync error: ${e.message}`);
-            }
-        }
-
-        // Update folder counts from local DB (after deletions + additions)
-        // Use recalcFolderCounts — single SQL query instead of fetching all messages
-        this.db.recalcFolderCounts(folderId);
-
-        this.emit("syncProgress", accountId, `sync:${folder.path}`, 100);
-
-        const syncedAt = Date.now();
-        // Notify client to refresh if anything changed
-        if (newCount > 0 || deletedCount > 0) {
-            const updatedFolder = this.db.getFolders(accountId).find(f => f.id === folderId);
-            this.emit("folderCountsChanged", accountId, {
-                [folderId]: { total: updatedFolder?.totalCount || 0, unread: updatedFolder?.unreadCount || 0 }
-            });
-        }
-        this.emit("folderSynced", accountId, folderId, syncedAt);
-        this.db.updateLastSync(accountId, syncedAt);
-
-        return newCount;
-    }
-
-    /** Sync all folders for all accounts */
-    async syncAll(): Promise<void> {
-        if (this.syncing) return; // Prevent concurrent syncs
-        this.syncing = true;
-        try {
-            await Promise.race([
-                this._syncAll(),
-                new Promise<void>((_, reject) => setTimeout(() => reject(new Error("Global sync timeout (10min)")), 600000))
-            ]);
-        } catch (e: any) {
-            console.error(`  syncAll error: ${e.message}`);
-        } finally { this.syncing = false; }
-    }
-
-    private async _syncAll(): Promise<void> {
-        const priorityOrder = ["sent", "drafts", "archive", "junk", "trash"];
-
-        // Sync all accounts in parallel — each manages its own connection.
-        // Prefetch runs per-account immediately after that account's sync
-        // completes, NOT after all accounts finish. This way a slow account
-        // (bobma with 300s timeouts) doesn't block prefetch for a fast account
-        // (Gmail). The old code put prefetch after `allSettled`, but syncAll
-        // has a 10-minute wall-clock timeout that killed it first — so
-        // prefetch never ran.
-        const syncAndPrefetch = async (accountId: string) => {
-            try {
-                await this.syncAccount(accountId, priorityOrder);
-            } catch {
-                // syncAccount already logs + emits syncError. Don't follow a
-                // failed sync with a body-prefetch storm into the same API:
-                // a 429 on listLabels means Gmail is in cooldown, so firing
-                // prefetch next would just re-trigger the same limit.
-                return;
-            }
-            if (getPrefetch()) {
-                this.prefetchBodies(accountId).catch(e =>
-                    console.error(`  [prefetch] ${accountId}: ${e.message}`)
-                );
-            }
-        };
-        const syncPromises = [...this.configs.keys()].map(syncAndPrefetch);
-        await Promise.allSettled(syncPromises);
-    }
-
-    /** Sync a single account — manages its own connection lifecycle */
-    private async syncAccount(accountId: string, priorityOrder: string[]): Promise<void> {
-        // Gmail: use REST API instead of IMAP
-        if (this.isGmailAccount(accountId)) {
-            return this.syncAccountViaApi(accountId, priorityOrder);
-        }
-
-        try {
-            // Step 1: Get folder list (fast — <1s typically)
-            let client = await this.getOpsClient(accountId);
-            const t0 = Date.now();
-            const folders = await this.syncFolders(accountId, client);
-            console.log(`  [timing] ${accountId}: folder list ${Date.now() - t0}ms (${folders.length} folders)`);
-
-            // Step 2: Sync INBOX first — keep retrying on failure (most important folder)
-            const inbox = folders.find(f => f.specialUse === "inbox");
-            if (inbox) {
-                console.log(`  [sync] ${accountId}: starting INBOX sync (folder ${inbox.id})`);
-                const maxAttempts = 5;
-                let inboxDone = false;
-                for (let attempt = 1; attempt <= maxAttempts && !inboxDone; attempt++) {
-                    try {
-                        client = await this.getOpsClient(accountId);
-                        if (attempt > 1) console.log(`  [sync] ${accountId}: INBOX retry #${attempt}`);
-                        await this.syncFolder(accountId, inbox.id, client);
-                        console.log(`  [sync] ${accountId}: INBOX sync complete`);
-                        inboxDone = true;
-                        // Kick off prefetch as soon as INBOX is fresh, not
-                        // after all 105 folders finish — bobma's full sync
-                        // can take 30+ minutes on a wide folder tree, and
-                        // INBOX is the only folder the user is staring at.
-                        // Uses the body client (separate connection from
-                        // ops), so it runs concurrently with the rest of the
-                        // folder sync without contending for the same socket.
-                        if (getPrefetch()) {
-                            this.prefetchBodies(accountId).catch(e =>
-                                console.error(`  [prefetch] ${accountId}: ${e.message}`)
-                            );
-                        }
-                    } catch (e: any) {
-                        console.error(`  Inbox sync error for ${accountId} (attempt ${attempt}/${maxAttempts}): ${e.message}`);
-                        await this.reconnectOps(accountId);
-                        if (attempt < maxAttempts) {
-                            const delay = Math.min(attempt * 5000, 15000);
-                            console.log(`  [sync] ${accountId}: waiting ${delay / 1000}s before INBOX retry`);
-                            await new Promise(r => setTimeout(r, delay));
-                        }
-                    }
-                }
-                if (!inboxDone) {
-                    console.error(`  [sync] ${accountId}: INBOX failed after ${maxAttempts} attempts — will retry next sync cycle`);
-                    this.emit("syncError", accountId, `INBOX sync failed after ${maxAttempts} attempts`);
-                    // Even when sync failed, try to prefetch bodies for messages
-                    // already in the local DB. Prefetch uses a separate body
-                    // client (not the ops client that just timed out), so a
-                    // sync timeout on SELECT/SEARCH doesn't necessarily mean
-                    // body fetches will also fail. Without this, a server
-                    // having a slow patch would leave every message with a
-                    // white "not-downloaded" dot indefinitely until sync
-                    // recovers — even though prior syncs already populated
-                    // headers that prefetch can flesh out independently.
-                    if (getPrefetch()) {
-                        this.prefetchBodies(accountId).catch(e =>
-                            console.error(`  [prefetch] ${accountId}: ${e.message}`)
-                        );
-                    }
-                }
-            } else {
-                console.log(`  [sync] ${accountId}: no INBOX folder found`);
-            }
-
-            // Step 3: Sync remaining folders.
-            //
-            // Parallel pool (concurrency 2) with a per-folder wall-clock cap.
-            // Previous serial loop meant one slow Dovecot UID FETCH could park
-            // every other folder behind it for minutes — user observed "mailx
-            // says synced but 90 folders are empty" because the loop never
-            // progressed past the stalled FETCH before the next sync tick.
-            //
-            // Parallelism uses independent IMAP sockets from the ops-client
-            // pool, so one stalled socket doesn't block the others. The 60s
-            // timeout abandons a stalled command instead of waiting out
-            // Dovecot's 300s server-side inactivity timer; the next sync tick
-            // retries on a fresh socket.
-            const remaining = folders.filter(f => f.specialUse !== "inbox");
-            remaining.sort((a, b) => {
-                const pa = priorityOrder.indexOf(a.specialUse || "") >= 0 ? priorityOrder.indexOf(a.specialUse || "") : 5;
-                const pb = priorityOrder.indexOf(b.specialUse || "") >= 0 ? priorityOrder.indexOf(b.specialUse || "") : 5;
-                return pa - pb;
-            });
-
-            const CONCURRENCY = 2;
-            const PER_FOLDER_TIMEOUT_MS = 60_000;
-            const total = remaining.length;
-            let done = 0;
-            let idx = 0;
-
-            const syncOne = async (folder: any): Promise<void> => {
-                const isTrashChild = folder.path.includes("/") && folder.path.toLowerCase().startsWith("trash");
-                const highestUid = this.db.getHighestUid(accountId, folder.id);
-                if (isTrashChild && highestUid === 0) return;
-                try {
-                    const fresh = await this.getOpsClient(accountId);
-                    await Promise.race([
-                        this.syncFolder(accountId, folder.id, fresh),
-                        new Promise((_, reject) => setTimeout(
-                            () => reject(new Error(`per-folder timeout (${PER_FOLDER_TIMEOUT_MS / 1000}s): ${folder.path}`)),
-                            PER_FOLDER_TIMEOUT_MS
-                        )),
-                    ]);
-                } catch (e: any) {
-                    if (e.responseText?.includes("doesn't exist")) {
-                        this.db.deleteFolder(folder.id);
-                    } else {
-                        console.error(`  Skipping ${folder.path}: ${e.message}`);
-                        this.recordError(accountId, e.message || String(e));
-                        // A timeout or stale-socket failure — drop the ops
-                        // client so the next iteration reconnects rather than
-                        // inheriting the doomed socket.
-                        await this.reconnectOps(accountId).catch(() => {});
-                    }
-                }
-            };
-
-            const worker = async (): Promise<void> => {
-                while (true) {
-                    const myIdx = idx++;
-                    if (myIdx >= remaining.length) return;
-                    const folder = remaining[myIdx];
-                    this.emit("syncProgress", accountId, `folders:${folder.path}`, Math.round((done / Math.max(total, 1)) * 100));
-                    await syncOne(folder);
-                    done++;
-                    this.emit("syncProgress", accountId, `folders-done`, Math.round((done / Math.max(total, 1)) * 100));
-                    console.log(`  [sync] ${accountId}: folder ${done}/${total} done (${folder.path})`);
-                }
-            };
-
-            await Promise.all(Array.from({ length: Math.min(CONCURRENCY, remaining.length) }, () => worker()));
-
-            this.accountErrorShown.delete(accountId);
-            this.emit("syncComplete", accountId);
-        } catch (e: any) {
-            const errMsg = imapError(e);
-            this.emit("syncError", accountId, errMsg);
-            this.recordError(accountId, errMsg);
-            console.error(`Sync error for ${accountId}: ${errMsg}`);
-            this.handleSyncError(accountId, errMsg);
-        }
-    }
-
-    /** Sync a Gmail account via REST API — no IMAP connections */
-    private async syncAccountViaApi(accountId: string, priorityOrder: string[]): Promise<void> {
-        try {
-            const api = this.getGmailProvider(accountId);
-            const t0 = Date.now();
-
-            // Step 1: Sync folder list via API
-            console.log(`  [api] ${accountId}: listing labels...`);
-            const apiFolders = await api.listFolders();
-            console.log(`  [api] ${accountId}: ${apiFolders.length} labels in ${Date.now() - t0}ms`);
-
-            // Store folders in DB (same as IMAP path)
-            for (const f of apiFolders) {
-                const specialUse = f.specialUse || "";
-                this.db.upsertFolder(accountId, f.path, f.name, specialUse, f.delimiter);
-            }
-            this.emit("folderCountsChanged", accountId, {});
-            const dbFolders = this.db.getFolders(accountId);
-
-            // Step 2: Sync folders — INBOX first, then by priority
-            const inbox = dbFolders.find(f => f.specialUse === "inbox");
-            const remaining = dbFolders.filter(f => f.specialUse !== "inbox");
-            remaining.sort((a, b) => {
-                const pa = priorityOrder.indexOf(a.specialUse || "") >= 0 ? priorityOrder.indexOf(a.specialUse || "") : 5;
-                const pb = priorityOrder.indexOf(b.specialUse || "") >= 0 ? priorityOrder.indexOf(b.specialUse || "") : 5;
-                return pa - pb;
-            });
-
-            const foldersToSync = inbox ? [inbox, ...remaining] : remaining;
-
-            for (const folder of foldersToSync) {
-                try {
-                    await this.syncFolderViaApi(accountId, folder, api);
-                } catch (e: any) {
-                    console.error(`  [api] ${accountId}/${folder.path}: ${e.message}`);
-                }
-            }
-
-            await api.close();
-            this.accountErrorShown.delete(accountId);
-            this.emit("syncComplete", accountId);
-        } catch (e: any) {
-            const errMsg = e.message || String(e);
-            this.emit("syncError", accountId, errMsg);
-            console.error(`  [api] Sync error for ${accountId}: ${errMsg}`);
-            this.handleSyncError(accountId, errMsg);
-            // Propagate so the caller skips the prefetch that would otherwise
-            // fire straight into the same 429/cooldown and make it worse.
-            throw e;
-        }
-    }
-
-    /** Sync a single folder via Gmail/Outlook API */
-    private async syncFolderViaApi(accountId: string, folder: Folder, api: MailProvider): Promise<void> {
-        const highestUid = this.db.getHighestUid(accountId, folder.id);
-        const historyDays = getHistoryDays(accountId);
-        const effectiveDays = (historyDays === 0 && highestUid === 0) ? 30 : historyDays;
-        const startDate = effectiveDays > 0 ? new Date(Date.now() - effectiveDays * 86400000) : new Date(0);
-        const tomorrow = new Date(Date.now() + 86400000);
-
-        this.emit("syncProgress", accountId, `sync:${folder.path}`, 0);
-        console.log(`  [api] ${accountId}/${folder.path}: syncing (highestUid=${highestUid})...`);
-
-        let messages: ProviderMessage[];
-        if (highestUid > 0) {
-            // Incremental: fetch messages since last known UID.
-            // Gmail "UIDs" are hashed (not chronological), so fetchSince
-            // returns messages in hash order — they can be from ANY date.
-            // Pass the date window so the provider can page the whole range
-            // (otherwise Gmail's default 200-id cap truncates high-volume
-            // inboxes to ~10 days regardless of historyDays).
-            const fetchOpts: any = { source: false };
-            if (effectiveDays > 0) fetchOpts.since = startDate;
-            messages = await api.fetchSince(folder.path, highestUid, fetchOpts);
-            if (effectiveDays > 0) {
-                const cutoff = startDate.getTime();
-                const before = messages.length;
-                messages = messages.filter(m => !m.date || m.date.getTime() >= cutoff);
-                if (messages.length < before) {
-                    console.log(`  [api] ${accountId}/${folder.path}: filtered ${before - messages.length} messages older than ${effectiveDays}d`);
-                }
-            }
-
-            // Backfill: if the history window reaches further back than our
-            // oldest local message, fetch the gap. Mirrors the IMAP path —
-            // otherwise a user who started with historyDays=30 and later
-            // sets it to 0 (or 365) never actually sees older mail. Cap
-            // each sync cycle at 90 days so unlimited-history accounts
-            // catch up incrementally instead of paging the whole mailbox.
-            const oldestDate = this.db.getOldestDate(accountId, folder.id);
-            if (oldestDate > 0 && startDate.getTime() < oldestDate) {
-                try {
-                    const CHUNK_MS = 90 * 86400000;
-                    const chunkStart = new Date(Math.max(startDate.getTime(), oldestDate - CHUNK_MS));
-                    const existingUids = new Set(this.db.getUidsForFolder(accountId, folder.id));
-                    const backfill = await api.fetchByDate(folder.path, chunkStart, new Date(oldestDate), { source: false });
-                    const newBackfill = backfill.filter(m => !existingUids.has(m.uid));
-                    if (newBackfill.length > 0) {
-                        console.log(`  [api] ${accountId}/${folder.path}: backfilling ${newBackfill.length} older messages (${chunkStart.toISOString().slice(0,10)} → ${new Date(oldestDate).toISOString().slice(0,10)})`);
-                        messages.push(...newBackfill);
-                    }
-                } catch (e: any) {
-                    console.error(`  [api] ${accountId}/${folder.path}: backfill failed: ${e.message}`);
-                }
-            }
-        } else {
-            // First sync: fetch by date range
-            messages = await api.fetchByDate(folder.path, startDate, tomorrow, { source: false },
-                (chunk) => {
-                    // Stream chunks to DB for instant UI
-                    const stored = this.storeApiMessages(accountId, folder.id, chunk, highestUid);
-                    if (stored > 0) {
-                        this.db.recalcFolderCounts(folder.id);
-                        this.emit("folderCountsChanged", accountId, {});
-                    }
-                });
-            // First sync chunks already stored via onChunk — just update counts
-            this.db.recalcFolderCounts(folder.id);
-            this.emit("folderCountsChanged", accountId, {});
-            this.emit("syncProgress", accountId, `sync:${folder.path}`, 100);
-            if (messages.length > 0) console.log(`  [api] ${accountId}/${folder.path}: ${messages.length} messages`);
-            return;
-        }
-
-        if (messages.length > 0) {
-            console.log(`  [api] ${accountId}/${folder.path}: ${messages.length} new messages`);
-            this.storeApiMessages(accountId, folder.id, messages, highestUid);
-        }
-
-        // Reconcile deletions — messages present locally but not on the server.
-        // SAFETY: this used to silently wipe entire folders when getUids()
-        // returned a partial list (e.g. paginated fetch hit a rate limit and
-        // bailed). Multiple guards now:
-        //   1. getUids() flags partial results via _truncated — refuse to delete
-        //   2. If server list is empty but local isn't, assume a transient error
-        //   3. If reconcile would delete more than RECONCILE_DELETE_THRESHOLD of
-        //      local messages, log and skip — safer to keep phantoms than to lose
-        //      real messages. User can fix with `mailx -rebuild` if needed.
-        try {
-            const serverUidsArr = await api.getUids(folder.path);
-            const serverUids = new Set(serverUidsArr);
-            const localUids = this.db.getUidsForFolder(accountId, folder.id);
-            if ((serverUidsArr as any)._truncated) {
-                console.log(`  [api] ${accountId}/${folder.path}: reconcile skipped — server list truncated (${serverUidsArr.length} ids)`);
-            } else if (serverUidsArr.length === 0 && localUids.length > 0) {
-                console.log(`  [api] ${accountId}/${folder.path}: reconcile skipped — server list empty but local has ${localUids.length}`);
-            } else {
-                const toDelete = localUids.filter(uid => !serverUids.has(uid));
-                const RECONCILE_DELETE_THRESHOLD = 0.5; // refuse to delete >50% in one pass
-                if (localUids.length > 0 && toDelete.length / localUids.length > RECONCILE_DELETE_THRESHOLD) {
-                    console.log(`  [api] ${accountId}/${folder.path}: reconcile refused — would delete ${toDelete.length}/${localUids.length} (${Math.round(toDelete.length / localUids.length * 100)}%) — probably a sync bug, skipping`);
-                } else {
-                    for (const uid of toDelete) {
-                        const env = this.db.getMessageByUid(accountId, uid);
-                        const tag = env ? `msgid=${env.messageId || "?"} subj="${(env.subject || "").slice(0, 60)}"` : "unknown";
-                        console.log(`  [reconcile-delete] ${accountId}/${folder.path} uid=${uid} ${tag}`);
-                        this.unlinkBodyFile(accountId, uid, folder.id).catch(() => {});
-                        this.db.deleteMessage(accountId, uid);
-                    }
-                    if (toDelete.length > 0) console.log(`  [api] ${accountId}/${folder.path}: ${toDelete.length} deleted`);
-                }
-            }
-        } catch (e: any) {
-            console.error(`  [api] ${accountId}/${folder.path}: reconciliation error: ${e.message}`);
-        }
-
-        this.db.recalcFolderCounts(folder.id);
-        this.emit("folderCountsChanged", accountId, {});
-        this.emit("folderSynced", accountId, folder.id, Date.now());
-        this.emit("syncProgress", accountId, `sync:${folder.path}`, 100);
-    }
-
-    /** Store API-fetched messages to DB */
-    private storeApiMessages(accountId: string, folderId: number, msgs: ProviderMessage[], highestUid: number): number {
-        // highestUid kept for signature compatibility but no longer used to
-        // filter — Gmail message IDs aren't monotonic, so `msg.uid <= highestUid`
-        // would drop brand-new messages whose hash happens to be smaller than
-        // the previous high. upsertMessage's primary-key dedup handles it.
-        void highestUid;
-        let stored = 0;
-        let errors = 0;
-        // Don't wrap the whole batch in one transaction: a single bad row
-        // would roll back the entire batch. E.g. a message with a malformed
-        // Date header gave `new Date(rawStr).getTime() === NaN`, SQLite
-        // coerced that to NULL, the NOT NULL constraint failed, and the
-        // whole Gmail sync lost 200 messages per tick. Now each row runs
-        // standalone — bad rows are logged and skipped.
-        for (const msg of msgs) {
-            try {
-                // Tombstone check — Gmail API sync was missing this so a
-                // locally-trashed Gmail message would reappear on the next
-                // listMessages tick if Gmail's eventual-consistency hadn't
-                // promoted the trash yet. Symmetric with the IMAP paths.
-                if (msg.messageId && this.db.hasTombstone(accountId, msg.messageId)) {
-                    continue;
-                }
-                const flags: string[] = [];
-                if (msg.seen) flags.push("\\Seen");
-                if (msg.flagged) flags.push("\\Flagged");
-                if (msg.answered) flags.push("\\Answered");
-                if (msg.draft) flags.push("\\Draft");
-                // Sanitize date: reject NaN (from malformed RFC 822 Date headers)
-                // and fall back to "now" so the message still lands in the DB.
-                let dateMs = Date.now();
-                if (msg.date instanceof Date) {
-                    const t = msg.date.getTime();
-                    if (Number.isFinite(t)) dateMs = t;
-                }
-                this.db.upsertMessage({
-                    accountId, folderId, uid: msg.uid,
-                    messageId: msg.messageId || "",
-                    inReplyTo: msg.inReplyTo || "",
-                    references: msg.references || [],
-                    date: dateMs,
-                    subject: msg.subject || "",
-                    from: toEmailAddress(msg.from?.[0] || {}),
-                    to: toEmailAddresses(msg.to || []),
-                    cc: toEmailAddresses(msg.cc || []),
-                    flags, size: msg.size || 0, hasAttachments: false, preview: "", bodyPath: "",
-                    providerId: msg.providerId || "",
-                });
-                stored++;
-            } catch (e: any) {
-                errors++;
-                if (errors <= 3) {
-                    console.error(`  [api] upsert ${accountId}/${folderId}/${msg.uid} (${msg.messageId}): ${e.message}`);
-                }
-            }
-        }
-        if (errors > 0) console.error(`  [api] storeApiMessages: ${errors} of ${msgs.length} rows failed (${stored} stored)`);
-        return stored;
-    }
-
-    /** Kill and recreate the persistent ops connection */
-    private async reconnectOps(accountId: string): Promise<void> {
-        const old = this.opsClients.get(accountId);
-        this.opsClients.delete(accountId);
-        if (old) { try { await (old._realLogout || old.logout)(); } catch { /* */ } }
-        console.log(`  [conn] ${accountId}: reconnecting`);
-    }
-
-    /** Handle sync errors — classify and emit appropriate UI events.
-     *  The connection-cap branch was removed: with the unified ops queue +
-     *  per-host semaphore, mailx alone can't exceed the server cap. If the
-     *  cap *is* hit, that means another client (Thunderbird, phone, sibling
-     *  process) is holding slots — punishing mailx with a multi-minute
-     *  blackout doesn't help the user, the next sync tick will retry. */
-    private handleSyncError(accountId: string, errMsg: string): void {
-        const config = this.configs.get(accountId);
-        const isOAuth = !!config?.tokenProvider;
-        const isTransient = /timeout|ECONNREFUSED|ECONNRESET|ETIMEDOUT|ENETUNREACH|Too many/i.test(errMsg);
-        const isAuth = /auth|login|credential|token|AUTHENTICATIONFAILED/i.test(errMsg);
-
-        if (isTransient) {
-            console.log(`  [transient] ${accountId}: ${errMsg} — will retry next cycle`);
-        } else if (isAuth && isOAuth) {
-            const lastReauth = this.lastReauthAttempt.get(accountId) || 0;
-            if (Date.now() - lastReauth > 300000 && !this.reauthenticating.has(accountId)) {
-                this.lastReauthAttempt.set(accountId, Date.now());
-                this.reauthenticate(accountId).catch(() => {});
-            }
-            if (!this.accountErrorShown.has(accountId)) {
-                this.accountErrorShown.add(accountId);
-                this.emit("accountError", accountId, errMsg, "Authentication expired — re-authenticate", true);
-            }
-        } else if (!this.accountErrorShown.has(accountId)) {
-            this.accountErrorShown.add(accountId);
-            this.emit("accountError", accountId, errMsg, errMsg, isOAuth);
-        }
-    }
-
-    /** Fetch ONLY new messages above highestUid for one account's INBOX —
-     *  the IDLE callback's hot path. Skips gap detection, backfill, and the
-     *  server reconcile (each of which fetches a full UID list — multi-second
-     *  on a large mailbox). The 5-minute STATUS poll path still runs full
-     *  `syncFolder` so deletions and gaps eventually reconcile. */
-    async syncInboxNewOnly(accountId: string): Promise<void> {
-        if (this.isGmailAccount(accountId)) return; // IDLE is IMAP-only
-        const inbox = this.db.getFolders(accountId).find(f => f.specialUse === "inbox");
-        if (!inbox) return;
-        try {
-            await this.withConnection(accountId, async (client: any) => {
-                const highestUid = this.db.getHighestUid(accountId, inbox.id);
-                if (highestUid === 0) {
-                    // First sync — fall through to full path so the date-windowed
-                    // backfill runs. `syncFolder` handles the no-highestUid case.
-                    await this.syncFolder(accountId, inbox.id, client);
-                    return;
-                }
-                const fetched = await client.fetchMessagesSinceUid(inbox.path, highestUid, { source: false });
-                const fresh = fetched.filter((m: any) => m.uid > highestUid);
-                if (fresh.length === 0) return;
-                const stored = await this.storeMessages(accountId, inbox.id, inbox, fresh, highestUid);
-                if (stored > 0) {
-                    this.db.recalcFolderCounts(inbox.id);
-                    const updated = this.db.getFolders(accountId).find(f => f.id === inbox.id);
-                    this.emit("folderCountsChanged", accountId, {
-                        [inbox.id]: { total: updated?.totalCount || 0, unread: updated?.unreadCount || 0 }
-                    });
-                    this.emit("folderSynced", accountId, inbox.id, Date.now());
-                    console.log(`  [idle-fast] ${accountId}: stored ${stored} new message(s)`);
-                }
-            });
-        } catch (e: any) {
-            console.error(`  [idle-fast] ${accountId}: ${e.message}`);
-        }
-    }
-
-    /** Sync just INBOX for each account (fast check for new mail) */
-    async syncInbox(): Promise<void> {
-        if (this.inboxSyncing) return;
-        this.inboxSyncing = true;
-        try {
-            for (const [accountId] of this.configs) {
-                try {
-                    const inbox = this.db.getFolders(accountId).find(f => f.specialUse === "inbox");
-                    if (!inbox) continue;
-                    // Gmail: use REST API, NOT IMAP. Mixing paths causes UID
-                    // mismatch — API uses hashed IDs, IMAP uses server-assigned
-                    // UIDs. The IMAP reconcile then deletes every API-synced
-                    // message because their UIDs don't appear in the IMAP list.
-                    if (this.isGmailAccount(accountId)) {
-                        const api = this.getGmailProvider(accountId);
-                        try {
-                            await this.syncFolderViaApi(accountId, inbox, api);
-                        } finally {
-                            try { await api.close(); } catch { /* ignore */ }
-                        }
-                    } else {
-                        await this.withConnection(accountId, async (client) => {
-                            await this.syncFolder(accountId, inbox.id, client);
-                        });
-                    }
-                } catch (e: any) {
-                    console.error(`  [inbox] Sync error for ${accountId}: ${e.message}`);
-                }
-            }
-        } finally {
-            this.inboxSyncing = false;
-        }
-    }
-
-    /** Quick inbox check — per-account lightweight probe.
-     *  If the probe value changed since last time, triggers an inbox sync.
-     *  The marker is only advanced after a successful sync so that a failed
-     *  sync doesn't eat the "new mail" signal and make us stop retrying. */
-    private lastInboxMarker = new Map<string, string | number>();
-    private quickCheckRunning = new Set<string>(); // per-account guard
-
-    /** Shared quick-check skeleton: probe → compare → sync-if-changed → advance marker.
-     *  `probe` returns the current marker value; `sync` runs only when it differs
-     *  from the previously stored value. Marker is advanced only after sync resolves. */
-    private async quickCheck<T extends string | number>(
-        accountId: string,
-        probe: () => Promise<T | null>,
-        sync: (current: T, prev: T | undefined) => Promise<void>,
-    ): Promise<void> {
-        if (this.quickCheckRunning.has(accountId)) return;
-        if (this.reauthenticating.has(accountId)) return;
-        this.quickCheckRunning.add(accountId);
-        try {
-            const current = await probe();
-            if (current === null || current === "" as any) return;
-            const prev = this.lastInboxMarker.get(accountId) as T | undefined;
-            if (prev === undefined || current !== prev) {
-                await sync(current, prev);
-            }
-            // Only advance after sync succeeds — a thrown error skips this line
-            // and the next tick will see the same delta and retry.
-            this.lastInboxMarker.set(accountId, current);
-        } catch {
-            // Lightweight check — silently ignore errors
-        } finally {
-            this.quickCheckRunning.delete(accountId);
-        }
-    }
-
-    /** Check a single account's inbox — uses its own connection, never blocked by sync */
-    async quickInboxCheckAccount(accountId: string): Promise<void> {
-        if (this.isGmailAccount(accountId)) return this.quickGmailCheck(accountId);
-        return this.quickImapCheck(accountId);
-    }
-
-    private async quickImapCheck(accountId: string): Promise<void> {
-        const inbox = this.db.getFolders(accountId).find(f => f.specialUse === "inbox");
-        if (!inbox) return;
-        let client: any = null;
-        try {
-            await this.quickCheck<number>(
-                accountId,
-                async () => {
-                    client = await this.newClient(accountId, "quickCheck");
-                    return await client.getMessagesCount("INBOX");
-                },
-                async (count, prev) => {
-                    if (prev !== undefined) console.log(`  [check] ${accountId} INBOX: ${prev} → ${count}`);
-                    await this.syncFolder(accountId, inbox.id, client);
-                },
-            );
-        } finally {
-            if (client) { try { await client.logout(); } catch { /* */ } }
-        }
-    }
-
-    private async quickGmailCheck(accountId: string): Promise<void> {
-        const config = this.configs.get(accountId);
-        if (!config?.tokenProvider) return;
-        const inbox = this.db.getFolders(accountId).find(f => f.specialUse === "inbox");
-        if (!inbox) return;
-        await this.quickCheck<string>(
-            accountId,
-            async () => {
-                const token = await config.tokenProvider!();
-                const res = await globalThis.fetch(
-                    `https://gmail.googleapis.com/gmail/v1/users/me/messages?q=in:inbox&maxResults=1`,
-                    { headers: { "Authorization": `Bearer ${token}` } }
-                );
-                if (!res.ok) return null;
-                const data = await res.json();
-                return data.messages?.[0]?.id || null;
-            },
-            async (_topId, prev) => {
-                if (prev !== undefined) console.log(`  [check] ${accountId} INBOX: new message detected`);
-                const api = this.getGmailProvider(accountId);
-                await this.syncFolderViaApi(accountId, inbox, api);
-                this.db.recalcFolderCounts(inbox.id);
-                this.emit("folderCountsChanged", accountId, {});
-                await api.close();
-            },
-        );
-    }
-
-    /** Check all accounts (used by legacy callers) */
-    async quickInboxCheck(): Promise<void> {
-        for (const [accountId] of this.configs) {
-            await this.quickInboxCheckAccount(accountId);
-        }
-    }
-
-    /** Start periodic sync */
-    startPeriodicSync(intervalMinutes: number): void {
-        this.stopPeriodicSync();
-
-        // Per-account quick inbox check — adapts to server constraints.
-        // Accounts with IDLE running get a long interval (5 min) because IDLE
-        // already pushes instant notifications — the STATUS poll is just a
-        // safety net. Non-IDLE accounts (rare) use a shorter interval.
-        //
-        // CRITICAL: the previous value (2500ms for everyone) was hammering
-        // Dovecot with 24 logins per minute. That's what tripped the server
-        // operator's fail2ban on mail1, and was still flooding the desktop
-        // connection. Each STATUS poll creates a disposable connection
-        // (TLS + auth + STATUS + close), not a lightweight keep-alive.
-        for (const [accountId] of this.configs) {
-            // Gmail uses API sync, not IMAP STATUS. IMAP accounts use IDLE
-            // which gives instant push — the STATUS poll is just a fallback
-            // in case IDLE silently dropped.
-            const isGmail = this.isGmailAccount(accountId);
-            // IMAP accounts: IDLE gives instant push; STATUS poll is just a
-            // safety net for silent IDLE drops — keep it infrequent.
-            // Gmail accounts: no IDLE (Gmail API doesn't expose it), so the
-            // quick poll IS the primary path to new-mail latency. Drop to 30s
-            // so Gmail mail appears in ~15s average. Gmail quota budget is
-            // huge (250 units/sec per user, 1.2B/day) — 120 polls/hour × 5
-            // units ≈ 600/hour, trivial. Dovecot accounts stay at 5min to
-            // respect connection limits (each poll = fresh connection).
-            const interval = isGmail ? 30000 : 300000; // Gmail: 30s; IMAP: 5min
-            const timer = setInterval(() => {
-                this.quickInboxCheckAccount(accountId).catch(() => {});
-            }, interval);
-            this.syncIntervals.set(`quick:${accountId}`, timer);
-            console.log(`  [periodic] ${accountId}: STATUS check every ${interval / 1000}s (${isGmail ? "API" : "IMAP+IDLE"})`);
-        }
-
-        // Sync actions (sends + flags/deletes/moves) every 30 seconds — skip during active sync
-        const actionsInterval = setInterval(async () => {
-            if (this.syncing) return;
-            for (const [accountId] of this.configs) {
-                this.processSendActions(accountId).catch(() => {});
-                this.processSyncActions(accountId).catch(() => {});
-            }
-        }, 30000);
-        this.syncIntervals.set("actions", actionsInterval);
-
-        // Body prefetch as a first-class background task — independent of
-        // sync success. Prefetch was previously only triggered from inside
-        // sync, so any account with slow/failing IMAP had its "not downloaded"
-        // dots stuck forever even though body fetches use a separate
-        // connection that might succeed. Every 60s, for every account, fire
-        // prefetchBodies() (cheap when body_path is already populated — just a
-        // DB query that returns 0 rows; the prefetchingAccounts guard
-        // short-circuits concurrent triggers).
-        if (getPrefetch()) {
-            const kickPrefetch = (): void => {
-                for (const [accountId] of this.configs) {
-                    this.prefetchBodies(accountId).catch(e =>
-                        console.error(`  [prefetch] ${accountId}: ${e?.message || e}`)
-                    );
-                }
-            };
-            // Fire once now so the "not downloaded" dots start filling in
-            // immediately on app start, don't make the user wait a minute.
-            setTimeout(kickPrefetch, 2000);
-            const prefetchInterval = setInterval(kickPrefetch, 60000);
-            this.syncIntervals.set("prefetch", prefetchInterval);
-            console.log(`  [periodic] body prefetch every 60s (independent of sync)`);
-        }
-
-        // Tombstone prune: age out local-delete records older than 30 days.
-        // Runs hourly — cheap (one indexed DELETE).
-        const TOMBSTONE_RETENTION_DAYS = 30;
-        const pruneTombstones = (): void => {
-            const cutoff = Date.now() - TOMBSTONE_RETENTION_DAYS * 86400_000;
-            const n = this.db.pruneTombstones(cutoff);
-            if (n > 0) console.log(`  [tombstones] pruned ${n} older than ${TOMBSTONE_RETENTION_DAYS} days`);
-        };
-        setTimeout(pruneTombstones, 30_000);  // first run after startup settles
-        this.syncIntervals.set("tombstone-prune", setInterval(pruneTombstones, 3600_000));
-
-        // Full sync (all folders + IDLE restart) at configured interval
-        const fullInterval = setInterval(async () => {
-            console.log(`  [periodic] Full sync at ${new Date().toLocaleTimeString()}`);
-            await this.syncAll();
-            await this.stopWatching();
-            await this.startWatching();
-        }, intervalMinutes * 60000);
-        this.syncIntervals.set("all", fullInterval);
-    }
-
-    /** Stop periodic sync */
-    stopPeriodicSync(): void {
-        for (const [key, interval] of this.syncIntervals) {
-            clearInterval(interval);
-        }
-        this.syncIntervals.clear();
-    }
-
-    /** Check if an account is OAuth (Gmail/Outlook — generous connection limits) */
-    isOAuthAccount(accountId: string): boolean {
-        const config = this.configs.get(accountId);
-        return !!config?.tokenProvider;
-    }
-
-    /** Start IMAP IDLE watchers for INBOX on each account */
-    async startWatching(): Promise<void> {
-        for (const [accountId] of this.configs) {
-            if (this.watchers.has(accountId)) continue;
-            try {
-                // IDLE keeps its own dedicated socket — once the connection
-                // is parked in IDLE, it's unusable for any other command, so
-                // it can't share the ops queue. Counts against the per-host
-                // semaphore (one slot for the IDLE socket).
-                const watchClient = await this.createClient(accountId, "idle");
-                const stop = await watchClient.watchMailbox("INBOX", (newCount: number) => {
-                    console.log(`  [idle] ${accountId}: ${newCount} new message(s)`);
-                    // Fetch only the new UIDs — the heavyweight gap/reconcile
-                    // path runs on the 5-minute STATUS poll, so EXISTS lands
-                    // in the UI in roughly one round-trip.
-                    this.syncInboxNewOnly(accountId).catch(e => console.error(`  [idle] sync error: ${e.message}`));
-                });
-                this.watchers.set(accountId, async () => {
-                    await stop();
-                    await watchClient.logout();
-                });
-                console.log(`  [idle] Watching INBOX for ${accountId}`);
-            } catch (e: any) {
-                console.error(`  [idle] Failed to watch ${accountId}: ${e.message}`);
-            }
-        }
-    }
-
-    /** Stop all IDLE watchers */
-    async stopWatching(): Promise<void> {
-        for (const [id, stop] of this.watchers) {
-            try { await stop(); } catch { /* ignore */ }
-        }
-        this.watchers.clear();
-    }
-
-    /** Unlink the on-disk body file for a message by reading its `body_path`
-     *  from the DB. Safe to call either before or after `db.deleteMessage`
-     *  — read body_path first, store it, then unlink whenever. */
-    private async unlinkBodyFile(accountId: string, uid: number, folderId?: number): Promise<void> {
-        try {
-            const row: any = this.db.getMessageByUid(accountId, uid, folderId);
-            const p = row?.bodyPath;
-            if (p) await this.bodyStore.unlinkByPath(p);
-        } catch { /* row already gone / file already gone — both fine */ }
-    }
-
-    /** Fetch a single message body on demand, caching in the store.
-     *
-     *  Cache lookup is folder-agnostic: when a UID exists in multiple folders
-     *  (Gmail labels, copy-instead-of-move) the prefetcher may have populated
-     *  body_path on only one row. Looking up by (account, uid) without the
-     *  folder filter finds the cached `.eml` regardless of which folder
-     *  context the UI passed.
-     *
-     *  Server fetch goes through the unified ops queue on the fast lane —
-     *  the user clicked, they're waiting, this jumps ahead of any background
-     *  prefetch sitting in the slow lane. */
-    async fetchMessageBody(accountId: string, folderId: number, uid: number): Promise<Buffer | null> {
-        const envelope: any = this.db.getMessageByUid(accountId, uid, folderId);
-        let storedPath = envelope?.bodyPath || "";
-        if (!storedPath) storedPath = this.db.getMessageBodyPath(accountId, uid) || "";
-        if (storedPath && await this.bodyStore.hasByPath(storedPath)) {
-            return this.bodyStore.readByPath(storedPath);
-        }
-
-        if (!this.configs.has(accountId)) return null;
-
-        const folder = this.db.getFolders(accountId).find(f => f.id === folderId);
-        if (!folder) return null;
-
-        // Gmail: REST API, no IMAP connection involved.
-        if (this.isGmailAccount(accountId)) {
-            return this.fetchMessageBodyViaApi(accountId, folderId, uid, folder.path);
-        }
-
-        // IMAP: fast lane on the ops queue. One try; if the socket is stale,
-        // withConnection's discard-on-error logic drops the client so the
-        // next attempt (caller-driven retry) gets a fresh one.
-        try {
-            const raw = await this.withConnection(accountId, async (client) => {
-                const msg: any = await client.fetchMessageByUid(folder.path, uid, { source: true });
-                if (!msg) throw makeNotFoundError(accountId, folderId, uid);
-                if (!msg.source) return null;
-                return Buffer.from(msg.source, "utf-8");
-            });
-            if (!raw) return null;
-            const bodyPath = await this.bodyStore.putMessage(accountId, folderId, uid, raw);
-            this.db.updateBodyPath(accountId, uid, bodyPath);
-            this.emit("bodyCached", accountId, uid);
-            return raw;
-        } catch (e: any) {
-            if (e?.isNotFound) throw e;
-            console.error(`  Body fetch error (${accountId}/${uid}): ${e?.message || e}`);
-            return null;
-        }
-    }
-
-    /** Fetch message body via Gmail/Outlook API.
-     *  Throws `MessageNotFoundError` when the server says the message is gone
-     *  (deleted from another device, for example). The caller uses that to
-     *  delete the stale row locally instead of showing a generic error. */
-    private async fetchMessageBodyViaApi(accountId: string, folderId: number, uid: number, folderPath: string): Promise<Buffer | null> {
-        try {
-            const api = this.getGmailProvider(accountId);
-            // Read provider_id from the local row so fetchOne can skip the
-            // listMessageIds pagination (the dominant Gmail rate-limit cost).
-            const env = this.db.getMessageByUid(accountId, uid, folderId);
-            const providerId = env?.providerId;
-            const msg = await api.fetchOne(folderPath, uid, { source: true, providerId });
-            await api.close();
-            if (!msg) {
-                // fetchOne returned null — message doesn't exist on the server anymore
-                throw makeNotFoundError(accountId, folderId, uid);
-            }
-            if (!msg.source) {
-                // Gmail returned a message object but no raw bytes. Seen when:
-                //  (a) the message exists but is larger than the format=raw cap (~10MB),
-                //  (b) UID→Gmail-ID resolution picked a collision and the target
-                //      exists only as a stub, or (c) the listMessageIds top-1000
-                //      didn't include our UID and fetchOne returned null above —
-                //      wait, that would hit the !msg branch. So (a)/(b) remain.
-                // Log enough to distinguish; surface the reason up via a non-null
-                // return so the UI stops showing a generic "fetch returned nothing".
-                console.error(`  [api] Body fetch empty source (${accountId}/${uid}): Gmail returned no raw body — likely too-large-for-format-raw or UID hash collision`);
-                return null;
-            }
-            const raw = Buffer.from(msg.source, "utf-8");
-            const bodyPath = await this.bodyStore.putMessage(accountId, folderId, uid, raw);
-            this.db.updateBodyPath(accountId, uid, bodyPath);
-            this.emit("bodyCached", accountId, uid);
-            return raw;
-        } catch (e: any) {
-            // Gmail API 404 → the message was deleted on the server
-            if ((e as any)?.isNotFound || /Gmail API 404|404|not found/i.test(e?.message || "")) {
-                throw makeNotFoundError(accountId, folderId, uid);
-            }
-            console.error(`  [api] Body fetch error (${accountId}/${uid}): ${e.message}`);
-            return null;
-        }
-    }
-
-    /** Background body prefetch — download bodies for messages that don't have them.
-     *  Server-side deletions (isNotFound) aren't errors here: we delete the
-     *  stale row locally and keep going. Only unrelated errors (network,
-     *  auth, rate limits) count against the error budget, and the budget is
-     *  generous so a few transient failures don't kill the whole run. */
-    /** Guard against concurrent prefetchBodies for the same account — mirror of
-     *  `sendingAccounts`. Without this, every periodic-sync tick spawns a new
-     *  prefetch session alongside any still in flight, blowing through Gmail's
-     *  per-minute quota and racing on disk writes. One prefetch per account. */
-    private prefetchingAccounts = new Set<string>();
-
-    /** Per-folder error cooldowns — `accountId:folderPath` → [timestamps].
-     *  Used to skip folders that repeatedly time out (Dovecot on slow shared
-     *  hosting SELECTs big `_Spam` / archive folders at 300s+ latency; the
-     *  prefetch error budget was burning out on a handful of bad folders
-     *  before the INBOX could finish). A folder with 2+ errors in the last
-     *  15 minutes is skipped until the cooldown passes. User-reported via
-     *  log analysis 2026-04-23: bobma prefetch timing out on Added2.organizations,
-     *  Added2.technews, _Spam, "Prefirst.Jerry's Retreat", Added2.zines. */
-    private folderErrorCooldown = new Map<string, number[]>();
-    private readonly FOLDER_ERROR_WINDOW_MS = 15 * 60_000;
-    private readonly FOLDER_ERROR_THRESHOLD = 2;
-
-    private shouldSkipFolder(accountId: string, folderPath: string): boolean {
-        const key = `${accountId}:${folderPath}`;
-        const now = Date.now();
-        const errors = (this.folderErrorCooldown.get(key) || [])
-            .filter(t => now - t < this.FOLDER_ERROR_WINDOW_MS);
-        this.folderErrorCooldown.set(key, errors);
-        return errors.length >= this.FOLDER_ERROR_THRESHOLD;
-    }
-    private recordFolderError(accountId: string, folderPath: string): void {
-        const key = `${accountId}:${folderPath}`;
-        const arr = this.folderErrorCooldown.get(key) || [];
-        arr.push(Date.now());
-        this.folderErrorCooldown.set(key, arr);
-    }
-    private clearFolderErrors(accountId: string, folderPath: string): void {
-        this.folderErrorCooldown.delete(`${accountId}:${folderPath}`);
-    }
-
-    private async prefetchBodies(accountId: string): Promise<void> {
-        if (this.prefetchingAccounts.has(accountId)) return;
-        this.prefetchingAccounts.add(accountId);
-        try { await this._prefetchBodies(accountId); }
-        finally { this.prefetchingAccounts.delete(accountId); }
-    }
-
-    private async _prefetchBodies(accountId: string): Promise<void> {
-        const counters = { totalFetched: 0, deleted: 0, errors: 0 };
-        const ERROR_BUDGET = 20;
-        const RATE_LIMIT_PAUSE_MS = 30000;
-        const BATCH_SIZE = 100;
-        const isGmail = this.isGmailAccount(accountId);
-        // Gmail still uses per-message fetch (HTTP /batch is a separate TODO in this file's
-        // governing unit). IMAP uses the batched `fetchBodiesBatch` path via iflow-direct —
-        // one SELECT + one UID FETCH per folder per tick instead of N round trips.
-        let announced = false;
-        while (true) {
-            const missing = this.db.getMessagesWithoutBody(accountId, BATCH_SIZE);
-            if (missing.length === 0) break;
-            if (!announced) {
-                console.log(`  [prefetch] ${accountId}: ${missing.length}+ bodies to fetch`);
-                announced = true;
-            }
-            let madeProgress = false;
-
-            if (isGmail) {
-                // Gmail batch path: group by label (what mailx calls "folder"),
-                // list once per label, bounded-concurrency fetch. Far fewer
-                // HTTP round trips than the old one-listMessageIds-per-body path.
-                // Note on the model: Gmail has labels, not folders. A message in
-                // multiple labels gets fetched twice under current grouping. A
-                // deeper label-native redesign is tracked as a separate TODO.
-                const byFolder = new Map<number, number[]>();
-                for (const m of missing) {
-                    let arr = byFolder.get(m.folderId);
-                    if (!arr) { arr = []; byFolder.set(m.folderId, arr); }
-                    arr.push(m.uid);
-                }
-                const folders = this.db.getFolders(accountId);
-                const api = this.getGmailProvider(accountId);
-                try {
-                    for (const [folderId, uidsInFolder] of byFolder) {
-                        const folder = folders.find(f => f.id === folderId);
-                        if (!folder) continue;
-                        const received = new Set<number>();
-                        const pending: Promise<void>[] = [];
-                        let batchSucceeded = false;
-                        try {
-                            await (api as any).fetchBodiesBatch(folder.path, uidsInFolder, (uid: number, source: string) => {
-                                received.add(uid);
-                                pending.push((async () => {
-                                    try {
-                                        const raw = Buffer.from(source, "utf-8");
-                                        const bodyPath = await this.bodyStore.putMessage(accountId, folderId, uid, raw);
-                                        this.db.updateBodyPath(accountId, uid, bodyPath);
-                                        this.emit("bodyCached", accountId, uid);
-                                        counters.totalFetched++;
-                                        madeProgress = true;
-                                    } catch (e: any) {
-                                        console.error(`  [prefetch] ${accountId}/${uid}: store write failed: ${e.message}`);
-                                    }
-                                })());
-                            });
-                            batchSucceeded = true;
-                        } catch (e: any) {
-                            const isRate = /429|rate|too many/i.test(String(e?.message || ""));
-                            if (isRate) {
-                                console.log(`  [prefetch] ${accountId}: rate-limited — pausing ${RATE_LIMIT_PAUSE_MS / 1000}s`);
-                                await new Promise(r => setTimeout(r, RATE_LIMIT_PAUSE_MS));
-                            } else {
-                                console.error(`  [prefetch] ${accountId} folder ${folder.path}: Gmail batch fetch failed: ${e.message}`);
-                                counters.errors++;
-                            }
-                        }
-                        await Promise.all(pending);
-                        // CRITICAL: only prune as "server-deleted" when the batch
-                        // actually completed. If the batch threw (403, 429, network
-                        // error, etc.) NOTHING was received, and treating every
-                        // requested UID as deleted silently wipes 100 messages per
-                        // batch. That's a data-loss bug. Earlier version did this
-                        // and pruned 296 messages on a 403 auth error.
-                        if (batchSucceeded) {
-                            for (const uid of uidsInFolder) {
-                                if (received.has(uid)) continue;
-                                try {
-                                    this.unlinkBodyFile(accountId, uid, folderId).catch(() => {});
-                                    this.db.deleteMessage(accountId, uid);
-                                    counters.deleted++;
-                                    madeProgress = true;
-                                } catch { /* ignore */ }
-                            }
-                        }
-                        if (counters.errors >= ERROR_BUDGET) break;
-                    }
-                } finally {
-                    try { await api.close(); } catch { /* ignore */ }
-                }
-                if (counters.errors >= ERROR_BUDGET) {
-                    console.error(`  [prefetch] ${accountId}: stopping after ${counters.errors} errors (${counters.totalFetched} cached, ${counters.deleted} pruned)`);
-                    return;
-                }
-            } else {
-                // IMAP batch path: one UID FETCH per folder, each on its own
-                // turn through the slow lane. Yielding between folders is
-                // crucial — a click-to-view body should jump ahead of the
-                // next folder's batch via the fast lane, not wait for all
-                // folders to finish.
-                const byFolder = new Map<number, number[]>();
-                for (const m of missing) {
-                    let arr = byFolder.get(m.folderId);
-                    if (!arr) { arr = []; byFolder.set(m.folderId, arr); }
-                    arr.push(m.uid);
-                }
-                const folders = this.db.getFolders(accountId);
-                // INBOX-first ordering so the folder the user actually looks at
-                // gets its bodies even if a later folder eats the error budget.
-                const orderedFolders = Array.from(byFolder.entries()).sort(([aid], [bid]) => {
-                    const af = folders.find(f => f.id === aid);
-                    const bf = folders.find(f => f.id === bid);
-                    const ai = af?.specialUse === "inbox" ? 0 : 1;
-                    const bi = bf?.specialUse === "inbox" ? 0 : 1;
-                    return ai - bi;
-                });
-                for (const [folderId, uids] of orderedFolders) {
-                    const folder = folders.find(f => f.id === folderId);
-                    if (!folder) continue;
-                    if (this.shouldSkipFolder(accountId, folder.path)) {
-                        console.log(`  [prefetch] ${accountId}: skipping ${folder.path} (recent timeouts — cooling down)`);
-                        continue;
-                    }
-                    const received = new Set<number>();
-                    let batchSucceeded = false;
-                    try {
-                        // Slow lane: prefetch is the textbook "this might take
-                        // a while" case — let interactive ops slip ahead.
-                        await this.withConnection(accountId, async (client) => {
-                            const pending: Promise<void>[] = [];
-                            await client.fetchBodiesBatch(folder.path, uids, (uid: number, source: string) => {
-                                received.add(uid);
-                                pending.push((async () => {
-                                    try {
-                                        const raw = Buffer.from(source, "utf-8");
-                                        const bodyPath = await this.bodyStore.putMessage(accountId, folderId, uid, raw);
-                                        this.db.updateBodyPath(accountId, uid, bodyPath);
-                                        this.emit("bodyCached", accountId, uid);
-                                        counters.totalFetched++;
-                                        madeProgress = true;
-                                    } catch (e: any) {
-                                        console.error(`  [prefetch] ${accountId}/${uid}: store write failed: ${e.message}`);
-                                    }
-                                })());
-                            });
-                            await Promise.all(pending);
-                        }, { slow: true });
-                        batchSucceeded = true;
-                        this.clearFolderErrors(accountId, folder.path);
-                    } catch (e: any) {
-                        const msg = String(e?.message || "");
-                        console.error(`  [prefetch] ${accountId} folder ${folder.path}: batch fetch failed: ${msg}`);
-                        counters.errors++;
-                        this.recordFolderError(accountId, folder.path);
-                        if (counters.errors >= ERROR_BUDGET) break;
-                    }
-                    // CRITICAL: only prune when the batch actually completed.
-                    // A thrown batch means NOTHING was received; treating
-                    // absence as server-deletion lost 296 messages once.
-                    if (batchSucceeded) for (const uid of uids) {
-                        if (received.has(uid)) continue;
-                        try {
-                            this.unlinkBodyFile(accountId, uid, folderId).catch(() => {});
-                            this.db.deleteMessage(accountId, uid);
-                            counters.deleted++;
-                            madeProgress = true;
-                        } catch { /* ignore */ }
-                    }
-                }
-                if (counters.errors >= ERROR_BUDGET) {
-                    console.error(`  [prefetch] ${accountId}: stopping after ${counters.errors} errors (${counters.totalFetched} cached, ${counters.deleted} pruned)`);
-                    return;
-                }
-            }
-
-            // Safety: zero progress this tick → bail rather than loop forever.
-            if (!madeProgress) break;
-            // Emit so the UI refreshes the open-circle → filled-teal indicator
-            // without waiting for the next sync cycle.
-            this.emit("folderCountsChanged", accountId, {});
-        }
-        if (counters.totalFetched > 0 || counters.deleted > 0) {
-            console.log(`  [prefetch] ${accountId}: ${counters.totalFetched} bodies cached, ${counters.deleted} stale rows pruned (done)`);
-            this.emit("folderCountsChanged", accountId, {});
-        }
-    }
-
-    /** Get the body store for direct access */
-    getBodyStore(): FileMessageStore {
-        return this.bodyStore;
-    }
-
-    /** Bulk trash messages — local-first, single IMAP connection for all */
-    async trashMessages(accountId: string, messages: { uid: number; folderId: number }[]): Promise<void> {
-        if (messages.length === 0) return;
-        const trash = this.findFolder(accountId, "trash");
-
-        // Local first — remove all from DB immediately
-        for (const msg of messages) {
-            this.unlinkBodyFile(accountId, msg.uid, msg.folderId).catch(() => {});
-            this.db.deleteMessage(accountId, msg.uid);
-        }
-        console.log(`  Deleted ${messages.length} messages locally`);
-
-        // Queue IMAP actions
-        for (const msg of messages) {
-            if (trash && trash.id !== msg.folderId) {
-                this.db.queueSyncAction(accountId, "move", msg.uid, msg.folderId, { targetFolderId: trash.id });
-            } else {
-                this.db.queueSyncAction(accountId, "delete", msg.uid, msg.folderId);
-            }
-        }
-
-        // Recalc folder counts so the tree badge updates immediately instead
-        // of showing stale numbers until the next full sync.
-        const sourceFolderIds = new Set(messages.map(m => m.folderId));
-        for (const fid of sourceFolderIds) this.db.recalcFolderCounts(fid);
-        if (trash) this.db.recalcFolderCounts(trash.id);
-        this.emit("folderCountsChanged", accountId, {});
-
-        // Process all queued actions in one IMAP session
-        this.debounceSyncActions(accountId);
-    }
-
-    /** Bulk move messages — queues the IMAP action only. The service layer
-     *  (MailxService.moveMessages) owns the local DB mutation via
-     *  updateMessageFolder; this method used to ALSO deleteMessage here,
-     *  which wiped the row the service just updated — the message vanished
-     *  on the next reconcile and "spam folder empty" was the symptom. */
-    async moveMessages(accountId: string, messages: { uid: number; folderId: number }[], targetFolderId: number): Promise<void> {
-        if (messages.length === 0) return;
-        for (const msg of messages) {
-            this.db.queueSyncAction(accountId, "move", msg.uid, msg.folderId, { targetFolderId });
-        }
-        console.log(`  [move] ${accountId}: queued IMAP MOVE for ${messages.length} message(s) → folder ${targetFolderId}`);
-        this.debounceSyncActions(accountId);
-    }
-
-    /** Debounced sync actions — batches rapid local changes into one IMAP operation */
-    private syncActionTimers = new Map<string, ReturnType<typeof setTimeout>>();
-
-    private debounceSyncActions(accountId: string): void {
-        const existing = this.syncActionTimers.get(accountId);
-        if (existing) clearTimeout(existing);
-        this.syncActionTimers.set(accountId, setTimeout(() => {
-            this.syncActionTimers.delete(accountId);
-            this.processSyncActions(accountId).catch(() => {});
-        }, 1000));
-    }
-
-    /** Move a message to Trash (delete) — local-first, queues IMAP sync */
-    async trashMessage(accountId: string, folderId: number, uid: number): Promise<void> {
-        const trash = this.findFolder(accountId, "trash");
-
-        // Local first — remove from DB immediately
-        this.unlinkBodyFile(accountId, uid, folderId).catch(() => {});
-        this.db.deleteMessage(accountId, uid);
-
-        // Queue IMAP action + log the resolution so "I deleted a message and
-        // now it's in neither trash nor deleted" is diagnosable from the log.
-        if (trash && trash.id !== folderId) {
-            const trashFolder = this.db.getFolders(accountId).find(f => f.id === trash.id);
-            this.db.queueSyncAction(accountId, "move", uid, folderId, { targetFolderId: trash.id });
-            console.log(`  [trash] ${accountId} UID ${uid}: queued MOVE to "${trashFolder?.path || trash.path}" (id=${trash.id}, specialUse=trash)`);
-        } else {
-            this.db.queueSyncAction(accountId, "delete", uid, folderId);
-            console.log(`  [trash] ${accountId} UID ${uid}: queued EXPUNGE in folder ${folderId} (already in trash or no trash configured)`);
-        }
-
-        // Debounced sync — batches multiple deletes into one IMAP session
-        this.debounceSyncActions(accountId);
-    }
-
-    /** Move a message between folders — queues IMAP sync only. Service
-     *  layer owns the local DB update (see MailxService.moveMessage). */
-    async moveMessage(accountId: string, uid: number, fromFolderId: number, toFolderId: number): Promise<void> {
-        this.db.queueSyncAction(accountId, "move", uid, fromFolderId, { targetFolderId: toFolderId });
-        console.log(`  [move] ${accountId}: queued IMAP MOVE UID ${uid} folder ${fromFolderId} → ${toFolderId}`);
-        this.debounceSyncActions(accountId);
-    }
-
-    /** Move message across accounts using iflow's moveMessageToServer */
-    async moveMessageCrossAccount(
-        fromAccountId: string, uid: number, fromFolderId: number,
-        toAccountId: string, toFolderId: number
-    ): Promise<void> {
-        const fromFolders = this.db.getFolders(fromAccountId);
-        const fromFolder = fromFolders.find(f => f.id === fromFolderId);
-        if (!fromFolder) throw new Error(`Source folder ${fromFolderId} not found`);
-
-        const toFolders = this.db.getFolders(toAccountId);
-        const toFolder = toFolders.find(f => f.id === toFolderId);
-        if (!toFolder) throw new Error(`Target folder ${toFolderId} not found`);
-
-        // Two accounts, two ops connections. Cross-account move is rare
-        // and requires both sockets to be live concurrently (we APPEND to
-        // target while still authenticated to source), so this can't fold
-        // into a single withConnection call.
-        await this.withConnection(fromAccountId, async (sourceClient) => {
-            await this.withConnection(toAccountId, async (targetClient) => {
-                const msg = await sourceClient.fetchMessageByUid(fromFolder.path, uid, { source: true });
-                if (!msg) throw new Error(`Message UID ${uid} not found in ${fromFolder.path}`);
-                await sourceClient.moveMessageToServer(msg, fromFolder.path, targetClient, toFolder.path);
-                this.db.deleteMessage(fromAccountId, uid);
-                console.log(`  Cross-account move: ${fromAccountId}/${fromFolder.path} UID ${uid} → ${toAccountId}/${toFolder.path}`);
-            });
-        });
-    }
-
-    /** Undelete — move from Trash back to original folder */
-    async undeleteMessage(accountId: string, uid: number, originalFolderId: number): Promise<void> {
-        const trash = this.findFolder(accountId, "trash");
-        if (!trash) throw new Error("No Trash folder found");
-        await this.moveMessage(accountId, uid, trash.id, originalFolderId);
-    }
-
-    /** Update flags — local-first, queues IMAP sync */
-    async updateFlagsLocal(accountId: string, uid: number, folderId: number, flags: string[]): Promise<void> {
-        this.db.updateMessageFlags(accountId, uid, flags);
-        this.db.queueSyncAction(accountId, "flags", uid, folderId, { flags });
-        // User-visible pink-dot pending state stays until the action drains.
-        // The 30-second periodic tick was too slow — opening one message to
-        // auto-mark-as-read left it pink for half a minute. Same 1-second
-        // debounce as moves/deletes batches rapid flag churn without the
-        // visual lag.
-        this.debounceSyncActions(accountId);
-    }
-
-    /** Process pending sync actions for an account */
-    async processSyncActions(accountId: string): Promise<void> {
-        const actions = this.db.getPendingSyncActions(accountId);
-        if (actions.length === 0) return;
-        const startCount = actions.length;
-
-        const folders = this.db.getFolders(accountId);
-
-        // Gmail path: push flag/label changes through the REST provider so
-        // they actually reach the server. Earlier this method always went
-        // through withConnection → IMAP, which silently no-op'd for Gmail
-        // accounts (REST-only, no IMAP connection) and left local-only stars
-        // that vanished on the next full sync.
-        if (this.isGmailAccount(accountId)) {
-            const api = this.getGmailProvider(accountId) as any;
-            try {
-                for (const action of actions) {
-                    const folder = folders.find(f => f.id === action.folderId);
-                    if (!folder) { this.db.completeSyncAction(action.id); continue; }
-                    try {
-                        if (action.action === "flags" && api.setFlags) {
-                            await api.setFlags(folder.path, action.uid, action.flags || []);
-                            console.log(`  [api] ${accountId}: flags synced UID ${action.uid}`);
-                        } else if ((action.action === "delete" || action.action === "trash") && api.trashMessage) {
-                            await api.trashMessage(folder.path, action.uid);
-                            console.log(`  [api] ${accountId}: trashed UID ${action.uid} from ${folder.path}`);
-                        } else if (action.action === "move" && api.moveMessage) {
-                            const target = folders.find(f => f.id === action.targetFolderId);
-                            if (!target) {
-                                // Unreachable target — drop the action rather than loop.
-                                console.error(`  [api] ${accountId}: move target folder ${action.targetFolderId} missing — dropping UID ${action.uid}`);
-                                this.db.completeSyncAction(action.id);
-                                continue;
-                            }
-                            await api.moveMessage(folder.path, action.uid, target.path);
-                            console.log(`  [api] ${accountId}: moved UID ${action.uid} ${folder.path} → ${target.path}`);
-                        } else {
-                            // Unsupported action on Gmail. After 5 retries, drop it
-                            // so stale rows don't mark messages pending-reconcile
-                            // forever. Previously "continue" here caused the pink
-                            // rows that shouldn't have been pink.
-                            if (action.attempts >= 5) {
-                                console.warn(`  [api] ${accountId}: dropping stale action "${action.action}" UID ${action.uid} after ${action.attempts} attempts (unsupported on Gmail API path)`);
-                                this.db.completeSyncAction(action.id);
-                            } else {
-                                this.db.failSyncAction(action.id, `unsupported Gmail action: ${action.action}`);
-                            }
-                            continue;
-                        }
-                        this.db.completeSyncAction(action.id);
-                    } catch (e: any) {
-                        console.error(`  [api] ${accountId}: flag sync failed UID ${action.uid}: ${e.message}`);
-                        this.db.failSyncAction(action.id, e.message);
-                        if (action.attempts >= 5) this.db.completeSyncAction(action.id);
-                    }
-                }
-            } finally { try { await api.close(); } catch { /* */ } }
-            // Nudge the UI so rows that were pending-reconcile re-query their
-            // pending state (pink dot was sticky until this event fired).
-            const remaining = this.db.getPendingSyncActions(accountId).length;
-            if (remaining < startCount) this.emit("folderCountsChanged", accountId, {});
-            return;
-        }
-
-        await this.withConnection(accountId, async (client) => {
-            for (const action of actions) {
-                const folder = folders.find(f => f.id === action.folderId);
-                if (!folder) {
-                    this.db.completeSyncAction(action.id);
-                    continue;
-                }
-
-                try {
-                    switch (action.action) {
-                        case "delete":
-                            await client.deleteMessageByUid(folder.path, action.uid);
-                            console.log(`  [sync] Deleted UID ${action.uid} from ${folder.path}`);
-                            break;
-
-                        case "move": {
-                            const target = folders.find(f => f.id === action.targetFolderId);
-                            if (!target) {
-                                // Target folder gone — treat as permanent failure so the
-                                // action doesn't loop forever. User must re-delete manually.
-                                console.error(`  [sync] Move target folder ${action.targetFolderId} missing — dropping action UID ${action.uid}`);
-                                throw new Error(`move target folder ${action.targetFolderId} not found`);
-                            }
-                            const msg = await client.fetchMessageByUid(folder.path, action.uid, { source: false });
-                            if (!msg) {
-                                // Message no longer in source folder. Two real cases:
-                                //   (a) another client already moved/deleted it — nothing to do,
-                                //       just mark the action done.
-                                //   (b) the server is lying (transient SELECT miss) — the retry
-                                //       will pick it up. We can't tell these apart from one fetch,
-                                //       so log loud and treat as (a) after the first failure; the
-                                //       attempts counter handles (b) via the failSyncAction path.
-                                console.log(`  [sync] Move UID ${action.uid} in ${folder.path}: message gone (attempt ${action.attempts + 1}); dropping action`);
-                                break;
-                            }
-                            await client.moveMessage(msg, folder.path, target.path);
-                            console.log(`  [sync] Moved UID ${action.uid}: ${folder.path} → ${target.path}`);
-                            break;
-                        }
-
-                        case "flags":
-                            if (action.flags.length > 0) {
-                                await client.addFlags(folder.path, action.uid, action.flags.filter(f => !f.startsWith("-")));
-                                const toRemove = action.flags.filter(f => f.startsWith("-")).map(f => f.slice(1));
-                                if (toRemove.length > 0) {
-                                    await client.removeFlags(folder.path, action.uid, toRemove);
-                                }
-                                console.log(`  [sync] Updated flags UID ${action.uid}`);
-                            }
-                            break;
-
-                        case "append": {
-                            if (action.rawMessage) {
-                                await client.appendMessage(folder.path, action.rawMessage, action.flags);
-                                console.log(`  [sync] Appended to ${folder.path}`);
-                            }
-                            break;
-                        }
-                    }
-                    this.db.completeSyncAction(action.id);
-                } catch (e: any) {
-                    console.error(`  [sync] Failed action ${action.action} UID ${action.uid}: ${e.message}`);
-                    this.db.failSyncAction(action.id, e.message);
-                    this.emit("syncActionFailed", accountId, action.action, action.uid, e.message);
-                    if (action.attempts >= 5) {
-                        console.error(`  [sync] Giving up on action ${action.id} after 5 attempts`);
-                        this.db.completeSyncAction(action.id);
-                        this.emit("syncActionFailed", accountId, action.action, action.uid, `Gave up after 5 attempts: ${e.message}`);
-                    }
-                }
-            }
-        });
-        // IMAP path: same nudge as the Gmail branch above. Any action that
-        // drained (successful or gave-up-after-5) decrements the pending
-        // count, which flips the pink dot off on the next re-query.
-        const remaining = this.db.getPendingSyncActions(accountId).length;
-        if (remaining < startCount) this.emit("folderCountsChanged", accountId, {});
-    }
-
-    /** Find a folder by specialUse, case-insensitive */
-    private findFolder(accountId: string, specialUse: string): { id: number; path: string } | null {
-        const folders = this.db.getFolders(accountId);
-        return folders.find(f =>
-            f.specialUse === specialUse ||
-            f.path.toLowerCase() === specialUse.toLowerCase()
-        ) || null;
-    }
-
-    /** Optimistic local-first Sent insert: write a row into the local DB's
-     *  Sent folder the moment the user hits Send, so the list reflects it
-     *  immediately instead of waiting for SMTP + IMAP-APPEND + syncFolder
-     *  (five server round-trips against a Dovecot that caps at 20 conns).
-     *
-     *  Uses a synthetic negative UID so it can't collide with a real APPENDUID
-     *  (which is always positive). When the real sync eventually picks the
-     *  message up in Sent with the server's UID, `db.upsertMessage` spots
-     *  the Message-ID match and rebinds the existing row's UID — no duplicate.
-     *  Negative UID also makes the row render pink (getMessages flags uid<0
-     *  as pending) so the user sees it's not-yet-reconciled.
-     *
-     *  Best-effort — any failure path (no Sent folder yet, parse error, store
-     *  write error) is logged and swallowed; the send itself is unaffected. */
-    async insertOptimisticSentRow(
-        accountId: string,
-        envelope: {
-            messageId: string;
-            inReplyTo: string;
-            references: string[];
-            subject: string;
-            from: EmailAddress;
-            to: EmailAddress[];
-            cc: EmailAddress[];
-            bcc: EmailAddress[];
-            date: number;
-        },
-        rawMessage: string,
-    ): Promise<void> {
-        try {
-            const sent = this.findFolder(accountId, "sent");
-            if (!sent) {
-                console.log(`  [sent-local] no Sent folder for ${accountId}; skipping optimistic row`);
-                return;
-            }
-            // Synthetic UID — negative ms timestamp is monotonic + won't
-            // collide with server UIDs. When the real APPENDUID returns via
-            // sync, upsertMessage's Message-ID rebind swaps this for the
-            // real positive value.
-            const synthUid = -Date.now();
-            const bodyPath = await this.bodyStore.putMessage(
-                accountId, sent.id, synthUid, Buffer.from(rawMessage, "utf-8"),
-            );
-            const parsed = await extractPreview(rawMessage);
-            this.db.upsertMessage({
-                accountId,
-                folderId: sent.id,
-                uid: synthUid,
-                messageId: envelope.messageId,
-                inReplyTo: envelope.inReplyTo,
-                references: envelope.references,
-                date: envelope.date,
-                subject: envelope.subject,
-                from: envelope.from,
-                to: envelope.to,
-                cc: envelope.cc,
-                flags: ["\\Seen"],
-                size: rawMessage.length,
-                hasAttachments: parsed.hasAttachments,
-                preview: parsed.preview,
-                bodyPath,
-            });
-            // Folder-tree badge refresh + message-list reload if the user
-            // is currently on Sent — same event the sync path emits.
-            this.db.recalcFolderCounts(sent.id);
-            this.emit("folderCountsChanged", { accountId, folderId: sent.id });
-            console.log(`  [sent-local] wrote optimistic row in Sent (uid=${synthUid}) for ${accountId}: ${envelope.subject}`);
-        } catch (e: any) {
-            // Non-fatal — send continues, Sent folder just won't show the
-            // row until the real APPEND-then-sync cycle completes.
-            console.error(`  [sent-local] optimistic insert failed: ${e?.message || e}`);
-        }
-    }
-
-    /** Copy sent message to the Sent folder via IMAP APPEND */
-    async copyToSent(accountId: string, rawMessage: string | Buffer): Promise<void> {
-        const sent = this.findFolder(accountId, "sent");
-        if (!sent) {
-            console.error(`  [sent] No Sent folder found for ${accountId}`);
-            return;
-        }
-
-        await this.withConnection(accountId, async (client) => {
-            await client.appendMessage(sent.path, rawMessage, ["\\Seen"]);
-            console.log(`  [sent] Copied to ${sent.path}`);
-        });
-    }
-
-    /** Save a draft to the Drafts folder via IMAP APPEND.
-     *  Returns the UID of the saved draft (for replacing on next save). */
-    async saveDraft(accountId: string, rawMessage: string | Buffer, previousDraftUid?: number, draftId?: string): Promise<number | null> {
-        const drafts = this.findFolder(accountId, "drafts");
-        if (!drafts) {
-            console.error(`  [drafts] No Drafts folder found for ${accountId}`);
-            return null;
-        }
-
-        return this.withConnection(accountId, async (client) => {
-            // Delete previous draft — try UID first (fast path), and ALWAYS also try
-            // searchByHeader(X-Mailx-Draft-ID) as a safety net. Running both catches
-            // orphans from a crash-mid-save or a UID delete that failed silently.
-            if (previousDraftUid) {
-                try {
-                    await client.deleteMessageByUid(drafts.path, previousDraftUid);
-                } catch (e: any) {
-                    console.error(`  [drafts] Delete prev UID ${previousDraftUid} failed: ${e.message}`);
-                }
-            }
-            if (draftId) {
-                try {
-                    const uids = await client.searchByHeader(drafts.path, "X-Mailx-Draft-ID", draftId);
-                    for (const uid of uids) {
-                        try { await client.deleteMessageByUid(drafts.path, uid); } catch { /* next */ }
-                    }
-                    if (uids.length > 0) console.log(`  [drafts] Deleted ${uids.length} stale draft(s) by ID ${draftId}`);
-                } catch (e: any) {
-                    console.error(`  [drafts] searchByHeader for ${draftId} failed: ${e.message}`);
-                }
-            }
-
-            // Append new draft. If the server returns [TRYCREATE] (RFC 3501 §7.1),
-            // the folder doesn't exist on the server even though mailx's DB has
-            // it. Create it and retry once.
-            let result: any;
-            try {
-                result = await client.appendMessage(drafts.path, rawMessage, ["\\Draft", "\\Seen"]);
-            } catch (e: any) {
-                const msg = String(e?.message || e);
-                if (/TRYCREATE/i.test(msg)) {
-                    console.log(`  [drafts] APPEND got TRYCREATE for "${drafts.path}" — creating folder and retrying`);
-                    try { await client.createmailbox(drafts.path); }
-                    catch (ce: any) {
-                        if (!/already exists/i.test(String(ce?.message || ""))) {
-                            console.error(`  [drafts] Folder create failed for "${drafts.path}": ${ce.message}`);
-                        }
-                    }
-                    result = await client.appendMessage(drafts.path, rawMessage, ["\\Draft", "\\Seen"]);
-                } else {
-                    throw e;
-                }
-            }
-            const uid: number | null = typeof result === "number" ? result : (result as any)?.uid || null;
-            return uid;
-        });
-    }
-
-    /** Delete a draft (or all drafts with a stable X-Mailx-Draft-ID) after successful send.
-     *  Tries the specific UID first, then falls back to searchByHeader so orphaned copies
-     *  from earlier failed autosaves are cleaned up at the same time. */
-    async deleteDraft(accountId: string, draftUid: number, draftId?: string): Promise<void> {
-        const drafts = this.findFolder(accountId, "drafts");
-        if (!drafts) return;
-        if (!draftUid && !draftId) return;
-
-        await this.withConnection(accountId, async (client) => {
-            if (draftUid) {
-                try {
-                    await client.deleteMessageByUid(drafts.path, draftUid);
-                    console.log(`  [drafts] Deleted draft UID ${draftUid}`);
-                } catch (e: any) {
-                    console.error(`  [drafts] Delete by UID ${draftUid} failed: ${e.message}`);
-                }
-            }
-            if (draftId) {
-                try {
-                    const uids = await client.searchByHeader(drafts.path, "X-Mailx-Draft-ID", draftId);
-                    for (const uid of uids) {
-                        try { await client.deleteMessageByUid(drafts.path, uid); } catch { /* next */ }
-                    }
-                    if (uids.length > 0) console.log(`  [drafts] Deleted ${uids.length} draft(s) by ID ${draftId}`);
-                } catch (e: any) {
-                    console.error(`  [drafts] searchByHeader for ${draftId} failed: ${e.message}`);
-                }
-            }
-        });
-    }
-
-    /** Queue outgoing message locally — never fails, worker handles IMAP+SMTP.
-     *  Single path: write `~/.mailx/outbox/<acct>/*.ltr` synchronously, then
-     *  kick processLocalQueue. The file IS the queue — durable across crashes,
-     *  visible in the filesystem, consumed by the existing outbox worker that
-     *  handles both IMAP-APPEND (non-Gmail) and direct SMTP (Gmail). The old
-     *  sync_actions "send" branch was removed because it duplicated the same
-     *  work and risked double-send when both paths fired on the same message. */
-    queueOutgoingLocal(accountId: string, rawMessage: string): void {
-        // Loud logging so a "vanished message" report is diagnosable from the log alone.
-        // ALWAYS leave a backup copy in sending/<acct>/attempted/ first — unconditionally,
-        // before the outbox write. The outbox .ltr may be claimed/consumed by the worker
-        // within milliseconds; this copy survives regardless of SMTP success, IMAP
-        // append, worker crash, or any other downstream failure. User asked for this
-        // as a fallback because "there isn't even the backup copy in sent".
-        this.saveSendingCopy(accountId, rawMessage, "attempted");
-        const outboxDir = path.join(getConfigDir(), "outbox", accountId);
-        try {
-            fs.mkdirSync(outboxDir, { recursive: true });
-        } catch (e: any) {
-            console.error(`  [outbox] FAIL mkdirSync ${outboxDir}: ${e?.message || e}`);
-            throw new Error(`Cannot create outbox dir ${outboxDir}: ${e?.message || e}`);
-        }
-        const now = new Date();
-        const pad2 = (n: number) => String(n).padStart(2, "0");
-        const filename = `${now.getFullYear()}${pad2(now.getMonth() + 1)}${pad2(now.getDate())}_${pad2(now.getHours())}${pad2(now.getMinutes())}${pad2(now.getSeconds())}-${String(Math.floor(Math.random() * 10000)).padStart(4, "0")}.ltr`;
-        const filePath = path.join(outboxDir, filename);
-        try {
-            fs.writeFileSync(filePath, rawMessage);
-        } catch (e: any) {
-            console.error(`  [outbox] FAIL writeFileSync ${filePath}: ${e?.message || e}`);
-            throw new Error(`Cannot write outbox file ${filePath}: ${e?.message || e}`);
-        }
-        // Immediate readback verification — if this DOESN'T print, the user's
-        // "neither in outbox nor file system" report has a real explanation.
-        const written = fs.existsSync(filePath);
-        const size = written ? fs.statSync(filePath).size : 0;
-        console.log(`  [outbox] WROTE ${filePath} (${size} bytes, exists=${written})`);
-        this.emitOutboxStatus();
-        // CRITICAL: defer to next tick. processLocalQueue runs ~30+ lines
-        // of synchronous fs work BEFORE its first await — calling it inline
-        // blocks the IPC ack on all that work.
-        setImmediate(() => {
-            this.processLocalQueue(accountId)
-                .catch((e: any) => console.error(`  [outbox] processLocalQueue error: ${e?.message || e}`))
-                .finally(() => this.emitOutboxStatus());
-        });
-    }
-
-    /** Scan the local outbox + sending/queued dirs and return counts + age.
-     *  Cheap — a handful of readdir + head-read per file. Called by both the
-     *  polling UI (status bar) and emitted as an event after queue mutations. */
-    getOutboxStatus(): OutboxStatus {
-        const configDir = getConfigDir();
-        const perAccount: Record<string, { total: number; retrying: number; claimed: number }> = {};
-        let total = 0;
-        let retrying = 0;
-        let claimed = 0;
-        let oldestMs = 0;
-        let maxAttempts = 0;
-        const now = Date.now();
-        const scan = (accountId: string, dir: string) => {
-            if (!fs.existsSync(dir)) return;
-            for (const f of fs.readdirSync(dir)) {
-                const isClaim = /\.sending-[^-]+-\d+$/.test(f);
-                const isActive = isClaim || f.endsWith(".ltr") || f.endsWith(".eml");
-                if (!isActive) continue;
-                total++;
-                const acctSlot = perAccount[accountId] ||= { total: 0, retrying: 0, claimed: 0 };
-                acctSlot.total++;
-                if (isClaim) { claimed++; acctSlot.claimed++; }
-                const fp = path.join(dir, f);
-                try {
-                    const st = fs.statSync(fp);
-                    const age = now - st.mtimeMs;
-                    if (age > oldestMs) oldestMs = age;
-                    // Only read header region to count retry attempts — tiny I/O.
-                    const fd = fs.openSync(fp, "r");
-                    try {
-                        const buf = Buffer.alloc(4096);
-                        const n = fs.readSync(fd, buf, 0, 4096, 0);
-                        const head = buf.slice(0, n).toString("utf-8");
-                        const info = parseRetryInfo(head);
-                        if (info.attemptCount > 0) { retrying++; acctSlot.retrying++; }
-                        if (info.attemptCount > maxAttempts) maxAttempts = info.attemptCount;
-                    } finally { fs.closeSync(fd); }
-                } catch { /* ignore per-file errors */ }
-            }
-        };
-        const outboxRoot = path.join(configDir, "outbox");
-        const sendingRoot = path.join(configDir, "sending");
-        try {
-            if (fs.existsSync(outboxRoot)) {
-                for (const acct of fs.readdirSync(outboxRoot)) scan(acct, path.join(outboxRoot, acct));
-            }
-            if (fs.existsSync(sendingRoot)) {
-                for (const acct of fs.readdirSync(sendingRoot)) {
-                    scan(acct, path.join(sendingRoot, acct, "queued"));
-                }
-            }
-        } catch { /* */ }
-        return {
-            total, retrying, claimed,
-            oldestAgeSec: Math.floor(oldestMs / 1000),
-            maxAttempts,
-            perAccount,
-        };
-    }
-
-    /** Emit outboxStatus now. Call after any queue mutation. */
-    private emitOutboxStatus(): void {
-        try { this.emit("outboxStatus", this.getOutboxStatus()); } catch { /* */ }
-    }
-
-    /** Guard against concurrent processSendActions for the same account */
-    private sendingAccounts = new Set<string>();
-
-    /** Process local send actions — APPEND to Outbox, which the outbox worker then sends */
-    private async processSendActions(accountId: string): Promise<void> {
-        if (this.sendingAccounts.has(accountId)) return; // already processing
-        this.sendingAccounts.add(accountId);
-        try { await this._processSendActions(accountId); }
-        finally { this.sendingAccounts.delete(accountId); }
-    }
-
-    private async _processSendActions(accountId: string): Promise<void> {
-        const actions = this.db.getPendingSyncActions(accountId)
-            .filter(a => a.action === "send");
-        if (actions.length === 0) return;
-
-        for (const action of actions) {
-            if (!action.rawMessage) {
-                this.db.completeSyncAction(action.id);
-                continue;
-            }
-            // Abandon after 10 failed attempts — don't retry forever
-            if (action.attempts >= 10) {
-                console.error(`  [outbox] Abandoning send action ${action.id} after ${action.attempts} attempts: ${action.rawMessage?.substring(0, 100)}`);
-                this.db.completeSyncAction(action.id);
-                this.emit("accountError", accountId, `Send permanently failed after ${action.attempts} attempts`, "Message removed from queue", false);
-                continue;
-            }
-            try {
-                await this.queueOutgoing(accountId, action.rawMessage);
-                this.db.completeSyncAction(action.id);
-            } catch (e: any) {
-                console.error(`  [outbox] Local→IMAP failed (attempt ${action.attempts + 1}): ${e.message}`);
-                this.db.failSyncAction(action.id, e.message);
-            }
-        }
-    }
-
-    // ── Outbox ──
-
-    private outboxInterval: ReturnType<typeof setInterval> | null = null;
-    private readonly hostname = os.hostname();
-
-    /** Ensure Outbox folder exists, create if needed */
-    private async ensureOutbox(accountId: string): Promise<string> {
-        let outbox = this.findFolder(accountId, "outbox");
-        if (outbox) return outbox.path;
-
-        // Look for existing folder named Outbox (case-insensitive)
-        const folders = this.db.getFolders(accountId);
-        const existing = folders.find(f => f.path.toLowerCase() === "outbox");
-        if (existing) return existing.path;
-
-        try {
-            await this.withConnection(accountId, async (client) => {
-                await client.createmailbox("Outbox");
-                await this.syncFolders(accountId, client);
-            });
-        } catch (e: any) {
-            // Might already exist — benign
-            if (!e.message?.includes("already exists")) throw e;
-        }
-
-        outbox = this.findFolder(accountId, "outbox");
-        return outbox?.path || "Outbox";
-    }
-
-    /** Save a copy of outgoing mail — label is a subdirectory (editing/queued/sent) */
-    private saveSendingCopy(accountId: string, rawMessage: string | Buffer, label: string): void {
-        try {
-            const dir = path.join(getConfigDir(), "sending", accountId, label);
-            fs.mkdirSync(dir, { recursive: true });
-            const now = new Date();
-            const pad2 = (n: number) => String(n).padStart(2, "0");
-            const ts = `${now.getFullYear()}${pad2(now.getMonth() + 1)}${pad2(now.getDate())}_${pad2(now.getHours())}${pad2(now.getMinutes())}${pad2(now.getSeconds())}`;
-            fs.writeFileSync(path.join(dir, `${ts}.eml`), rawMessage);
-            console.log(`  [sending] ${label}/${ts}.eml`);
-        } catch (e: any) {
-            console.error(`  [sending] Failed to save copy: ${e.message}`);
-        }
-    }
-
-    /** Queue a message for sending. Tries IMAP Outbox, falls back to local file. */
-    async queueOutgoing(accountId: string, rawMessage: string | Buffer): Promise<void> {
-        // IMPORTANT: do NOT save a "debug copy" to sending/<acct>/queued/ here.
-        // processLocalQueue also scans sending/<acct>/queued/, so writing there
-        // on every send caused the same message to be re-APPENDed to the IMAP
-        // Outbox on the next outbox tick — resulting in a duplicate send.
-        // The only two legitimate queue locations are:
-        //   - IMAP Outbox (primary, populated by APPEND below)
-        //   - ~/.mailx/outbox/<acct>/*.ltr (fallback when IMAP is unreachable)
-        try {
-            const outboxPath = await this.ensureOutbox(accountId);
-            await this.withConnection(accountId, async (client) => {
-                await client.appendMessage(outboxPath, rawMessage, ["\\Seen"]);
-                console.log(`  [outbox] Queued message in ${outboxPath}`);
-            });
-            const outboxFolder = this.findFolder(accountId, "outbox");
-            if (outboxFolder) {
-                this.syncFolder(accountId, outboxFolder.id).catch(() => {});
-            }
-            return;
-        } catch (e: any) {
-            console.error(`  [outbox] IMAP queue failed: ${e.message} — saving locally`);
-        }
-
-        // Fallback: save to local file queue (processLocalQueue picks these up)
-        const localQueue = path.join(getConfigDir(), "outbox", accountId);
-        fs.mkdirSync(localQueue, { recursive: true });
-        const now = new Date();
-        const pad2 = (n: number) => String(n).padStart(2, "0");
-        const filename = `${now.getFullYear()}${pad2(now.getMonth() + 1)}${pad2(now.getDate())}_${pad2(now.getHours())}${pad2(now.getMinutes())}${pad2(now.getSeconds())}-${String(Math.floor(Math.random() * 10000)).padStart(4, "0")}.ltr`;
-        fs.writeFileSync(path.join(localQueue, filename), rawMessage);
-        console.log(`  [outbox] Saved locally: ${filename}`);
-    }
-
-    /** Process local file queue — scan both outbox/ (IMAP-unreachable fallback)
-     *  and sending/<acct>/queued/ (manual drop-in, crash recovery). The earlier
-     *  double-send bug was caused by queueOutgoing() WRITING a debug copy to
-     *  sending/queued/ on every send — that write is gone now, so scanning the
-     *  directory is safe again. Any legitimate files that land there (crash
-     *  recovery, manual drop) will get sent. */
-    private async processLocalQueue(accountId: string): Promise<void> {
-        const outboxDir = path.join(getConfigDir(), "outbox", accountId);
-        const queuedDir = path.join(getConfigDir(), "sending", accountId, "queued");
-
-        // Recovery sweep: any *.sending-<host>-<pid> on THIS host whose PID is
-        // dead (process crashed mid-send) gets unclaimed so the next tick can
-        // retry. Foreign hosts are left alone — we have no way to know if their
-        // process is alive. Cross-host stale recovery is the IMAP-folder path's
-        // job (sweeper looks at server-side claim flags, not local files).
-        for (const dir of [outboxDir, queuedDir]) {
-            if (!fs.existsSync(dir)) continue;
-            for (const f of fs.readdirSync(dir)) {
-                const m = f.match(/^(.+)\.sending-([^-]+)-(\d+)$/);
-                if (!m) continue;
-                const [, original, host, pidStr] = m;
-                if (host !== this.hostname) continue;
-                const pid = parseInt(pidStr);
-                let alive = false;
-                try { process.kill(pid, 0); alive = true; } catch { /* dead */ }
-                if (alive) continue; // live claim — owner (sibling or self) still has it
-                try {
-                    fs.renameSync(path.join(dir, f), path.join(dir, original));
-                    console.log(`  [outbox] Recovered stale claim ${f} → ${original}`);
-                } catch { /* ignore */ }
-            }
-        }
-
-        const filesToSend: { dir: string; file: string }[] = [];
-        for (const dir of [outboxDir, queuedDir]) {
-            if (!fs.existsSync(dir)) continue;
-            for (const file of fs.readdirSync(dir).filter(f => f.endsWith(".ltr") || f.endsWith(".eml"))) {
-                filesToSend.push({ dir, file });
-            }
-        }
-        if (filesToSend.length === 0) return;
-
-        // Gmail/API accounts: send directly via SMTP from local queue (no IMAP outbox)
-        const sentDir = path.join(getConfigDir(), "sending", accountId, "sent");
-        fs.mkdirSync(sentDir, { recursive: true });
-
-        if (this.isGmailAccount(accountId)) {
-            const nowMs = Date.now();
-            for (const { dir, file } of filesToSend) {
-                const filePath = path.join(dir, file);
-
-                // Atomic claim: rename to <file>.sending-<host>-<pid> so a sibling
-                // process scanning the same dir can't grab the same .ltr. Filesystem
-                // rename is atomic; loser sees ENOENT and skips. Without this, two
-                // mailx instances on one machine (or two ticks within one process)
-                // could both pass the Message-ID dedup check and both call SMTP.
-                const claimSuffix = `.sending-${this.hostname}-${process.pid}`;
-                const claimedPath = filePath + claimSuffix;
-                try {
-                    fs.renameSync(filePath, claimedPath);
-                } catch (e: any) {
-                    if (e.code === "ENOENT") continue; // another process won
-                    throw e;
-                }
-
-                let raw = fs.readFileSync(claimedPath, "utf-8");
-
-                // Per-message rate limit: if a prior attempt set X-Mailx-Retry-After
-                // in the future, skip this file for now. Minimizes the race where the
-                // SMTP server actually accepted DATA but we lost the ack and would
-                // otherwise retry immediately on the next 10s tick.
-                const retryInfo = parseRetryInfo(raw);
-                if (retryInfo.nextAttemptAt > nowMs) {
-                    // Release claim — let next tick reconsider
-                    try { fs.renameSync(claimedPath, filePath); } catch { /* ignore */ }
-                    continue;
-                }
-
-                // Record this attempt: strip internal X-Mailx-Retry-After, append a new
-                // X-Mailx-Retry: N <ISO-timestamp> line to the headers. The updated file
-                // is written back *before* the send so a crash mid-send doesn't lose state.
-                const attempt = retryInfo.attemptCount + 1;
-                raw = stripHeaderField(raw, "X-Mailx-Retry-After");
-                raw = insertHeaderBeforeBody(raw, `X-Mailx-Retry: ${attempt} ${new Date().toISOString()}`);
-                fs.writeFileSync(claimedPath, raw, "utf-8");
-
-                try {
-                    await this.sendRawViaSMTP(accountId, raw);
-                    fs.renameSync(claimedPath, path.join(sentDir, file));
-                    console.log(`  [outbox] Sent ${file} via SMTP → sent/ (attempt ${attempt})`);
-                } catch (e: any) {
-                    // Persist a next-attempt timestamp and release the claim so the
-                    // file is visible to the scan loop again.
-                    const nextAt = new Date(nowMs + OUTBOX_RETRY_DELAY_MS).toISOString();
-                    const withDelay = insertHeaderBeforeBody(raw, `X-Mailx-Retry-After: ${nextAt}`);
-                    fs.writeFileSync(claimedPath, withDelay, "utf-8");
-                    try { fs.renameSync(claimedPath, filePath); } catch { /* file stays claimed; recovery sweeper will handle */ }
-                    console.error(`  [outbox] Send failed for ${file} (attempt ${attempt}, retry after ${nextAt}): ${e.message}`);
-                }
-            }
-            return;
-        }
-
-        // IMAP accounts: append to IMAP Outbox for multi-machine interlock.
-        //
-        // Atomic claim (same pattern as the Gmail path above): rename the file
-        // to <file>.sending-<host>-<pid> BEFORE reading it, so two concurrent
-        // mailx instances scanning the same dir can't both APPEND the same
-        // message to IMAP Outbox and end up with a duplicate. Filesystem rename
-        // is atomic; the loser sees ENOENT and skips. On APPEND success, move
-        // the claimed file to sending/sent/; on APPEND failure, release the
-        // claim so the recovery sweeper picks it up next tick.
-        try {
-            const outboxPath = await this.ensureOutbox(accountId);
-            const client = await this.createClientWithLimit(accountId);
-            try {
-                for (const { dir, file } of filesToSend) {
-                    const filePath = path.join(dir, file);
-                    const claimSuffix = `.sending-${this.hostname}-${process.pid}`;
-                    const claimedPath = filePath + claimSuffix;
-                    try {
-                        fs.renameSync(filePath, claimedPath);
-                    } catch (e: any) {
-                        if (e.code === "ENOENT") continue; // sibling claimed first
-                        throw e;
-                    }
-                    try {
-                        const raw = fs.readFileSync(claimedPath, "utf-8");
-                        await client.appendMessage(outboxPath, raw, ["\\Seen"]);
-                        fs.renameSync(claimedPath, path.join(sentDir, file));
-                        console.log(`  [outbox] Moved ${file} to IMAP Outbox → sent/`);
-                    } catch (e: any) {
-                        // APPEND failed (connection dropped mid-send, server
-                        // busy, etc.) — release the claim so next tick can
-                        // retry. Don't swallow: rethrow after release so the
-                        // outer catch ("IMAP still unreachable") bails out of
-                        // the remaining files too — whatever broke will break
-                        // the next file the same way.
-                        try { fs.renameSync(claimedPath, filePath); } catch { /* recovery sweeper will handle */ }
-                        throw e;
-                    }
-                }
-            } finally {
-                try { await client.logout(); } catch { /* ignore */ }
-            }
-        } catch {
-            // IMAP still unreachable — leave files for next attempt
-        }
-    }
-
-    /** Send a raw RFC 2822 message via SMTP for a given account.
-     *  Uses @bobfrankston/smtp-direct with the same TransportFactory as IMAP —
-     *  same TCP byte-stream interface, no nodemailer dependency. */
-    private async sendRawViaSMTP(accountId: string, raw: string): Promise<void> {
-        const settings = loadSettings();
-        const account = settings.accounts.find(a => a.id === accountId);
-        if (!account?.smtp) throw new Error(`No SMTP config for ${accountId}`);
-
-        const smtpPort = account.smtp.port || SMTP_PORT_STARTTLS;
-        const smtpHost = account.smtp.host || account.imap?.host;
-        if (!smtpHost) throw new Error(`No SMTP host for ${accountId}`);
-
-        // SMTP auth: explicit SMTP creds, fall back to IMAP creds for password auth.
-        const smtpAuthType = account.smtp.auth || (account.imap?.password ? "password" : undefined);
-        const smtpUser = account.smtp.user || account.imap?.user || account.email;
-        let auth: import("@bobfrankston/smtp-direct").SmtpAuth | undefined;
-        if (smtpAuthType === "password") {
-            const pass = account.smtp.password || account.imap?.password;
-            if (!pass) throw new Error("SMTP password not configured");
-            auth = { method: "PLAIN", user: smtpUser, pass };
-        } else if (smtpAuthType === "oauth2") {
-            const token = await this.getOAuthToken(accountId);
-            if (!token) throw new Error("OAuth token not available");
-            auth = { method: "XOAUTH2", user: smtpUser, token };
-        }
-
-        const parseAddrs = (s: string) => s.match(/[\w.+-]+@[\w.-]+/g) || [];
-        const toMatch = raw.match(/^To:\s*(.+)$/mi);
-        const ccMatch = raw.match(/^Cc:\s*(.+)$/mi);
-        const bccMatch = raw.match(/^Bcc:\s*(.+)$/mi);
-        const fromMatch = raw.match(/^From:\s*(.+)$/mi);
-        const subjectMatch = raw.match(/^Subject:\s*(.+)$/mi);
-        const messageIdMatch = raw.match(/^Message-ID:\s*(<[^>]+>)/mi);
-        const recipients = [
-            ...(toMatch ? parseAddrs(toMatch[1]) : []),
-            ...(ccMatch ? parseAddrs(ccMatch[1]) : []),
-            ...(bccMatch ? parseAddrs(bccMatch[1]) : []),
-        ];
-        const sender = fromMatch ? (parseAddrs(fromMatch[1])[0] || account.email) : account.email;
-        if (recipients.length === 0) throw new Error("No recipients");
-
-        // Dedup: skip if this Message-ID has already been sent. Prevents the
-        // outbox from re-sending the same file across crash/restart cycles.
-        const messageId = messageIdMatch ? messageIdMatch[1] : "";
-        if (messageId && this.db.hasSentMessage(messageId)) {
-            console.log(`  [smtp] ${accountId}: SKIP ${messageId} — already in sent_log`);
-            return;
-        }
-
-        const rawToSend = raw.replace(/^Bcc:.*\r?\n/mi, "");
-        this.saveSendingCopy(accountId, rawToSend, "sent");
-
-        const smtp = new SmtpClient({
-            host: smtpHost,
-            port: smtpPort,
-            secure: smtpPort === SMTP_PORT_IMPLICIT_TLS,
-            auth,
-            localname: os.hostname(),
-        }, this.transportFactory);
-        try {
-            await smtp.connect();
-            const result = await smtp.sendMail({ from: sender, to: recipients }, rawToSend);
-            if (result.rejected.length > 0) {
-                console.log(`  [smtp] ${accountId}: ${result.rejected.length} recipient(s) rejected: ${result.rejected.map(r => `${r.address} (${r.code})`).join(", ")}`);
-            }
-        } finally {
-            try { await smtp.quit(); } catch { /* ignore */ }
-        }
-
-        if (messageId) {
-            this.db.recordSent(messageId, accountId, subjectMatch?.[1]?.trim() || "", recipients);
-        }
-        console.log(`  [smtp] ${accountId}: sent to ${recipients.join(", ")}`);
-    }
-
-    /** Process Outbox — send pending messages with flag-based interlock.
-     *  Each per-UID step is its own withConnection({slow}) call so the queue
-     *  yields between messages: a click-to-view body in the middle of a
-     *  10-message outbox drain doesn't wait for all 10 to finish. */
-    async processOutbox(accountId: string): Promise<void> {
-        const outboxFolder = this.findFolder(accountId, "outbox");
-        if (!outboxFolder) return;
-
-        // Gmail: skip IMAP outbox check — sending handled by processLocalQueue which sends directly via SMTP
-        if (this.isGmailAccount(accountId)) return;
-
-        const settings = loadSettings();
-        const account = settings.accounts.find(a => a.id === accountId);
-        if (!account) return;
-
-        // List UIDs first — quick command, fast lane.
-        const uids = await this.withConnection(accountId, (client) =>
-            client.getUids(outboxFolder.path)
-        ) as number[];
-        if (uids.length === 0) return;
-
-        const STALE_CLAIM_MS = 3600_000; // 1 hour — longer than any reasonable SMTP send
-        const nowSec = Math.floor(Date.now() / 1000);
-        const sendingFlag = `$Sending-${this.hostname}-${nowSec}`;
-        const sentFolder = this.findFolder(accountId, "sent");
-
-        for (const uid of uids) {
-            // Each iteration is one slow-lane turn — fast-lane work can run
-            // between iterations, so a body click during a long outbox drain
-            // gets serviced promptly.
-            const result = await this.withConnection(accountId, async (client) => {
-                const flags = await client.getFlags(outboxFolder.path, uid);
-
-                // Sweep stale claims. $Sending-<host>-<sec> with old timestamp,
-                // or legacy $Sending-<host> without timestamp (treated as
-                // stale; if the real owner is alive it'll re-claim next tick).
-                const claimFlags = flags.filter((f: string) => f.startsWith("$Sending"));
-                for (const cf of claimFlags) {
-                    const m = cf.match(/^\$Sending-(.+?)(?:-(\d+))?$/);
-                    if (!m) continue;
-                    const tsSec = m[2] ? parseInt(m[2]) : 0;
-                    const ageSec = nowSec - tsSec;
-                    if (ageSec * 1000 > STALE_CLAIM_MS) {
-                        try {
-                            await client.removeFlags(outboxFolder.path, uid, [cf]);
-                            console.log(`  [outbox] Swept stale claim ${cf} on UID ${uid} (age ${Math.round(ageSec / 60)}m)`);
-                        } catch { /* ignore */ }
-                    }
-                }
-
-                const flagsNow = (claimFlags.length > 0)
-                    ? await client.getFlags(outboxFolder.path, uid)
-                    : flags;
-                if (flagsNow.some((f: string) => f.startsWith("$Sending"))) return { skip: true };
-                if (flagsNow.includes("$PermanentFailure")) return { skip: true };
-                if (flagsNow.includes("$Failed")) {
-                    await client.removeFlags(outboxFolder.path, uid, ["$Failed"]);
-                }
-
-                await client.addFlags(outboxFolder.path, uid, [sendingFlag]);
-
-                // TOCTOU re-check: if two devices addFlags concurrently both
-                // see ≥2 sending flags. Fail-safe: both back off, next tick
-                // one wins.
-                const flagsAfter = await client.getFlags(outboxFolder.path, uid);
-                const sendingFlags = flagsAfter.filter((f: string) => f.startsWith("$Sending"));
-                if (sendingFlags.length > 1 || (sendingFlags.length === 1 && sendingFlags[0] !== sendingFlag)) {
-                    await client.removeFlags(outboxFolder.path, uid, [sendingFlag]);
-                    return { skip: true };
-                }
-
-                const msg = await client.fetchMessageByUid(outboxFolder.path, uid, { source: true });
-                if (!msg?.source) {
-                    await client.removeFlags(outboxFolder.path, uid, [sendingFlag]);
-                    return { skip: true };
-                }
-                return { source: msg.source };
-            }, { slow: true });
-
-            if ((result as any).skip) continue;
-            const source = (result as any).source as string;
-
-            // SMTP send is its own connection — not an IMAP op, doesn't go
-            // through withConnection.
-            try {
-                await this.sendRawViaSMTP(accountId, source);
-                console.log(`  [outbox] Sent UID ${uid}`);
-
-                // Delete from Outbox + copy to Sent. Done in two separate
-                // withConnection calls so other work can interleave.
-                await this.withConnection(accountId, async (client) => {
-                    // Delete FIRST to prevent double-send if Sent-copy fails.
-                    await client.deleteMessageByUid(outboxFolder.path, uid);
-                }, { slow: true });
-                if (sentFolder) {
-                    try {
-                        await this.withConnection(accountId, async (client) => {
-                            await client.appendMessage(sentFolder.path, source, ["\\Seen"]);
-                        }, { slow: true });
-                        this.syncFolder(accountId, sentFolder.id).catch(() => {});
-                    } catch (sentErr: any) {
-                        console.error(`  [outbox] Failed to copy to Sent: ${sentErr.message} — message was sent successfully`);
-                    }
-                    this.syncFolder(accountId, outboxFolder.id).catch(() => {});
-                }
-            } catch (e: any) {
-                const errMsg = e.message || String(e);
-                console.error(`  [outbox] Send failed UID ${uid}: ${errMsg}`);
-                try {
-                    await this.withConnection(accountId, async (client) => {
-                        await client.removeFlags(outboxFolder.path, uid, [sendingFlag]);
-                        await client.addFlags(outboxFolder.path, uid, ["$Failed"]);
-                    }, { slow: true });
-                } catch { /* best-effort */ }
-                this.emit("accountError", accountId, `Send failed: ${errMsg}`, "Message kept in Outbox", false);
-                if (/auth|login|credential|invalid/i.test(errMsg)) {
-                    this.outboxBackoff.set(accountId, Date.now() + 3600000); // 1 hour
-                    console.error(`  [outbox] Auth failure for ${accountId} — outbox paused for 1 hour`);
-                }
-            }
-        }
-    }
-
-    /** Start background Outbox worker — runs immediately then every 10 seconds */
-    private outboxBackoff = new Map<string, number>(); // accountId → next retry timestamp
-    private outboxBackoffDelay = new Map<string, number>(); // accountId → current delay ms
-
-    startOutboxWorker(): void {
-        if (this.outboxInterval) return;
-
-        const processAll = async () => {
-            const now = Date.now();
-            for (const [accountId] of this.configs) {
-                // Skip accounts in backoff
-                const retryAfter = this.outboxBackoff.get(accountId) || 0;
-                if (now < retryAfter) continue;
-
-                try {
-                    await this.processLocalQueue(accountId);
-                    await this.processOutbox(accountId);
-                    // Success — clear backoff
-                    this.outboxBackoff.delete(accountId);
-                    this.outboxBackoffDelay.delete(accountId);
-                } catch (e: any) {
-                    // Stale-socket errors (Dovecot silently drops idle connections,
-                    // or the sync path timed out and destroyed the socket): force a
-                    // fresh ops client so the next tick doesn't keep hitting the same
-                    // dead socket. Without reconnectOps, the dead client stays in the
-                    // opsClients map and every subsequent processOutbox call fails
-                    // immediately with "Not connected" — forever.
-                    const msg = String(e?.message || e);
-                    if (/Not connected|ECONNRESET|socket hang up|EPIPE|write after end/i.test(msg)) {
-                        this.reconnectOps(accountId).catch(() => {});
-                        console.error(`  [outbox] Stale connection for ${accountId}: ${msg} — reconnecting`);
-                    } else {
-                        // Exponential backoff: 60s → 120s → 300s (max 5min)
-                        const prevDelay = this.outboxBackoffDelay.get(accountId) || 0;
-                        const delay = prevDelay ? Math.min(prevDelay * 2, 300000) : 60000;
-                        this.outboxBackoffDelay.set(accountId, delay);
-                        this.outboxBackoff.set(accountId, now + delay);
-                        console.error(`  [outbox] Error for ${accountId}: ${imapError(e)} (retry in ${Math.round(delay / 1000)}s)`);
-                    }
-                }
-            }
-            // After each full tick, refresh the UI indicator.
-            this.emitOutboxStatus();
-        };
-        // First tick at 500ms so any stale .sending-HOST-DEAD_PID claim file
-        // left behind by a prior crash gets recovered (renamed back to .ltr)
-        // within half a second of startup — otherwise the status-queue pill
-        // shows a red "1 queued" to the user until the first 10s tick passes.
-        setTimeout(() => processAll(), 500);
-        this.outboxInterval = setInterval(processAll, 10000);
-    }
-
-    /** Stop Outbox worker */
-    stopOutboxWorker(): void {
-        if (this.outboxInterval) {
-            clearInterval(this.outboxInterval);
-            this.outboxInterval = null;
-        }
-    }
-
-    // ── Config file watcher ──
-
-    private configWatchers: fs.FSWatcher[] = [];
-    private cloudPollTimers: ReturnType<typeof setInterval>[] = [];
-
-    /** Watch the local config files for external changes. On change, emit
-     *  configChanged so the UI can show a "restart to apply" banner. Uses
-     *  a debounce to coalesce rapid writes from save tools. */
-    watchConfigFiles(): void {
-        const files = ["accounts.jsonc", "allowlist.jsonc", "clients.jsonc", "config.jsonc", "contacts.jsonc"];
-        const configDir = getConfigDir();
-        const debounce = new Map<string, ReturnType<typeof setTimeout>>();
-        // Cache the last-seen normalized content per file. fs.watch fires on
-        // metadata-only events (atime, attrib change) AND on no-op rewrites
-        // that land identical bytes — both would fire a spurious banner.
-        // Compare after the debounce window and only emit on a real change.
-        const normalize = (s: string): string =>
-            s.replace(/^\uFEFF/, "").replace(/\r\n/g, "\n").replace(/[ \t\r\n]+$/, "");
-        const lastContent = new Map<string, string>();
-        for (const filename of files) {
-            const full = path.join(configDir, filename);
-            if (!fs.existsSync(full)) continue;
-            try { lastContent.set(filename, normalize(fs.readFileSync(full, "utf-8"))); } catch { /* */ }
-            try {
-                const watcher = fs.watch(full, () => {
-                    const prev = debounce.get(filename);
-                    if (prev) clearTimeout(prev);
-                    debounce.set(filename, setTimeout(() => {
-                        debounce.delete(filename);
-                        let current = "";
-                        try { current = normalize(fs.readFileSync(full, "utf-8")); } catch { /* missing */ }
-                        const previous = lastContent.get(filename) || "";
-                        if (current === previous) {
-                            console.log(`  [watch] ${filename} fs.watch fired but content unchanged — no banner`);
-                            return;
-                        }
-                        // Log a short diff hint so repeat-firings are diagnosable.
-                        const prevSize = previous.length;
-                        const curSize = current.length;
-                        const firstDiff = (() => {
-                            const n = Math.min(prevSize, curSize);
-                            for (let i = 0; i < n; i++) if (previous[i] !== current[i]) return i;
-                            return n;
-                        })();
-                        const prevSnip = previous.slice(Math.max(0, firstDiff - 20), firstDiff + 40).replace(/\n/g, "\\n");
-                        const curSnip = current.slice(Math.max(0, firstDiff - 20), firstDiff + 40).replace(/\n/g, "\\n");
-                        console.log(`  [watch] ${filename} changed: size ${prevSize}→${curSize}, first diff at byte ${firstDiff}`);
-                        console.log(`  [watch]   was: ${JSON.stringify(prevSnip)}`);
-                        console.log(`  [watch]   now: ${JSON.stringify(curSnip)}`);
-                        lastContent.set(filename, current);
-                        this.emit("configChanged", filename);
-                    }, 500));
-                });
-                this.configWatchers.push(watcher);
-            } catch (e: any) {
-                console.error(`  [watch] Failed to watch ${filename}: ${e.message}`);
-            }
-        }
-
-        // GDrive has no push/watch for arbitrary Drive files, so edits on
-        // another device (or via Drive web) never fire fs.watch locally.
-        // Poll the cloud copies of the replicated-to-cloud config files
-        // (accounts.jsonc, allowlist.jsonc, clients.jsonc) every 3 minutes,
-        // compare to local, and write-through on difference. The local
-        // fs.watch above then picks up the write and emits configChanged.
-        // config.jsonc is per-machine / local-only — never polled.
-        const cloudFiles = ["accounts.jsonc", "allowlist.jsonc", "clients.jsonc", "contacts.jsonc"];
-        const CLOUD_POLL_MS = 3 * 60 * 1000;
-        // normalize() reused from the fs.watch block above — same intent:
-        // cloud round-trips that re-wrap newlines / add a trailing newline are
-        // semantically identical; don't overwrite local on those.
-        const pollCloud = async (): Promise<void> => {
-            let cloudRead: any;
-            let parseJsonc: any;
-            try {
-                ({ cloudRead } = await import("@bobfrankston/mailx-settings"));
-                ({ parseJsonc } = await import("jsonc-parser").then(m => ({ parseJsonc: m.parse })));
-            } catch { return; /* cloud module unavailable */ }
-            for (const filename of cloudFiles) {
-                try {
-                    const cloudContent = await cloudRead(filename);
-                    if (!cloudContent) continue;
-                    const localPath = path.join(configDir, filename);
-                    let localContent: string | null = null;
-                    try { localContent = fs.readFileSync(localPath, "utf-8"); } catch { /* missing */ }
-                    if (localContent !== null) {
-                        if (normalize(localContent) === normalize(cloudContent)) continue;
-                        // Semantic check: parse both as JSONC and compare structures.
-                        // Catches reorderings that normalize() doesn't (e.g. JSON with
-                        // same keys in different order after a cloud-side re-serialize).
-                        try {
-                            const a = parseJsonc(localContent);
-                            const b = parseJsonc(cloudContent);
-                            if (a !== undefined && b !== undefined &&
-                                JSON.stringify(a) === JSON.stringify(b)) continue;
-                        } catch { /* fall through to write */ }
-                    }
-                    fs.writeFileSync(localPath, cloudContent);
-                    console.log(`  [cloud-poll] ${filename} updated from cloud copy`);
-                } catch (e: any) {
-                    console.log(`  [cloud-poll] ${filename} check skipped: ${e?.message || e}`);
-                }
-            }
-        };
-        // First poll ~10s after startup, then every 3 min.
-        setTimeout(() => {
-            pollCloud();
-            const interval = setInterval(pollCloud, CLOUD_POLL_MS);
-            this.cloudPollTimers.push(interval);
-        }, 10_000);
-    }
-
-    /** Stop all config file watchers */
-    stopWatchingConfig(): void {
-        for (const w of this.configWatchers) {
-            try { w.close(); } catch { /* ignore */ }
-        }
-        this.configWatchers = [];
-        for (const t of this.cloudPollTimers) {
-            try { clearInterval(t); } catch { /* ignore */ }
-        }
-        this.cloudPollTimers = [];
-    }
-
-    // ── Google Contacts Sync (incremental via People API syncToken) ──
-
-    /** Per-account in-flight guard so concurrent calls (startup + periodic
-     *  timer + manual button) share one round-trip instead of stacking. */
-    private contactsSyncing = new Map<string, Promise<number>>();
-
-    /** Get an OAuth token for Google APIs (contacts, calendar, etc.)
-     *  Uses the SAME token as IMAP — scopes are combined in one grant */
-    private async getContactsToken(accountId: string): Promise<string | null> {
-        // Reuse the IMAP token — it now includes contacts.readonly scope
-        return this.getOAuthToken(accountId);
-    }
-
-    /** Sync contacts from Google People API. Incremental: persists
-     *  `nextSyncToken` per account in the kv table (`scope='contacts'`,
-     *  `key=accountId`) so subsequent calls only fetch changed/deleted rows.
-     *  First-ever call passes `requestSyncToken=true` so Google returns a
-     *  token to use next time; without that, the first response has no
-     *  `nextSyncToken` and incremental never kicks in. Returns the number of
-     *  contacts added or removed in this run. */
-    async syncGoogleContacts(accountId: string): Promise<number> {
-        // Coalesce concurrent calls for the same account.
-        const inFlight = this.contactsSyncing.get(accountId);
-        if (inFlight) return inFlight;
-        const promise = this.syncGoogleContactsImpl(accountId)
-            .finally(() => this.contactsSyncing.delete(accountId));
-        this.contactsSyncing.set(accountId, promise);
-        return promise;
-    }
-
-    private async syncGoogleContactsImpl(accountId: string): Promise<number> {
-        const token = await this.getContactsToken(accountId);
-        if (!token) return 0;
-
-        let changed = 0;
-        let nextPageToken: string | undefined;
-        const now = Date.now();
-
-        // Per-account persisted sync token (survives restarts). Empty means
-        // we've never completed an initial sync for this account.
-        let syncToken = this.db.getKv("contacts", accountId) || "";
-
-        try {
-            do {
-                const params = new URLSearchParams({
-                    personFields: "names,emailAddresses,organizations,photos",
-                    pageSize: "100",
-                });
-                if (nextPageToken) params.set("pageToken", nextPageToken);
-                if (syncToken) {
-                    params.set("syncToken", syncToken);
-                } else {
-                    // First-ever sync for this account — ask Google to give us
-                    // a token in the response so the NEXT call can be cheap.
-                    params.set("requestSyncToken", "true");
-                }
-
-                const url = `https://people.googleapis.com/v1/people/me/connections?${params}`;
-                const res = await fetch(url, {
-                    headers: { Authorization: `Bearer ${token}` },
-                });
-
-                if (res.status === 410) {
-                    // Sync token expired (Google retains tokens for ~7 days).
-                    // Drop the stored token and recurse for a full sync — the
-                    // in-flight guard is on syncGoogleContacts (the public
-                    // wrapper), not Impl, so recursion is safe.
-                    this.db.setKv("contacts", accountId, null);
-                    return this.syncGoogleContactsImpl(accountId);
-                }
-
-                if (!res.ok) {
-                    const err = await res.text();
-                    console.error(`  [contacts] API error for ${accountId}: ${res.status} ${err}`);
-                    return changed;
-                }
-
-                const data = await res.json() as any;
-
-                if (data.connections) {
-                    for (const person of data.connections) {
-                        const googleId = person.resourceName || "";
-                        // Incremental responses tag deleted contacts via
-                        // metadata.deleted=true (and emit no other fields).
-                        // Drop those rows so autocomplete stops surfacing them.
-                        if (person.metadata?.deleted) {
-                            const removed = this.db.deleteContactByGoogleId(googleId);
-                            if (removed > 0) changed += removed;
-                            continue;
-                        }
-                        const emails = person.emailAddresses || [];
-                        const names = person.names || [];
-                        const orgs = person.organizations || [];
-                        const name = names[0]?.displayName || "";
-                        const org = orgs[0]?.name || "";
-
-                        for (const emailEntry of emails) {
-                            const email = emailEntry.value?.toLowerCase();
-                            if (!email) continue;
-
-                            const existing = this.db.searchContacts(email, 1);
-                            const wasNew = !(existing.length > 0 && existing[0].email === email);
-                            this.db.recordSentAddress(name, email);
-                            if (wasNew) changed++;
-
-                            try {
-                                (this.db as any).db.prepare(
-                                    "UPDATE contacts SET source = 'google', google_id = ?, organization = ?, updated_at = ? WHERE email = ?"
-                                ).run(googleId, org, now, email);
-                            } catch { /* ignore */ }
-                        }
-                    }
-                }
-
-                nextPageToken = data.nextPageToken;
-                // Google only returns nextSyncToken on the LAST page of a
-                // sync run (sentinel that the snapshot is consistent). When
-                // it appears, persist it for next time.
-                if (data.nextSyncToken) {
-                    this.db.setKv("contacts", accountId, data.nextSyncToken);
-                    syncToken = data.nextSyncToken;
-                }
-            } while (nextPageToken);
-
-            console.log(`  [contacts] ${accountId}: ${changed} change(s) (${syncToken ? "incremental" : "full"})`);
-        } catch (e: any) {
-            console.error(`  [contacts] Sync error for ${accountId}: ${e.message}`);
-        }
-
-        return changed;
-    }
-
-    /** Sync contacts for all OAuth accounts */
-    async syncAllContacts(): Promise<void> {
-        const settings = loadSettings();
-        for (const account of settings.accounts) {
-            if (account.imap.auth === "oauth2" && (account.enabled || (account as any).syncContacts)) {
-                await this.syncGoogleContacts(account.id);
-            }
-        }
-    }
-
-    /** Shut down all watchers and timers */
-    async shutdown(): Promise<void> {
-        this.stopPeriodicSync();
-        this.stopOutboxWorker();
-        await this.stopWatching();
-        // Disconnect all persistent operational connections
-        for (const [accountId] of this.opsClients) {
-            await this.disconnectOps(accountId);
-        }
-    }
-}