fix(android): disable AGP new-DSL mode to fix signReleaseBundle NullPointerException

AGP 9+ defaults to new-DSL-only mode, which causes a NullPointerException when conditionally creating signingConfigs inside the android {} block. Setting android.newDsl=false restores the previous evaluation behaviour. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
fix: pass keystore password as Dagger secret to Android builds
2026-05-17 12:34:51 +02:00 · 2026-05-17 11:18:00 +02:00
225 changed files with 1106 additions and 15094 deletions
@@ -1,18 +1,20 @@
 # Dagger context ignore file.
+# Since we use explicit inclusion in ci/main.go (Base function),
+# we only need to ignore large or sensitive directories here to
+# avoid unnecessary upload overhead to the Dagger engine.

-# Version control
 .git/
-
-# Build artifacts
 build/
 .dart_tool/
-coverage/
+.fvm/
+.pub-cache/
+node_modules/
+ios/Pods/
+macos/Pods/
 linux/flutter/ephemeral/
 website/public/
 website/resources/
-.task/
-.fvm/

-# Secrets
+# Sensitive files
 .env*
-.envrc
+.ssh/
@@ -1,21 +0,0 @@
-# Source: https://codeberg.org/guettli/sharedinbox/src/branch/main/.forgejo/Dockerfile
-# Install at on the act-runner host on: /etc/forgejo/runner/Dockerfile
-#
-# In systemd service:
-#    ExecStartPre=docker build -t forgejo-act-runner:latest /etc/forgejo/runner
-#    ExecStart=/usr/local/bin/forgejo-runner daemon --config /etc/forgejo/config.yml
-FROM ghcr.io/catthehacker/ubuntu:go-24.04
-
-# Infrastructure tools required by CI workflows
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    stunnel4 \
-    netcat-openbsd \
-    && rm -rf /var/lib/apt/lists/*
-
-# Dagger CLI — pinned to match the engine version on the runner host
-RUN curl -fsSL https://dl.dagger.io/dagger/install.sh \
-    | DAGGER_VERSION=0.20.8 BIN_DIR=/usr/local/bin sh
-
-# Task runner
-RUN curl -fsSL https://taskfile.dev/install.sh \
-    | sh -s -- -b /usr/local/bin v3.48.0
@@ -0,0 +1,39 @@
+# We switched to Dagger. Running the emulator tests in Dagger does not really work
+# We will use an external service for device testing.
+# TODO: Switch to device testing. First choose a service. Maybe codemagic.io
+name: Android Emulator Tests (Disabled)
+
+on:
+  workflow_dispatch: # Manual trigger only
+
+jobs:
+  integration-android:
+    name: Android Emulator Integration Tests
+    runs-on: self-hosted
+    timeout-minutes: 60
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 50
+
+      - name: Enable Nix flakes
+        run: |
+          mkdir -p ~/.config/nix
+          echo "experimental-features = nix-command flakes" >> ~/.config/nix/nix.conf
+
+      - name: Install Android SDK
+        run: |
+          SDK="${ANDROID_HOME:-$HOME/Android/Sdk}"
+          if [ ! -d "$SDK/platforms/android-34" ]; then
+            wget -q https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip -O /tmp/cmdtools.zip
+            mkdir -p "$SDK/cmdline-tools"
+            unzip -q /tmp/cmdtools.zip -d "$SDK/cmdline-tools"
+            [ -d "$SDK/cmdline-tools/cmdline-tools" ] && mv "$SDK/cmdline-tools/cmdline-tools" "$SDK/cmdline-tools/latest"
+            yes | "$SDK/cmdline-tools/latest/bin/sdkmanager" --licenses >/dev/null 2>&1 || true
+            "$SDK/cmdline-tools/latest/bin/sdkmanager" "emulator" "system-images;android-34;google_apis;x86_64"
+            "$SDK/cmdline-tools/latest/bin/sdkmanager" "platform-tools" "build-tools;34.0.0" "platforms;android-34"
+          fi
+
+      - name: Run Android Integration Tests
+        run: nix develop --no-warn-dirty --command task integration-android
@@ -3,157 +3,137 @@ name: CI
 on:
  push:
    branches: [main]
-    paths:
-      - 'lib/**'
-      - 'test/**'
-      - 'integration_test/**'
-      - 'android/**'
-      - 'linux/**'
-      - 'assets/**'
-      - '!assets/changelog.txt'
-      - 'pubspec.yaml'
-      - 'pubspec.lock'
-      - 'analysis_options.yaml'
-      - 'scripts/**'
-      - 'stalwart-dev/**'
-      - 'ci/**'
-      - 'Taskfile.yml'
-      - 'drift_schemas/**'
-      - '.forgejo/workflows/ci.yml'
  pull_request:
-    paths:
-      - 'lib/**'
-      - 'test/**'
-      - 'integration_test/**'
-      - 'android/**'
-      - 'linux/**'
-      - 'assets/**'
-      - '!assets/changelog.txt'
-      - 'pubspec.yaml'
-      - 'pubspec.lock'
-      - 'analysis_options.yaml'
-      - 'scripts/**'
-      - 'stalwart-dev/**'
-      - 'ci/**'
-      - 'Taskfile.yml'
-      - 'drift_schemas/**'
-      - '.forgejo/workflows/ci.yml'

 jobs:
  check:
    name: Full Project Check
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
+    runs-on: self-hosted
+    timeout-minutes: 30

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 50

-      - name: Check runner tools
+      - name: Enable Nix flakes
        run: |
-          command -v dagger  >/dev/null 2>&1 || { echo "ERROR: dagger is not installed in the runner image. Add it to .forgejo/Dockerfile."; exit 1; }
-          command -v task    >/dev/null 2>&1 || { echo "ERROR: task is not installed in the runner image. Add it to .forgejo/Dockerfile."; exit 1; }
-          dpkg -s stunnel4 netcat-openbsd >/dev/null 2>&1 || { echo "ERROR: stunnel4/netcat-openbsd are not installed in the runner image. Add them to .forgejo/Dockerfile."; exit 1; }
-
-      - name: Setup Dagger Remote Engine (via stunnel)
-        env:
-          DAGGER_STUNNEL_URL: ${{ secrets.DAGGER_STUNNEL_URL }}
-          DAGGER_CA_CERT: ${{ secrets.DAGGER_CA_CERT }}
-          DAGGER_CLIENT_CERT: ${{ secrets.DAGGER_CLIENT_CERT }}
-          DAGGER_CLIENT_KEY: ${{ secrets.DAGGER_CLIENT_KEY }}
-        run: scripts/setup_dagger_remote.sh
-
-      - name: Locate Docker daemon for local Dagger engine
-        run: |
-          # Skip if remote Dagger engine is already configured (preferred path)
-          if [ -n "${_DAGGER_RUNNER_HOST:-}" ]; then
-            echo "Remote Dagger engine configured, no local Docker needed."
-            exit 0
-          fi
-
-          # Try host Docker socket (DooD) if runner mounts it
-          if [ -S /var/run/docker.sock ]; then
-            if DOCKER_HOST=unix:///var/run/docker.sock docker info >/dev/null 2>&1; then
-              echo "Docker available via host socket."
-              echo "DOCKER_HOST=unix:///var/run/docker.sock" >> "$GITHUB_ENV"
-              exit 0
-            fi
-          fi
-
-          echo "WARNING: No remote Dagger engine and no local Docker found." >&2
-          echo "  - Remote engine: check DAGGER_STUNNEL_URL secret and that the host proxy is running." >&2
-          echo "  - Local Docker: runner does not expose /var/run/docker.sock." >&2
-          echo "CI will likely fail at the Dagger step." >&2
-
-      - name: Prune Dagger cache before check
-        env:
-          DAGGER_NO_NAG: "1"
-        # prune(maxUsedSpace) also reclaims named cache volumes (gradle-cache, go-build-cache, etc.)
-        # when total cache exceeds the limit; without args only unreferenced entries are removed.
-        run: |
-          dagger query '{ engine { localCache { prune(maxUsedSpace: "75gb", targetSpace: "50gb") } } }' || true
+          mkdir -p ~/.config/nix
+          echo "experimental-features = nix-command flakes" >> ~/.config/nix/nix.conf

      - name: Run Full Check Suite
-        env:
-          DAGGER_NO_NAG: "1"
-        run: task check-dagger
+        run: nix develop --no-warn-dirty --command dagger call --progress=plain -m ci check --source .

-      - name: Prune Dagger cache after check
-        if: always()
-        env:
-          DAGGER_NO_NAG: "1"
-        run: |
-          dagger query '{ engine { localCache { prune(maxUsedSpace: "75gb", targetSpace: "50gb") } } }' || true
-
-      - name: Cleanup TLS credentials
-        if: always()
-        run: rm -rf /tmp/dagger-tls /tmp/stunnel-dagger.conf /tmp/stunnel.pid
-
-  merge-renovate:
-    name: Auto-merge Renovate PR
-    needs: [check]
-    if: github.event_name == 'pull_request' && startsWith(github.head_ref, 'renovate/')
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
+  build-linux:
+    name: Build Linux Release
+    runs-on: self-hosted
+    needs: check
+    if: github.ref == 'refs/heads/main'

    steps:
-      - name: Merge if automerge label is set
-        env:
-          FORGEJO_TOKEN: ${{ github.token }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 50
+
+      - name: Enable Nix flakes
        run: |
-          python3 - << 'PYEOF'
-          import os, json, urllib.request, urllib.error, sys
+          mkdir -p ~/.config/nix
+          echo "experimental-features = nix-command flakes" >> ~/.config/nix/nix.conf

-          token = os.environ["FORGEJO_TOKEN"]
-          url_base = os.environ.get("GITHUB_SERVER_URL", "").rstrip("/")
-          repo = os.environ.get("GITHUB_REPOSITORY", "")
-          pr_number = os.environ["PR_NUMBER"]
-          api = f"{url_base}/api/v1/repos/{repo}"
-          headers = {"Authorization": f"token {token}", "Content-Type": "application/json"}
+      - name: Build & Deploy Linux to server
+        continue-on-error: true
+        env:
+          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
+          SSH_USER: ${{ secrets.SSH_USER }}
+          SSH_HOST: ${{ secrets.SSH_HOST }}
+        run: |
+          HASH=$(git rev-parse --short HEAD)
+          nix develop --no-warn-dirty --command dagger call --progress=plain -m ci deploy-linux --source . --ssh-key env:SSH_PRIVATE_KEY --ssh-user "$SSH_USER" --ssh-host "$SSH_HOST" --commit-hash "$HASH"

-          req = urllib.request.Request(f"{api}/issues/{pr_number}/labels", headers=headers)
-          with urllib.request.urlopen(req) as r:
-              labels = [l["name"] for l in json.loads(r.read())]
+  deploy-playstore:
+    name: Build & Deploy to Play Store
+    runs-on: self-hosted
+    needs: check
+    if: github.ref == 'refs/heads/main'

-          if "automerge" not in labels:
-              print(f"PR #{pr_number}: no 'automerge' label — major update, skipping")
-              sys.exit(0)
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 50

-          body = json.dumps({"Do": "merge"}).encode()
-          req = urllib.request.Request(
-              f"{api}/pulls/{pr_number}/merge",
-              data=body, headers=headers, method="POST"
-          )
-          try:
-              with urllib.request.urlopen(req) as r:
-                  print(f"PR #{pr_number} merged successfully")
-          except urllib.error.HTTPError as e:
-              err = e.read().decode()
-              if "already been merged" in err or "has been merged" in err:
-                  print(f"PR #{pr_number} already merged — OK")
-              else:
-                  print(f"Merge failed: {err}")
-                  sys.exit(1)
-          PYEOF
+      - name: Enable Nix flakes
+        run: |
+          mkdir -p ~/.config/nix
+          echo "experimental-features = nix-command flakes" >> ~/.config/nix/nix.conf
+
+      - name: Install Android SDK (cached on runner between runs)
+        run: |
+          SDK="${ANDROID_HOME:-$HOME/Android/Sdk}"
+          if [ ! -d "$SDK/platforms/android-34" ]; then
+            echo "Android SDK not found, installing..."
+            wget -q https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip -O /tmp/cmdtools.zip
+            mkdir -p "$SDK/cmdline-tools"
+            unzip -q /tmp/cmdtools.zip -d "$SDK/cmdline-tools"
+            [ -d "$SDK/cmdline-tools/cmdline-tools" ] && mv "$SDK/cmdline-tools/cmdline-tools" "$SDK/cmdline-tools/latest"
+            yes | "$SDK/cmdline-tools/latest/bin/sdkmanager" --licenses >/dev/null 2>&1 || true
+            "$SDK/cmdline-tools/latest/bin/sdkmanager" "platform-tools" "build-tools;34.0.0" "platforms;android-34"
+          else
+            echo "Android SDK cached, skipping install."
+          fi
+
+      - name: Prepare Keystore
+        env:
+          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
+        run: |
+          if [ -n "$ANDROID_KEYSTORE_BASE64" ]; then
+            echo "$ANDROID_KEYSTORE_BASE64" | base64 -d > android/app/upload-keystore.jks
+          else
+            echo "Error: ANDROID_KEYSTORE_BASE64 secret is not set."
+            exit 1
+          fi
+
+      - name: Build & Deploy to Play Store
+        env:
+          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+          PLAY_STORE_CONFIG_JSON: ${{ secrets.PLAY_STORE_CONFIG_JSON }}
+        run: |
+          nix develop --no-warn-dirty --command dagger call --progress=plain -m ci publish-android --source . --play-store-config env:PLAY_STORE_CONFIG_JSON --keystore-password env:ANDROID_KEYSTORE_PASSWORD
+
+      - name: Build & Deploy APK to server
+        continue-on-error: true
+        env:
+          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
+          SSH_USER: ${{ secrets.SSH_USER }}
+          SSH_HOST: ${{ secrets.SSH_HOST }}
+          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+        run: |
+          HASH=$(git rev-parse --short HEAD)
+          nix develop --no-warn-dirty --command dagger call --progress=plain -m ci deploy-apk --source . --ssh-key env:SSH_PRIVATE_KEY --ssh-user "$SSH_USER" --ssh-host "$SSH_HOST" --commit-hash "$HASH" --keystore-password env:ANDROID_KEYSTORE_PASSWORD
+
+  publish-website:
+    name: Publish Website Build History
+    runs-on: self-hosted
+    needs: [build-linux, deploy-playstore]
+    if: |
+      always() &&
+      github.ref == 'refs/heads/main' &&
+      (needs.build-linux.result == 'success' || needs.deploy-playstore.result == 'success')
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Enable Nix flakes
+        run: |
+          mkdir -p ~/.config/nix
+          echo "experimental-features = nix-command flakes" >> ~/.config/nix/nix.conf
+
+      - name: Generate build history and deploy website
+        continue-on-error: true
+        env:
+          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
+          SSH_USER: ${{ secrets.SSH_USER }}
+          SSH_HOST: ${{ secrets.SSH_HOST }}
+        run: |
+          nix develop --no-warn-dirty --command dagger call --progress=plain -m ci publish-website --source . --ssh-key env:SSH_PRIVATE_KEY --ssh-user "$SSH_USER" --ssh-host "$SSH_HOST"
@@ -1,314 +0,0 @@
-name: Deploy
-
-on:
-  schedule:
-    - cron: '0 * * * *'   # every hour on the hour
-  workflow_dispatch:
-
-jobs:
-  check-changes:
-    name: Detect Changed Files
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    outputs:
-      android: ${{ steps.diff.outputs.android }}
-      linux: ${{ steps.diff.outputs.linux }}
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 2
-
-      - name: Detect Android and Linux changes
-        id: diff
-        shell: bash
-        env:
-          FORGEJO_TOKEN: ${{ github.token }}
-        run: |
-          # On workflow_dispatch always build everything
-          if [ "$GITHUB_EVENT_NAME" = "workflow_dispatch" ]; then
-            echo "android=true" >> "$GITHUB_OUTPUT"
-            echo "linux=true"   >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          HEAD_SHA=$(git rev-parse HEAD)
-
-          # Skip if this exact commit was already successfully deployed (prevents
-          # hourly schedule from redeploying the same commit on every tick).
-          LAST_DEPLOYED_SHA=$(python3 - << 'PYEOF'
-          import json, os, sys, urllib.request
-          token = os.environ.get("FORGEJO_TOKEN", "")
-          server = os.environ.get("GITHUB_SERVER_URL", "").rstrip("/")
-          repo = os.environ.get("GITHUB_REPOSITORY", "")
-          url = f"{server}/api/v1/repos/{repo}/actions/runs?workflow_id=deploy.yml&status=success&limit=5"
-          req = urllib.request.Request(url, headers={"Authorization": f"token {token}"})
-          try:
-              with urllib.request.urlopen(req) as r:
-                  data = json.loads(r.read())
-              runs = [
-                  r for r in data.get("workflow_runs", [])
-                  if r.get("workflow_id") == "deploy.yml" and r.get("status") == "success"
-              ]
-              print(runs[0].get("commit_sha") or "")
-          except Exception as e:
-              print(f"API check failed: {e}", file=sys.stderr)
-              print("")
-          PYEOF
-          )
-
-          if [ -n "$LAST_DEPLOYED_SHA" ] && [ "$HEAD_SHA" = "$LAST_DEPLOYED_SHA" ]; then
-            echo "HEAD $HEAD_SHA already successfully deployed — skipping"
-            echo "android=false" >> "$GITHUB_OUTPUT"
-            echo "linux=false"   >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          # Diff the HEAD commit against its parent; fall back to listing HEAD's files
-          # when the parent is unavailable (initial commit, shallow clone).
-          CHANGED=$(git diff --name-only HEAD~1 HEAD 2>/dev/null \
-            || git show --name-only --format= HEAD)
-
-          echo "Changed files:"
-          echo "$CHANGED"
-
-          android_re='^(android/|integration_test/|lib/|pubspec\.yaml|pubspec\.lock|drift_schemas/|scripts/deploy_playstore\.py)'
-          linux_re='^(linux/|lib/|pubspec\.yaml|pubspec\.lock)'
-
-          echo "$CHANGED" | grep -qE "$android_re" \
-            && echo "android=true" >> "$GITHUB_OUTPUT" \
-            || echo "android=false" >> "$GITHUB_OUTPUT"
-
-          echo "$CHANGED" | grep -qE "$linux_re" \
-            && echo "linux=true"   >> "$GITHUB_OUTPUT" \
-            || echo "linux=false"  >> "$GITHUB_OUTPUT"
-
-  deploy-playstore:
-    name: Build & Deploy to Play Store
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    needs: [check-changes]
-    if: needs.check-changes.outputs.android == 'true'
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 100
-
-      - name: Check runner tools
-        run: |
-          command -v dagger  >/dev/null 2>&1 || { echo "ERROR: dagger is not installed in the runner image. Add it to .forgejo/Dockerfile."; exit 1; }
-          command -v task    >/dev/null 2>&1 || { echo "ERROR: task is not installed in the runner image. Add it to .forgejo/Dockerfile."; exit 1; }
-          dpkg -s stunnel4 netcat-openbsd >/dev/null 2>&1 || { echo "ERROR: stunnel4/netcat-openbsd are not installed in the runner image. Add them to .forgejo/Dockerfile."; exit 1; }
-
-      - name: Setup Dagger Remote Engine (via stunnel)
-        env:
-          DAGGER_STUNNEL_URL: ${{ secrets.DAGGER_STUNNEL_URL }}
-          DAGGER_CA_CERT: ${{ secrets.DAGGER_CA_CERT }}
-          DAGGER_CLIENT_CERT: ${{ secrets.DAGGER_CLIENT_CERT }}
-          DAGGER_CLIENT_KEY: ${{ secrets.DAGGER_CLIENT_KEY }}
-        run: scripts/setup_dagger_remote.sh
-
-      - name: Publish Android to Play Store
-        if: ${{ secrets.PLAY_STORE_CONFIG_JSON != '' }}
-        env:
-          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
-          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
-          PLAY_STORE_CONFIG_JSON: ${{ secrets.PLAY_STORE_CONFIG_JSON }}
-          DAGGER_NO_NAG: "1"
-        run: task publish-android
-
-      - name: Cleanup TLS credentials
-        if: always()
-        run: rm -rf /tmp/dagger-tls /tmp/stunnel-dagger.conf /tmp/stunnel.pid
-
-  deploy-apk:
-    name: Build & Deploy APK to Server
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    needs: [check-changes]
-    if: needs.check-changes.outputs.android == 'true'
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 100
-
-      - name: Check runner tools
-        run: |
-          command -v dagger  >/dev/null 2>&1 || { echo "ERROR: dagger is not installed in the runner image. Add it to .forgejo/Dockerfile."; exit 1; }
-          command -v task    >/dev/null 2>&1 || { echo "ERROR: task is not installed in the runner image. Add it to .forgejo/Dockerfile."; exit 1; }
-          dpkg -s stunnel4 netcat-openbsd >/dev/null 2>&1 || { echo "ERROR: stunnel4/netcat-openbsd are not installed in the runner image. Add them to .forgejo/Dockerfile."; exit 1; }
-
-      - name: Setup Dagger Remote Engine (via stunnel)
-        env:
-          DAGGER_STUNNEL_URL: ${{ secrets.DAGGER_STUNNEL_URL }}
-          DAGGER_CA_CERT: ${{ secrets.DAGGER_CA_CERT }}
-          DAGGER_CLIENT_CERT: ${{ secrets.DAGGER_CLIENT_CERT }}
-          DAGGER_CLIENT_KEY: ${{ secrets.DAGGER_CLIENT_KEY }}
-        run: scripts/setup_dagger_remote.sh
-
-      - name: Build & Deploy APK to server
-        if: ${{ secrets.SSH_PRIVATE_KEY != '' }}
-        env:
-          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
-          SSH_KNOWN_HOSTS: ${{ secrets.SSH_KNOWN_HOSTS }}
-          SSH_USER: ${{ secrets.SSH_USER }}
-          SSH_HOST: ${{ secrets.SSH_HOST }}
-          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
-          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
-          DAGGER_NO_NAG: "1"
-        run: task deploy-apk
-
-      - name: Cleanup TLS credentials
-        if: always()
-        run: rm -rf /tmp/dagger-tls /tmp/stunnel-dagger.conf /tmp/stunnel.pid
-
-  build-linux:
-    name: Build Linux Release
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    needs: [check-changes]
-    if: needs.check-changes.outputs.linux == 'true'
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 100
-
-      - name: Check runner tools
-        run: |
-          command -v dagger  >/dev/null 2>&1 || { echo "ERROR: dagger is not installed in the runner image. Add it to .forgejo/Dockerfile."; exit 1; }
-          command -v task    >/dev/null 2>&1 || { echo "ERROR: task is not installed in the runner image. Add it to .forgejo/Dockerfile."; exit 1; }
-          dpkg -s stunnel4 netcat-openbsd >/dev/null 2>&1 || { echo "ERROR: stunnel4/netcat-openbsd are not installed in the runner image. Add them to .forgejo/Dockerfile."; exit 1; }
-
-      - name: Setup Dagger Remote Engine (via stunnel)
-        env:
-          DAGGER_STUNNEL_URL: ${{ secrets.DAGGER_STUNNEL_URL }}
-          DAGGER_CA_CERT: ${{ secrets.DAGGER_CA_CERT }}
-          DAGGER_CLIENT_CERT: ${{ secrets.DAGGER_CLIENT_CERT }}
-          DAGGER_CLIENT_KEY: ${{ secrets.DAGGER_CLIENT_KEY }}
-        run: scripts/setup_dagger_remote.sh
-
-      - name: Build & Deploy Linux to server
-        if: ${{ secrets.SSH_PRIVATE_KEY != '' }}
-        env:
-          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
-          SSH_KNOWN_HOSTS: ${{ secrets.SSH_KNOWN_HOSTS }}
-          SSH_USER: ${{ secrets.SSH_USER }}
-          SSH_HOST: ${{ secrets.SSH_HOST }}
-          DAGGER_NO_NAG: "1"
-        run: task deploy-linux
-
-      - name: Cleanup TLS credentials
-        if: always()
-        run: rm -rf /tmp/dagger-tls /tmp/stunnel-dagger.conf /tmp/stunnel.pid
-
-  publish-website:
-    name: Publish Website Build History
-    runs-on: ubuntu-latest
-    needs: [build-linux, deploy-playstore, deploy-apk]
-    if: |
-      always() &&
-      (needs.build-linux.result == 'success' || needs.deploy-playstore.result == 'success' || needs.deploy-apk.result == 'success')
-    timeout-minutes: 60
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-
-      - name: Check runner tools
-        run: |
-          command -v dagger  >/dev/null 2>&1 || { echo "ERROR: dagger is not installed in the runner image. Add it to .forgejo/Dockerfile."; exit 1; }
-          command -v task    >/dev/null 2>&1 || { echo "ERROR: task is not installed in the runner image. Add it to .forgejo/Dockerfile."; exit 1; }
-          dpkg -s stunnel4 netcat-openbsd >/dev/null 2>&1 || { echo "ERROR: stunnel4/netcat-openbsd are not installed in the runner image. Add them to .forgejo/Dockerfile."; exit 1; }
-
-      - name: Setup Dagger Remote Engine (via stunnel)
-        env:
-          DAGGER_STUNNEL_URL: ${{ secrets.DAGGER_STUNNEL_URL }}
-          DAGGER_CA_CERT: ${{ secrets.DAGGER_CA_CERT }}
-          DAGGER_CLIENT_CERT: ${{ secrets.DAGGER_CLIENT_CERT }}
-          DAGGER_CLIENT_KEY: ${{ secrets.DAGGER_CLIENT_KEY }}
-        run: scripts/setup_dagger_remote.sh
-
-      - name: Generate build history and deploy website
-        if: ${{ secrets.SSH_PRIVATE_KEY != '' }}
-        env:
-          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
-          SSH_KNOWN_HOSTS: ${{ secrets.SSH_KNOWN_HOSTS }}
-          SSH_USER: ${{ secrets.SSH_USER }}
-          SSH_HOST: ${{ secrets.SSH_HOST }}
-          DAGGER_NO_NAG: "1"
-        run: task publish-website
-
-      - name: Cleanup TLS credentials
-        if: always()
-        run: rm -rf /tmp/dagger-tls /tmp/stunnel-dagger.conf /tmp/stunnel.pid
-
-  label-deploy-health:
-    name: Update Deploy Health Label
-    runs-on: ubuntu-latest
-    needs: [deploy-playstore, deploy-apk, build-linux]
-    if: |
-      always() && vars.DEPLOY_HEALTH_ISSUE != '' && (
-        needs.deploy-playstore.result == 'success' || needs.deploy-playstore.result == 'failure' ||
-        needs.deploy-apk.result == 'success' || needs.deploy-apk.result == 'failure' ||
-        needs.build-linux.result == 'success' || needs.build-linux.result == 'failure'
-      )
-    timeout-minutes: 5
-
-    steps:
-      - name: Set CI/Full-Pass or CI/Full-Fail label on tracking issue
-        env:
-          FORGEJO_TOKEN: ${{ github.token }}
-          FORGEJO_URL: ${{ github.server_url }}
-          DEPLOY_HEALTH_ISSUE: ${{ vars.DEPLOY_HEALTH_ISSUE }}
-          ALL_SUCCEEDED: ${{ (needs.deploy-playstore.result == 'success' || needs.deploy-playstore.result == 'skipped') && (needs.deploy-apk.result == 'success' || needs.deploy-apk.result == 'skipped') && (needs.build-linux.result == 'success' || needs.build-linux.result == 'skipped') }}
-        run: |
-          python3 - << 'PYEOF'
-          import os, json, urllib.request, urllib.error
-
-          issue = os.environ.get("DEPLOY_HEALTH_ISSUE", "").strip()
-          if not issue:
-              print("DEPLOY_HEALTH_ISSUE not set; skipping")
-              raise SystemExit(0)
-
-          token = os.environ["FORGEJO_TOKEN"]
-          url_base = os.environ["FORGEJO_URL"].rstrip("/")
-          succeeded = os.environ.get("ALL_SUCCEEDED", "false").lower() == "true"
-          add_label = "CI/Full-Pass" if succeeded else "CI/Full-Fail"
-          remove_label = "CI/Full-Fail" if succeeded else "CI/Full-Pass"
-
-          headers = {"Authorization": f"token {token}", "Content-Type": "application/json"}
-          api = f"{url_base}/api/v1/repos/guettli/sharedinbox"
-
-          def api_get(path):
-              req = urllib.request.Request(f"{api}{path}", headers=headers)
-              with urllib.request.urlopen(req) as r:
-                  return json.loads(r.read())
-
-          def api_put(path, body):
-              data = json.dumps(body).encode()
-              req = urllib.request.Request(f"{api}{path}", data=data, headers=headers, method="PUT")
-              try:
-                  with urllib.request.urlopen(req) as r:
-                      return json.loads(r.read())
-              except urllib.error.HTTPError as e:
-                  print(f"PUT {path} failed: {e.read().decode()}")
-                  raise
-
-          repo_labels = api_get("/labels")
-          label_map = {l["name"]: l["id"] for l in repo_labels}
-
-          if add_label not in label_map:
-              print(f"Label '{add_label}' not found in repo — create it first")
-              raise SystemExit(1)
-
-          current = api_get(f"/issues/{issue}/labels")
-          keep_ids = [l["id"] for l in current if l["name"] not in ("CI/Full-Pass", "CI/Full-Fail")]
-          keep_ids.append(label_map[add_label])
-
-          api_put(f"/issues/{issue}/labels", {"labels": keep_ids})
-          print(f"Set '{add_label}' on issue #{issue}")
-          PYEOF
@@ -1,132 +0,0 @@
-name: Firebase Tests
-
-on:
-  schedule:
-    - cron: '0 3 * * *'   # once per day at 3 AM
-  workflow_dispatch:
-
-jobs:
-  check-changes:
-    name: Detect Firebase-Relevant Changes
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    outputs:
-      has_changes: ${{ steps.diff.outputs.has_changes }}
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Detect Firebase-relevant changes in last 24 hours
-        id: diff
-        shell: bash
-        run: |
-          # On workflow_dispatch always run
-          if [ "$GITHUB_EVENT_NAME" = "workflow_dispatch" ]; then
-            echo "has_changes=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          SINCE=$(date -u -d '24 hours ago' '+%Y-%m-%dT%H:%M:%S')
-          CHANGED=$(git log --since="$SINCE" --name-only --format= -- \
-            'android/' 'integration_test/' 'lib/' 'pubspec.yaml' 'pubspec.lock' 'drift_schemas/' \
-            | sort -u | grep -v '^$')
-
-          if [ -n "$CHANGED" ]; then
-            echo "Firebase-relevant files changed since $SINCE:"
-            echo "$CHANGED"
-            echo "has_changes=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "No Firebase-relevant changes in the last 24 hours — skipping tests"
-            echo "has_changes=false" >> "$GITHUB_OUTPUT"
-          fi
-
-  test-android-firebase:
-    name: Android Instrumented Tests (Firebase Test Lab)
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    needs: [check-changes]
-    if: needs.check-changes.outputs.has_changes == 'true'
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-
-      - name: Check runner tools
-        run: |
-          command -v dagger  >/dev/null 2>&1 || { echo "ERROR: dagger is not installed in the runner image. Add it to .forgejo/Dockerfile."; exit 1; }
-          command -v task    >/dev/null 2>&1 || { echo "ERROR: task is not installed in the runner image. Add it to .forgejo/Dockerfile."; exit 1; }
-          dpkg -s stunnel4 netcat-openbsd >/dev/null 2>&1 || { echo "ERROR: stunnel4/netcat-openbsd are not installed in the runner image. Add them to .forgejo/Dockerfile."; exit 1; }
-
-      - name: Setup Dagger Remote Engine (via stunnel)
-        env:
-          DAGGER_STUNNEL_URL: ${{ secrets.DAGGER_STUNNEL_URL }}
-          DAGGER_CA_CERT: ${{ secrets.DAGGER_CA_CERT }}
-          DAGGER_CLIENT_CERT: ${{ secrets.DAGGER_CLIENT_CERT }}
-          DAGGER_CLIENT_KEY: ${{ secrets.DAGGER_CLIENT_KEY }}
-        run: scripts/setup_dagger_remote.sh
-
-      - name: Run Android Tests on Firebase Test Lab
-        if: ${{ secrets.FIREBASE_TEST_LAB_SERVICE_ACCOUNT_KEY != '' }}
-        env:
-          FIREBASE_TEST_LAB_SERVICE_ACCOUNT_KEY: ${{ secrets.FIREBASE_TEST_LAB_SERVICE_ACCOUNT_KEY }}
-          FIREBASE_PROJECT_ID: ${{ vars.FIREBASE_PROJECT_ID }}
-          DAGGER_NO_NAG: "1"
-        run: task test-android-firebase
-
-      - name: Cleanup TLS credentials
-        if: always()
-        run: rm -rf /tmp/dagger-tls /tmp/stunnel-dagger.conf /tmp/stunnel.pid
-
-      - name: Create issue on test failure
-        if: failure()
-        env:
-          FORGEJO_TOKEN: ${{ github.token }}
-          FORGEJO_URL: ${{ github.server_url }}
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-        run: |
-          python3 - << 'PYEOF'
-          import os, json, urllib.request, urllib.error
-
-          token = os.environ["FORGEJO_TOKEN"]
-          url_base = os.environ["FORGEJO_URL"].rstrip("/")
-          run_url = os.environ["RUN_URL"]
-
-          headers = {"Authorization": f"token {token}", "Content-Type": "application/json"}
-          api = f"{url_base}/api/v1/repos/guettli/sharedinbox"
-
-          def api_get(path):
-              req = urllib.request.Request(f"{api}{path}", headers=headers)
-              with urllib.request.urlopen(req) as r:
-                  return json.loads(r.read())
-
-          def api_post(path, body):
-              data = json.dumps(body).encode()
-              req = urllib.request.Request(f"{api}{path}", data=data, headers=headers, method="POST")
-              with urllib.request.urlopen(req) as r:
-                  return json.loads(r.read())
-
-          repo_labels = api_get("/labels")
-          label_map = {l["name"]: l["id"] for l in repo_labels}
-
-          label_ids = [label_map["Ready"]] if "Ready" in label_map else []
-
-          title = "Firebase Tests failed — find root cause and fix"
-          body = (
-              "Firebase instrumented tests failed in the daily run.\n\n"
-              f"**Failed run:** {run_url}\n\n"
-              "## Steps to resolve\n\n"
-              "1. **Find the root cause**: Check the test run logs linked above and identify which test(s) failed and why.\n"
-              "2. **Fix if possible**: If the failure is caused by a code bug, create a fix. If it is a flaky or infrastructure issue, document the findings.\n"
-              "3. Close this issue once the root cause is resolved and the tests pass.\n"
-          )
-
-          issue = api_post("/issues", {
-              "title": title,
-              "body": body,
-              "labels": label_ids,
-          })
-          print(f"Created issue #{issue['number']}: {issue['html_url']}")
-          PYEOF
@@ -1,18 +0,0 @@
-name: Monitor Agent Loop
-
-on:
-  schedule:
-    - cron: '0 */2 * * *'  # every 2 hours
-  workflow_dispatch:
-
-jobs:
-  monitor:
-    name: Check Agent Loop Health
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Check agent loop heartbeat
-        run: python3 scripts/agent_loop.py monitor
@@ -1,39 +0,0 @@
-name: Renovate
-
-on:
-  schedule:
-    - cron: '0 6 * * *'
-  workflow_dispatch:
-
-jobs:
-  renovate:
-    name: Renovate
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Check runner tools
-        run: |
-          command -v dagger  >/dev/null 2>&1 || { echo "ERROR: dagger is not installed in the runner image. Add it to .forgejo/Dockerfile."; exit 1; }
-          command -v task    >/dev/null 2>&1 || { echo "ERROR: task is not installed in the runner image. Add it to .forgejo/Dockerfile."; exit 1; }
-          dpkg -s stunnel4 netcat-openbsd >/dev/null 2>&1 || { echo "ERROR: stunnel4/netcat-openbsd are not installed in the runner image. Add them to .forgejo/Dockerfile."; exit 1; }
-
-      - name: Setup Dagger Remote Engine (via stunnel)
-        env:
-          DAGGER_STUNNEL_URL: ${{ secrets.DAGGER_STUNNEL_URL }}
-          DAGGER_CA_CERT: ${{ secrets.DAGGER_CA_CERT }}
-          DAGGER_CLIENT_CERT: ${{ secrets.DAGGER_CLIENT_CERT }}
-          DAGGER_CLIENT_KEY: ${{ secrets.DAGGER_CLIENT_KEY }}
-        run: scripts/setup_dagger_remote.sh
-
-      - name: Run Renovate
-        env:
-          DAGGER_NO_NAG: "1"
-          RENOVATE_FORGEJO_TOKEN: ${{ secrets.RENOVATE_FORGEJO_TOKEN }}
-        run: task renovate
-
-      - name: Cleanup TLS credentials
-        if: always()
-        run: rm -rf /tmp/dagger-tls /tmp/stunnel-dagger.conf /tmp/stunnel.pid
@@ -12,43 +12,36 @@ on:
 jobs:
  deploy:
    name: Build & Deploy Website
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
+    runs-on: self-hosted

    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive

-      - name: Check runner tools
+      - name: Enable Nix flakes
        run: |
-          command -v dagger  >/dev/null 2>&1 || { echo "ERROR: dagger is not installed in the runner image. Add it to .forgejo/Dockerfile."; exit 1; }
-          command -v task    >/dev/null 2>&1 || { echo "ERROR: task is not installed in the runner image. Add it to .forgejo/Dockerfile."; exit 1; }
-          dpkg -s stunnel4 netcat-openbsd >/dev/null 2>&1 || { echo "ERROR: stunnel4/netcat-openbsd are not installed in the runner image. Add them to .forgejo/Dockerfile."; exit 1; }
+          mkdir -p ~/.config/nix
+          echo "experimental-features = nix-command flakes" >> ~/.config/nix/nix.conf

-      - name: Setup Dagger Remote Engine (via stunnel)
+      - name: Setup SSH
        env:
-          DAGGER_STUNNEL_URL: ${{ secrets.DAGGER_STUNNEL_URL }}
-          DAGGER_CA_CERT: ${{ secrets.DAGGER_CA_CERT }}
-          DAGGER_CLIENT_CERT: ${{ secrets.DAGGER_CLIENT_CERT }}
-          DAGGER_CLIENT_KEY: ${{ secrets.DAGGER_CLIENT_KEY }}
-        run: scripts/setup_dagger_remote.sh
+          SSH_PRIVATE_KEY: ${{ secrets.WEBSITE_SSH_PRIVATE_KEY }}
+        run: |
+          if [ -n "$SSH_PRIVATE_KEY" ]; then
+            mkdir -p ~/.ssh
+            echo "$SSH_PRIVATE_KEY" > ~/.ssh/id_rsa
+            chmod 600 ~/.ssh/id_rsa
+          else
+            echo "Error: WEBSITE_SSH_PRIVATE_KEY secret is not set."
+            exit 1
+          fi

-      - name: Build & Deploy Website
-        if: ${{ secrets.SSH_PRIVATE_KEY != '' }}
-        env:
-          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
-          SSH_KNOWN_HOSTS: ${{ secrets.SSH_KNOWN_HOSTS }}
-          SSH_USER: ${{ secrets.SSH_USER }}
-          SSH_HOST: ${{ secrets.SSH_HOST }}
-          DAGGER_NO_NAG: "1"
-        run: task publish-website
-
-      - name: Verify Website
+      - name: Deploy
        env:
+          SSH_USER: ${{ secrets.WEBSITE_SSH_USER }}
          SSH_HOST: ${{ secrets.WEBSITE_SSH_HOST }}
-        run: scripts/website-verify.sh
+        run: nix develop --command task website-deploy

-      - name: Cleanup TLS credentials
-        if: always()
-        run: rm -rf /tmp/dagger-tls /tmp/stunnel-dagger.conf /tmp/stunnel.pid
+      - name: Verify
+        run: nix develop --command task website-verify
@@ -11,6 +11,7 @@ jobs:
    name: Build & Deploy Windows (Nightly)
    runs-on: windows-runner
    if: false
+    continue-on-error: true

    steps:
      - uses: actions/checkout@v4
@@ -31,6 +32,7 @@ jobs:

      - name: Set up SSH key
        if: env.SKIP_BUILD != 'true'
+        continue-on-error: true
        env:
          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
        run: |
@@ -40,6 +42,7 @@ jobs:

      - name: Deploy Windows to server
        if: env.SKIP_BUILD != 'true'
+        continue-on-error: true
        env:
          SSH_USER: ${{ secrets.SSH_USER }}
          SSH_HOST: ${{ secrets.SSH_HOST }}
@@ -8,7 +8,7 @@ on:
 jobs:
  analyze-and-test:
    name: Analyze & unit test
-    runs-on: sharedinbox-runner
+    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
@@ -39,7 +39,7 @@ jobs:

  integration:
    name: Integration tests (Stalwart)
-    runs-on: sharedinbox-runner
+    runs-on: ubuntu-latest
    # Run integration tests only on push to main, not on every PR.
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'

@@ -74,7 +74,7 @@ jobs:

  integration-ui:
    name: UI Integration tests (Stalwart + Xvfb)
-    runs-on: sharedinbox-runner
+    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'

    steps:
@@ -124,7 +124,7 @@ jobs:

  build-linux:
    name: Build Linux desktop
-    runs-on: sharedinbox-runner
+    runs-on: ubuntu-latest
    needs: analyze-and-test

    steps:
@@ -154,7 +154,7 @@ jobs:

  deploy:
    name: Deploy Linux build & publish website
-    runs-on: sharedinbox-runner
+    runs-on: ubuntu-latest
    needs: build-linux
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    env:
@@ -202,8 +202,6 @@ jobs:
          mkdir -p ~/.ssh
          printf '%s\n' "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
-          printf '%s\n' "${{ secrets.SSH_KNOWN_HOSTS }}" >> ~/.ssh/known_hosts
-          chmod 644 ~/.ssh/known_hosts

      - name: Build Linux release
        run: |
@@ -217,20 +215,20 @@ jobs:
          REMOTE_DIR="public_html/builds/$DATE_PATH"
          TARBALL="sharedinbox-linux-amd64-$HASH.tar.gz"
          tar -czf /tmp/$TARBALL -C build/linux/x64/release bundle
-          ssh "$SSH_USER@$SSH_HOST" "mkdir -p $REMOTE_DIR"
-          scp /tmp/$TARBALL "$SSH_USER@$SSH_HOST:$REMOTE_DIR/$TARBALL"
+          ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" "mkdir -p $REMOTE_DIR"
+          scp -o StrictHostKeyChecking=no /tmp/$TARBALL "$SSH_USER@$SSH_HOST:$REMOTE_DIR/$TARBALL"
          DOWNLOAD_URL="https://sharedinbox.de/builds/$DATE_PATH/$TARBALL"
-          EXISTING=$(ssh "$SSH_USER@$SSH_HOST" \
+          EXISTING=$(ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" \
            "cat public_html/latest.json 2>/dev/null || echo '{}'")
          WINDOWS_URL=$(echo "$EXISTING" | \
            python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('windows',''))" \
            2>/dev/null || true)
          if [ -n "$WINDOWS_URL" ]; then
            echo "{\"version\":\"$HASH\",\"linux\":\"$DOWNLOAD_URL\",\"windows\":\"$WINDOWS_URL\"}" | \
-              ssh "$SSH_USER@$SSH_HOST" "cat > public_html/latest.json"
+              ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" "cat > public_html/latest.json"
          else
            echo "{\"version\":\"$HASH\",\"linux\":\"$DOWNLOAD_URL\"}" | \
-              ssh "$SSH_USER@$SSH_HOST" "cat > public_html/latest.json"
+              ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" "cat > public_html/latest.json"
          fi

      - name: Generate build history pages
@@ -246,5 +244,6 @@ jobs:
          rsync -avz --delete \
            --exclude='*.apk' \
            --exclude='*.tar.gz' \
+            -e "ssh -o StrictHostKeyChecking=no" \
            website/public/ \
            "$SSH_USER@$SSH_HOST:public_html/"
@@ -3,6 +3,7 @@ coverage/
 .dart_tool/
 .dart-tool/
 .packages
+pubspec.lock
 build/
 *.g.dart
 *.freezed.dart
@@ -28,8 +29,7 @@ android/.gradle/
 android/local.properties
 android/app/google-services.json
 android/key.properties
-# android/app/src/main/java/io/flutter/plugins/ intentionally tracked so that
-# GeneratedPluginRegistrant.java (catch Throwable) is committed and used by CI.
+android/app/src/main/java/io/flutter/plugins/
 .android/
 Android/
 .gradle/
@@ -117,8 +117,3 @@ test/widget/failures/
 dagger-certs
 .Xauthority
 .sharedinbox-agent-state.json
-
-.viminfo
-/go
-.last_deployed_sha
-.fail_count
@@ -0,0 +1,3 @@
+[submodule "website/themes/PaperMod"]
+	path = website/themes/PaperMod
+	url = https://github.com/adityatelange/hugo-PaperMod.git
@@ -30,15 +30,3 @@ repos:
        entry: bash -c 'cd "$(git rev-parse --show-toplevel)" && nix develop --command scripts/pre_commit_check.sh'
        pass_filenames: false
        always_run: true
-      - id: ci-no-direct-dagger
-        name: check for direct dagger calls in workflows (use Task instead)
-        language: system
-        entry: "bash -c 'git --no-pager grep \"dagger call\" .forgejo/workflows/ && echo \"ERROR: Direct dagger calls found in workflows. Use Taskfile instead.\" && exit 1 || exit 0'"
-        pass_filenames: false
-        always_run: true
-      - id: dagger-progress-plain
-        name: ensure all dagger calls use --progress=plain
-        language: system
-        entry: "bash -c 'git --no-pager grep \"dagger call\" -- \":!.pre-commit-config.yaml\" | grep -v \"\\-\\-progress=plain\" && echo \"ERROR: All dagger calls must include --progress=plain\" && exit 1 || exit 0'"
-        pass_filenames: false
-        always_run: true
@@ -10,21 +10,9 @@ CLI tool `fgj` is available to query issues/PRs/actions.

 We use issues, follow this label state machine:

- **State/ToPlan** — Issue needs a plan written by an agent before implementation
- **State/Planned** — Plan has been posted as a comment; awaiting human review
- **State/Ready** — Issue is approved and ready for implementation
- **State/InProgress** — Set while an agent (or human) is actively working
- **State/Question** — Agent hit a blocker or needs clarification
-
-Full lifecycle:
-
-```
-State/ToPlan → State/Planned   (automated: agent_loop.py runs a planning agent)
-State/Planned → State/Ready    (manual: human reviews the plan and approves)
-State/Ready → State/InProgress (automated: agent_loop.py before starting implementation)
-State/InProgress → closed      (automated: after PR is merged and CI passes)
-any state → State/Question     (automated or manual: when blocked)
-```
+- **State/Ready** — Issue is available to pick up
+- **State/InProgress** — Set this when you start working on an issue
+- **State/Question** — Set this when you hit a blocker or need clarification

 List open issues ready to pick up:

@@ -34,12 +22,8 @@ fgj issue list --json --state open | jq '[.[] | select(.labels[].name == "State/

 Rules:

- Never start implementation on an issue without `State/Ready`
- Planning agents only post a plan comment — they do NOT write code or open PRs
- After `State/Planned`, a human must review the plan and manually add `State/Ready`
- When working via the agent loop: label transitions are set automatically
-  by `agent_loop.py` — do **not** set them yourself.
- When working manually: switch to `State/InProgress` as your **first action**:
+- Never start work on an issue without `State/Ready`
+- Switch `State/Ready` → `State/InProgress` as your **first action** when picking up an issue — before reading any code:
  ```bash
  fgj issue edit <NUMBER> --remove-label "State/Ready" --add-label "State/InProgress"
  ```
@@ -61,29 +61,9 @@ _DAGGER_RUNNER_HOST=tcp://127.0.0.1:8080
 Once the environment is set up, you can run the Dagger pipeline. For non-interactive environments (CI, LLMs), use `--progress=plain` for readable logs:

 ```bash
-nix develop --command dagger call --progress=plain -q -m ci --source=. check
+nix develop --command dagger call --progress=plain -m ci check --source .
 ```

-## Secrets
-
-All sensitive credentials are passed as `dagger.Secret` (never as plain strings).
-This prevents values from appearing in Dagger logs or being cached in the engine.
-
-| Parameter | Functions |
-|---|---|
-| `sshKey *dagger.Secret` | `Deployer`, `GenerateBuildHistory`, `BuildWebsite`, `PublishWebsite`, `DeployLinux`, `DeployApk` |
-| `keystoreBase64 *dagger.Secret` | `setupKeystore`, `BuildAndroidApk`, `DeployApk`, `SignAndroidBundle`, `PublishAndroid` |
-| `keystorePassword *dagger.Secret` | same as above |
-| `playStoreConfig *dagger.Secret` | `UploadToPlayStore`, `PublishAndroid` |
-| `serviceAccountKey *dagger.Secret` | `TestAndroidFirebase` |
-
-Secrets are injected via `WithMountedSecret` (file-based, e.g. SSH key) or
-`WithSecretVariable` (env-var-based, e.g. keystore data, Play Store JSON).
-
-The only credentials not typed as `dagger.Secret` are the test passwords
-(`STALWART_PASS_B`, `STALWART_PASS_C`) in `WithStalwart`. These are hardcoded
-development values defined in `stalwart-dev/` — not production secrets.
-
 ## CI Integration (Codeberg/Forgejo)

 The CI workflow in `.forgejo/workflows/ci.yml` is configured to use the Dagger module located in the `ci/` directory.
@@ -91,93 +71,3 @@ The CI workflow in `.forgejo/workflows/ci.yml` is configured to use the Dagger m
 - **Check Suite:** Runs analysis and tests in parallel.
 - **Builds:** Produces Linux and Android artifacts.
 - **Caching:** When using the shared engine, CI runners benefit from the persistent cache on the host.
-
-## Credential Security — Keeping Production Secrets Off Codeberg
-
-### Problem
-
-The current setup stores two categories of secrets in Codeberg repository secrets:
-
-1. **Dagger access credentials** — TLS certificates used to connect to the remote Dagger engine via stunnel (`DAGGER_CA_CERT`, `DAGGER_CLIENT_CERT`, `DAGGER_CLIENT_KEY`, `DAGGER_STUNNEL_URL`).
-2. **Production secrets** — actual credentials for external services: `ANDROID_KEYSTORE_BASE64`, `ANDROID_KEYSTORE_PASSWORD`, `PLAY_STORE_CONFIG_JSON`, `SSH_PRIVATE_KEY`, `FIREBASE_TEST_LAB_SERVICE_ACCOUNT_KEY`.
-
-If Codeberg is compromised, both categories are leaked. The Dagger TLS certificates enable access only to the Dagger engine and have limited blast radius. But the production secrets give direct access to the Play Store, the Android signing key, the deployment server, and Firebase — a much larger blast radius.
-
-**Goal:** Keep only Dagger access credentials in Codeberg. Store all production secrets on the Dagger host machine so they never touch Codeberg.
-
-### Option 1: Runner-level environment variables
-
-Store production secrets as environment variables in the Forgejo runner's systemd service (e.g., via a `EnvironmentFile=` in the service override). The runner injects host env vars into job processes automatically. CI workflows drop the `${{ secrets.XYZ }}` references for production secrets entirely — the variables are already present in the job environment.
-
-**Pro:**
- No new infrastructure required.
- Works with the existing `dagger call --progress=plain --secret env:VAR_NAME` argument style.
- Secrets never enter Codeberg.
- Straightforward to set up on a single self-hosted runner.
-
-**Con:**
- Env vars are visible to every process on the runner host (e.g., via `/proc/<pid>/environ`).
- Rotating a secret requires host access (no API).
- Does not scale cleanly to multiple runners without a shared secrets mechanism.
-
-### Option 2: Secret files on the CI host with restricted permissions
-
-Store production secrets as files owned by the runner user with mode `600` (e.g., `/home/forgejo-runner/secrets/play_store.json`). A small setup script reads the files and either exports them as env vars or passes them directly as file-type arguments to `dagger call --progress=plain`. CI workflows contain no secret references at all.
-
-**Pro:**
- OS-level file permissions limit access to the runner user.
- Natural format for JSON payloads and key files.
- Easy to audit (list files, check mtime).
- No new infrastructure.
-
-**Con:**
- Plaintext files on disk; root or backup access exposes them.
- Workflow must know file paths (either hardcoded or by convention).
- Rotation still requires host filesystem access.
-
-### Option 3: Dagger host as pipeline orchestrator
-
-Instead of the CI runner invoking the Dagger CLI directly, the CI job sends a trigger to the Dagger host over SSH. The Dagger host runs the pipeline locally against its own environment, where secrets live as env vars or files. Codeberg only stores the SSH key to reach the Dagger host — not the production secrets.
-
-```yaml
-# CI job only does this:
- name: Trigger pipeline on Dagger host
-  run: ssh dagger-host "cd sharedinbox && task publish-android"
-  env:
-    SSH_PRIVATE_KEY: ${{ secrets.DAGGER_TRIGGER_SSH_KEY }}
-```
-
-**Pro:**
- Production secrets never leave the Dagger host.
- Codeberg stores exactly one secret: the trigger SSH key.
- All deployment logic and secrets are fully contained on the host.
-
-**Con:**
- Harder to stream structured CI logs back to Codeberg Actions.
- Dynamic context (commit SHA, PR branch) must be passed explicitly over SSH.
- The trigger SSH key still grants shell access to the host, so its compromise has its own blast radius.
- CI becomes a "fire-and-forget" call, making failure attribution harder.
-
-### Option 4: External secret manager (e.g., HashiCorp Vault)
-
-Run a secret manager co-located with the Dagger host. The CI job authenticates with a short-lived AppRole credential (stored in Codeberg) and retrieves secrets at runtime. Vault can also be configured with IP-allow-lists to further restrict who can authenticate.
-
-**Pro:**
- Full audit trail: every secret read is logged with a timestamp and caller identity.
- Fine-grained access control per secret.
- Built-in versioning and rotation support.
- Industry-standard approach; scales to team or multi-runner setups.
-
-**Con:**
- Significant additional infrastructure to install, configure, and maintain.
- Vault credentials (RoleID + SecretID) still need to be in Codeberg, though with a smaller blast radius than raw secrets.
- Vault itself becomes a security-critical single point of failure.
- Operational overhead likely disproportionate for a small single-developer project.
-
-### Recommendation
-
-**Option 1** (runner-level env vars) or **Option 2** (secret files) are the pragmatic starting point for a single self-hosted runner. They require no new infrastructure and move all production secrets off Codeberg immediately.
-
-**Option 3** (Dagger host as orchestrator) is worth considering once the trigger SSH key replaces all other secrets in Codeberg — it offers the cleanest security boundary at the cost of reduced CI observability.
-
-**Option 4** (Vault) becomes worthwhile if the project grows to multiple runners or team members who each need audited access to deploy credentials.
@@ -1,9 +1,6 @@
 version: "3"
 silent: true

-env:
-  DAGGER_NO_NAG: "1"
-
 tasks:
  default:
    desc: Run all checks (analyze + unit tests + widget tests + integration, in parallel)
@@ -175,174 +172,22 @@ tasks:
      - fvm flutter test

  test-backend:
-    desc: Backend tests against a local Stalwart mail server (via Dagger)
+    desc: Backend tests against a local Stalwart mail server
+    deps: [_flutter-check]
+    sources:
+      - lib/**/*.dart
+      - test/backend/**/*.dart
    cmds:
-      - dagger call --progress=plain -q -m ci --source=. test-backend
+      - stalwart-dev/test.sh

  integration-ui:
-    desc: UI E2E tests on Linux via Xvfb — headless, no emulator needed (via Dagger)
+    desc: UI E2E tests on Linux via Xvfb — headless, no emulator needed
+    deps: [_preflight, _linux-deps-check, _pub-get]
+    sources:
+      - lib/**/*.dart
+      - integration_test/app_e2e_test.dart
    cmds:
-      - dagger call --progress=plain -q -m ci --source=. test-integration
-
-  sync-reliability:
-    desc: Run sync reliability runner (via Dagger)
-    cmds:
-      - dagger call --progress=plain -q -m ci --source=. test-sync-reliability
-
-  test-android-firebase:
-    desc: Build Android debug APKs and run instrumented tests on Firebase Test Lab (via Dagger)
-    preconditions:
-      - sh: test -n "$FIREBASE_TEST_LAB_SERVICE_ACCOUNT_KEY"
-        msg: "FIREBASE_TEST_LAB_SERVICE_ACCOUNT_KEY is not set"
-      - sh: test -n "$FIREBASE_PROJECT_ID"
-        msg: "FIREBASE_PROJECT_ID is not set"
-    cmds:
-      - scripts/run_firebase_test.sh
-
-  ci-graph:
-    desc: Print a Mermaid diagram of the CI pipeline — paste into mermaid.live or any Markdown renderer
-    cmds:
-      - dagger call --progress=plain -q -m ci --source=. graph
-
-  stalwart:
-    desc: Start a Stalwart instance for local development (via Dagger)
-    cmds:
-      - echo "Starting Stalwart on default ports (JMAP=8080, IMAP=1430, SMTP=1025, SIEVE=4190)"
-      - dagger call --progress=plain -q -m ci --source=. stalwart up --ports 8080:8080 --ports 1430:1430 --ports 1025:1025 --ports 4190:4190
-
-  deploy-linux:
-    desc: Build and deploy Linux release via Dagger
-    preconditions:
-      - sh: test -n "$SSH_PRIVATE_KEY"
-        msg: "SSH_PRIVATE_KEY is not set"
-      - sh: test -n "$SSH_KNOWN_HOSTS"
-        msg: "SSH_KNOWN_HOSTS is not set"
-    cmds:
-      - HASH=$(git rev-parse --short HEAD) && dagger call --progress=plain -q -m ci --source=. deploy-linux --ssh-key env:SSH_PRIVATE_KEY --known-hosts env:SSH_KNOWN_HOSTS --ssh-user "$SSH_USER" --ssh-host "$SSH_HOST" --commit-hash "$HASH"
-
-  build-android-bundle:
-    desc: Build AAB via Dagger (cached, versionCode=1 placeholder) and export locally
-    cmds:
-      - mkdir -p build/app/outputs/bundle/release
-      - HASH=$(git rev-parse --short HEAD) && dagger call --progress=plain -q -m ci --source=. build-android-release --commit-hash "$HASH" -o build/app/outputs/bundle/release/app-release.aab
-
-  upload-android-bundle:
-    desc: Upload AAB from build/ to Play Store via Dagger
-    preconditions:
-      - sh: test -n "$PLAY_STORE_CONFIG_JSON"
-        msg: "PLAY_STORE_CONFIG_JSON is not set"
-      - sh: test -f build/app/outputs/bundle/release/app-release.aab
-        msg: "AAB not found — run build-android-bundle first"
-    cmds:
-      - dagger call --progress=plain -q -m ci --source=. upload-to-play-store --aab build/app/outputs/bundle/release/app-release.aab --play-store-config env:PLAY_STORE_CONFIG_JSON
-
-  publish-android:
-    desc: Build cached AAB, stamp versionCode, sign, and publish to Play Store via Dagger
-    deps: [generate-changelog]
-    preconditions:
-      - sh: test -n "$PLAY_STORE_CONFIG_JSON"
-        msg: "PLAY_STORE_CONFIG_JSON is not set"
-      - sh: test -n "$ANDROID_KEYSTORE_BASE64"
-        msg: "ANDROID_KEYSTORE_BASE64 is not set"
-      - sh: test -n "$ANDROID_KEYSTORE_PASSWORD"
-        msg: "ANDROID_KEYSTORE_PASSWORD is not set"
-    cmds:
-      - HASH=$(git rev-parse --short HEAD) && dagger call --progress=plain -q -m ci --source=. publish-android --play-store-config env:PLAY_STORE_CONFIG_JSON --keystore-base64 env:ANDROID_KEYSTORE_BASE64 --keystore-password env:ANDROID_KEYSTORE_PASSWORD --commit-hash "$HASH"
-
-  deploy-apk:
-    desc: Build and deploy Android APK via Dagger
-    preconditions:
-      - sh: test -n "$SSH_PRIVATE_KEY"
-        msg: "SSH_PRIVATE_KEY is not set"
-      - sh: test -n "$SSH_KNOWN_HOSTS"
-        msg: "SSH_KNOWN_HOSTS is not set"
-      - sh: test -n "$ANDROID_KEYSTORE_BASE64"
-        msg: "ANDROID_KEYSTORE_BASE64 is not set"
-      - sh: test -n "$ANDROID_KEYSTORE_PASSWORD"
-        msg: "ANDROID_KEYSTORE_PASSWORD is not set"
-    cmds:
-      - HASH=$(git rev-parse --short HEAD) && dagger call --progress=plain -q -m ci --source=. deploy-apk --ssh-key env:SSH_PRIVATE_KEY --known-hosts env:SSH_KNOWN_HOSTS --ssh-user "$SSH_USER" --ssh-host "$SSH_HOST" --commit-hash "$HASH" --keystore-base64 env:ANDROID_KEYSTORE_BASE64 --keystore-password env:ANDROID_KEYSTORE_PASSWORD --build-number "$(git log -1 --format=%ct HEAD)"
-
-  publish-website:
-    desc: Build and publish website via Dagger
-    preconditions:
-      - sh: test -n "$SSH_PRIVATE_KEY"
-        msg: "SSH_PRIVATE_KEY is not set"
-      - sh: test -n "$SSH_KNOWN_HOSTS"
-        msg: "SSH_KNOWN_HOSTS is not set"
-    cmds:
-      - dagger call --progress=plain -q -m ci --source=. publish-website --ssh-key env:SSH_PRIVATE_KEY --known-hosts env:SSH_KNOWN_HOSTS --ssh-user "$SSH_USER" --ssh-host "$SSH_HOST"
-
-  check-dagger:
-    desc: Run full check suite via Dagger (with OTEL timing report if python3 is available)
-    cmds:
-      - |
-        DAGGER_OUT=$(mktemp)
-        RC_FILE=$(mktemp)
-        _ts() { date -u '+[%H:%M:%S]'; }
-        run_dagger() {
-          : > "$DAGGER_OUT"; : > "$RC_FILE"
-          { timeout --kill-after=10 600 "$@"; echo $? > "$RC_FILE"; } 2>&1 | tee "$DAGGER_OUT"
-          RC=$(cat "$RC_FILE" 2>/dev/null || echo 1)
-          if [ "$RC" -eq 124 ] && grep -q "All tests passed" "$DAGGER_OUT"; then
-            echo "$(_ts) dagger: hung in teardown after success; treating as exit 0." >&2
-            RC=0
-          fi
-          return "$RC"
-        }
-        retry_dagger() {
-          for attempt in 1 2 3; do
-            run_dagger "$@" && return 0
-            RC=$?
-            if [ "$attempt" -lt 3 ] && grep -qE "connection reset|context canceled|connection refused|invalid return status code" "$DAGGER_OUT"; then
-              echo "$(_ts) dagger: network error on attempt $attempt/3, retrying..." >&2
-            elif [ "$attempt" -lt 3 ] && grep -q "No space left on device" "$DAGGER_OUT"; then
-              echo "$(_ts) dagger: disk space error on attempt $attempt/3, pruning Dagger cache..." >&2
-              dagger query '{ engine { localCache { prune(targetSpace: "20gb") } } }' 2>/dev/null || true
-              echo "$(_ts) dagger: waiting 90s for freed space to settle..." >&2
-              sleep 90
-            else
-              return "$RC"
-            fi
-          done
-        }
-        if ! command -v python3 >/dev/null 2>&1; then
-          retry_dagger dagger call --progress=plain -q -m ci --source=. check
-          RC=$?
-          rm -f "$DAGGER_OUT" "$RC_FILE"
-          exit $RC
-        fi
-        PORTFILE=$(mktemp)
-        python3 ci/otel-receiver.py --port-file="$PORTFILE" &
-        RECV_PID=$!
-        cleanup() {
-          rm -f "$PORTFILE" "$DAGGER_OUT" "$RC_FILE"
-        }
-        trap cleanup EXIT
-        until [ -s "$PORTFILE" ]; do sleep 0.05; done
-        PORT=$(cat "$PORTFILE")
-        retry_dagger env \
-          OTEL_EXPORTER_OTLP_ENDPOINT="http://127.0.0.1:$PORT" \
-          OTEL_EXPORTER_OTLP_PROTOCOL="http/protobuf" \
-          dagger call --progress=plain -q -m ci --source=. check
-        RC=$?
-        curl -sf "http://127.0.0.1:$PORT/shutdown" >/dev/null 2>&1 || true
-        wait "$RECV_PID" 2>/dev/null || true
-        exit $RC
-
-  dagger-prune:
-    desc: Prune the Dagger engine cache (keeps named volumes unless total exceeds 75 GB, then targets 50 GB)
-    cmds:
-      - |
-        dagger query '{ engine { localCache { prune(maxUsedSpace: "75gb", targetSpace: "50gb") } } }'
-
-  renovate:
-    desc: Run Renovate bot against the repository via Dagger
-    preconditions:
-      - sh: test -n "$RENOVATE_FORGEJO_TOKEN"
-        msg: "RENOVATE_FORGEJO_TOKEN is not set"
-    cmds:
-      - dagger call --progress=plain -q -m ci --source=. renovate --renovate-token env:RENOVATE_FORGEJO_TOKEN
+      - stalwart-dev/integration_ui_test.sh

  integration-android:
    desc: UI integration tests on a connected Android emulator (Stalwart on host, emulator reaches it via 10.0.2.2)
@@ -391,29 +236,25 @@ tasks:
        msg: "SSH_USER is not set"
      - sh: test -n "$SSH_HOST"
        msg: "SSH_HOST is not set"
-      - sh: test -n "$SSH_KNOWN_HOSTS"
-        msg: "SSH_KNOWN_HOSTS is not set"
    cmds:
      - |
-        mkdir -p ~/.ssh
-        printf '%s\n' "$SSH_KNOWN_HOSTS" >> ~/.ssh/known_hosts
        HASH=$(git rev-parse --short HEAD)
        DATE_PATH=$(date -u +%Y/%m/%d)
        REMOTE_DIR="public_html/builds/$DATE_PATH"
        TARBALL="sharedinbox-linux-amd64-$HASH.tar.gz"
        tar -czf /tmp/$TARBALL -C build/linux/x64/release bundle
-        ssh "$SSH_USER@$SSH_HOST" "mkdir -p $REMOTE_DIR"
-        scp /tmp/$TARBALL "$SSH_USER@$SSH_HOST:$REMOTE_DIR/$TARBALL"
+        ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" "mkdir -p $REMOTE_DIR"
+        scp -o StrictHostKeyChecking=no /tmp/$TARBALL "$SSH_USER@$SSH_HOST:$REMOTE_DIR/$TARBALL"
        DOWNLOAD_URL="https://sharedinbox.de/builds/$DATE_PATH/$TARBALL"
        # Merge with any existing latest.json so we don't overwrite the windows key
-        EXISTING=$(ssh "$SSH_USER@$SSH_HOST" "cat public_html/latest.json 2>/dev/null || echo '{}'")
+        EXISTING=$(ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" "cat public_html/latest.json 2>/dev/null || echo '{}'")
        WINDOWS_URL=$(echo "$EXISTING" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('windows',''))" 2>/dev/null || true)
        if [ -n "$WINDOWS_URL" ]; then
          echo "{\"version\":\"$HASH\",\"linux\":\"$DOWNLOAD_URL\",\"windows\":\"$WINDOWS_URL\"}" | \
-            ssh "$SSH_USER@$SSH_HOST" "cat > public_html/latest.json"
+            ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" "cat > public_html/latest.json"
        else
          echo "{\"version\":\"$HASH\",\"linux\":\"$DOWNLOAD_URL\"}" | \
-            ssh "$SSH_USER@$SSH_HOST" "cat > public_html/latest.json"
+            ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" "cat > public_html/latest.json"
        fi
        echo "Uploaded $TARBALL and updated latest.json"

@@ -438,28 +279,24 @@ tasks:
        msg: "SSH_USER is not set"
      - sh: test -n "$SSH_HOST"
        msg: "SSH_HOST is not set"
-      - sh: test -n "$SSH_KNOWN_HOSTS"
-        msg: "SSH_KNOWN_HOSTS is not set"
    cmds:
      - |
-        mkdir -p ~/.ssh
-        printf '%s\n' "$SSH_KNOWN_HOSTS" >> ~/.ssh/known_hosts
        HASH=$(git rev-parse --short HEAD)
        DATE_PATH=$(date -u +%Y/%m/%d)
        REMOTE_DIR="public_html/builds/$DATE_PATH"
        ZIPFILE="sharedinbox-windows-x64-$HASH.zip"
        cd build/windows/x64/runner && zip -r /tmp/$ZIPFILE Release/ && cd -
-        ssh "$SSH_USER@$SSH_HOST" "mkdir -p $REMOTE_DIR"
-        scp /tmp/$ZIPFILE "$SSH_USER@$SSH_HOST:$REMOTE_DIR/$ZIPFILE"
+        ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" "mkdir -p $REMOTE_DIR"
+        scp -o StrictHostKeyChecking=no /tmp/$ZIPFILE "$SSH_USER@$SSH_HOST:$REMOTE_DIR/$ZIPFILE"
        DOWNLOAD_URL="https://sharedinbox.de/builds/$DATE_PATH/$ZIPFILE"
-        EXISTING=$(ssh "$SSH_USER@$SSH_HOST" "cat public_html/latest.json 2>/dev/null || echo '{}'")
+        EXISTING=$(ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" "cat public_html/latest.json 2>/dev/null || echo '{}'")
        LINUX_URL=$(echo "$EXISTING" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('linux',''))" 2>/dev/null || true)
        if [ -n "$LINUX_URL" ]; then
          echo "{\"version\":\"$HASH\",\"linux\":\"$LINUX_URL\",\"windows\":\"$DOWNLOAD_URL\"}" | \
-            ssh "$SSH_USER@$SSH_HOST" "cat > public_html/latest.json"
+            ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" "cat > public_html/latest.json"
        else
          echo "{\"version\":\"$HASH\",\"windows\":\"$DOWNLOAD_URL\"}" | \
-            ssh "$SSH_USER@$SSH_HOST" "cat > public_html/latest.json"
+            ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" "cat > public_html/latest.json"
        fi
        echo "Uploaded $ZIPFILE and updated latest.json"

@@ -514,16 +351,16 @@ tasks:
      - ANDROID_HOME=${ANDROID_HOME:-$HOME/Android/Sdk} fvm flutter build apk --release --no-pub --dart-define=GIT_HASH=$(git rev-parse --short HEAD) | grep -Ev "was tree-shaken|Tree-shaking can be disabled"

  deploy-android-bundle:
-    desc: Build release AAB and upload to Play Store internal track (local/fvm)
-    deps: [build-android-bundle-local]
+    desc: Build release AAB and upload to Play Store internal track
+    deps: [build-android-bundle]
    preconditions:
      - sh: test -n "$PLAY_STORE_CONFIG_JSON"
        msg: "PLAY_STORE_CONFIG_JSON is not set"
    cmds:
      - python3 scripts/deploy_playstore.py

-  build-android-bundle-local:
-    desc: Build a release App Bundle (AAB) locally via fvm (not Dagger)
+  build-android-bundle:
+    desc: Build a release App Bundle (AAB)
    deps: [_preflight, _android-sdk-check, _codegen, generate-changelog]
    method: timestamp
    sources:
@@ -609,18 +446,14 @@ tasks:
        msg: "SSH_USER is not set"
      - sh: test -n "$SSH_HOST"
        msg: "SSH_HOST is not set"
-      - sh: test -n "$SSH_KNOWN_HOSTS"
-        msg: "SSH_KNOWN_HOSTS is not set"
    cmds:
      - |
-        mkdir -p ~/.ssh
-        printf '%s\n' "$SSH_KNOWN_HOSTS" >> ~/.ssh/known_hosts
        HASH=$(git rev-parse --short HEAD)
        DATE_PATH=$(date -u +%Y/%m/%d)
        REMOTE_DIR="public_html/builds/$DATE_PATH"
        APK_NAME="sharedinbox-mua-$HASH.apk"
-        ssh "$SSH_USER@$SSH_HOST" "mkdir -p $REMOTE_DIR"
-        scp \
+        ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" "mkdir -p $REMOTE_DIR"
+        scp -o StrictHostKeyChecking=no \
          build/app/outputs/flutter-apk/app-release.apk \
          "$SSH_USER@$SSH_HOST:$REMOTE_DIR/$APK_NAME"
        echo "Uploaded $APK_NAME to $REMOTE_DIR"
@@ -649,16 +482,12 @@ tasks:
  website-deploy:
    desc: Deploy the website via rsync to public_html
    deps: [website-build]
-    preconditions:
-      - sh: test -n "$SSH_KNOWN_HOSTS"
-        msg: "SSH_KNOWN_HOSTS is not set"
    cmds:
      - |
-        mkdir -p ~/.ssh
-        printf '%s\n' "$SSH_KNOWN_HOSTS" >> ~/.ssh/known_hosts
        rsync -avz --delete \
          --exclude='*.apk' \
          --exclude='*.tar.gz' \
+          -e "ssh -o StrictHostKeyChecking=no" \
          website/public/ \
          ${SSH_USER}@${SSH_HOST}:public_html/

@@ -4,6 +4,7 @@ gradle-wrapper.jar
 /gradlew
 /gradlew.bat
 /local.properties
+GeneratedPluginRegistrant.java
 .cxx/

 # Remember to never publicly share your keystore.
@@ -20,15 +20,18 @@ android {
        jvmTarget = JavaVersion.VERSION_17.toString()
    }

-    signingConfigs {
-        create("release") {
-            // Hardcoded alias matching t.sh
-            keyAlias = "upload"
-            // Use the same password for both key and keystore
-            val pass = System.getenv("ANDROID_KEYSTORE_PASSWORD")
-            storePassword = pass
-            keyPassword = pass
-            storeFile = file("upload-keystore.jks")
+    val keystoreFile = file("upload-keystore.jks")
+    val keystorePass: String? = System.getenv("ANDROID_KEYSTORE_PASSWORD")
+    val hasKeystore = keystoreFile.exists() && keystorePass != null
+
+    if (hasKeystore) {
+        signingConfigs {
+            create("release") {
+                keyAlias = "upload"
+                storePassword = keystorePass
+                keyPassword = keystorePass
+                storeFile = keystoreFile
+            }
        }
    }

@@ -44,9 +47,7 @@ android {

    buildTypes {
        release {
-            // Use the signing config defined above for release builds.
-            // If the keystore file exists (e.g. in CI or manually placed), sign it.
-            signingConfig = if (signingConfigs.getByName("release").storeFile?.exists() == true) {
+            signingConfig = if (hasKeystore) {
                signingConfigs.getByName("release")
            } else {
                signingConfigs.getByName("debug")
@@ -1,89 +0,0 @@
-package io.flutter.plugins;
-
-import androidx.annotation.Keep;
-import androidx.annotation.NonNull;
-import io.flutter.Log;
-
-import io.flutter.embedding.engine.FlutterEngine;
-
-/**
- * Generated file. Do not edit.
- * This file is generated by the Flutter tool based on the
- * plugins that support the Android platform.
- */
-@Keep
-public final class GeneratedPluginRegistrant {
-  private static final String TAG = "GeneratedPluginRegistrant";
-  public static void registerWith(@NonNull FlutterEngine flutterEngine) {
-    try {
-      flutterEngine.getPlugins().add(new dev.fluttercommunity.plus.device_info.DeviceInfoPlusPlugin());
-    } catch (Exception e) {
-      Log.e(TAG, "Error registering plugin device_info_plus, dev.fluttercommunity.plus.device_info.DeviceInfoPlusPlugin", e);
-    }
-    try {
-      flutterEngine.getPlugins().add(new com.mr.flutter.plugin.filepicker.FilePickerPlugin());
-    } catch (Exception e) {
-      Log.e(TAG, "Error registering plugin file_picker, com.mr.flutter.plugin.filepicker.FilePickerPlugin", e);
-    }
-    try {
-      flutterEngine.getPlugins().add(new com.dexterous.flutterlocalnotifications.FlutterLocalNotificationsPlugin());
-    } catch (Exception e) {
-      Log.e(TAG, "Error registering plugin flutter_local_notifications, com.dexterous.flutterlocalnotifications.FlutterLocalNotificationsPlugin", e);
-    }
-    try {
-      flutterEngine.getPlugins().add(new io.flutter.plugins.flutter_plugin_android_lifecycle.FlutterAndroidLifecyclePlugin());
-    } catch (Exception e) {
-      Log.e(TAG, "Error registering plugin flutter_plugin_android_lifecycle, io.flutter.plugins.flutter_plugin_android_lifecycle.FlutterAndroidLifecyclePlugin", e);
-    }
-    try {
-      flutterEngine.getPlugins().add(new com.it_nomads.fluttersecurestorage.FlutterSecureStoragePlugin());
-    } catch (Exception e) {
-      Log.e(TAG, "Error registering plugin flutter_secure_storage, com.it_nomads.fluttersecurestorage.FlutterSecureStoragePlugin", e);
-    }
-    try {
-      flutterEngine.getPlugins().add(new dev.flutter.plugins.integration_test.IntegrationTestPlugin());
-    } catch (Exception e) {
-      Log.e(TAG, "Error registering plugin integration_test, dev.flutter.plugins.integration_test.IntegrationTestPlugin", e);
-    }
-    try {
-      flutterEngine.getPlugins().add(new dev.steenbakker.mobile_scanner.MobileScannerPlugin());
-    } catch (Exception e) {
-      Log.e(TAG, "Error registering plugin mobile_scanner, dev.steenbakker.mobile_scanner.MobileScannerPlugin", e);
-    }
-    try {
-      flutterEngine.getPlugins().add(new com.crazecoder.openfile.OpenFilePlugin());
-    } catch (Exception e) {
-      Log.e(TAG, "Error registering plugin open_filex, com.crazecoder.openfile.OpenFilePlugin", e);
-    }
-    try {
-      flutterEngine.getPlugins().add(new dev.fluttercommunity.plus.packageinfo.PackageInfoPlugin());
-    } catch (Exception e) {
-      Log.e(TAG, "Error registering plugin package_info_plus, dev.fluttercommunity.plus.packageinfo.PackageInfoPlugin", e);
-    }
-    try {
-      flutterEngine.getPlugins().add(new io.flutter.plugins.pathprovider.PathProviderPlugin());
-    } catch (Exception e) {
-      Log.e(TAG, "Error registering plugin path_provider_android, io.flutter.plugins.pathprovider.PathProviderPlugin", e);
-    }
-    try {
-      flutterEngine.getPlugins().add(new dev.fluttercommunity.plus.share.SharePlusPlugin());
-    } catch (Exception e) {
-      Log.e(TAG, "Error registering plugin share_plus, dev.fluttercommunity.plus.share.SharePlusPlugin", e);
-    }
-    try {
-      flutterEngine.getPlugins().add(new io.flutter.plugins.urllauncher.UrlLauncherPlugin());
-    } catch (Exception e) {
-      Log.e(TAG, "Error registering plugin url_launcher_android, io.flutter.plugins.urllauncher.UrlLauncherPlugin", e);
-    }
-    try {
-      flutterEngine.getPlugins().add(new io.flutter.plugins.webviewflutter.WebViewFlutterPlugin());
-    } catch (Exception e) {
-      Log.e(TAG, "Error registering plugin webview_flutter_android, io.flutter.plugins.webviewflutter.WebViewFlutterPlugin", e);
-    }
-    try {
-      flutterEngine.getPlugins().add(new dev.fluttercommunity.workmanager.WorkmanagerPlugin());
-    } catch (Exception e) {
-      Log.e(TAG, "Error registering plugin workmanager_android, dev.fluttercommunity.workmanager.WorkmanagerPlugin", e);
-    }
-  }
-}
@@ -1,3 +1,3 @@
 org.gradle.jvmargs=-Xmx8G -XX:MaxMetaspaceSize=4G -XX:ReservedCodeCacheSize=512m -XX:+HeapDumpOnOutOfMemoryError
 android.useAndroidX=true
-org.gradle.welcome=never
+android.newDsl=false
@@ -1,195 +0,0 @@
-#!/usr/bin/env python3
-"""
-Minimal OTLP HTTP/protobuf trace receiver for Dagger CI timing.
-
-Usage:
-    python3 ci/otel-receiver.py --port-file=/tmp/otel.port
-
-Caller sets:
-    OTEL_EXPORTER_OTLP_ENDPOINT=http://127.0.0.1:<port>
-    OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf
-"""
-
-import argparse
-import signal
-import struct
-import sys
-import threading
-from http.server import BaseHTTPRequestHandler, HTTPServer
-
-
-# ── Minimal protobuf binary decoder ─────────────────────────────────────────
-# Only decodes the fields we need; skips everything else safely.
-
-def _varint(buf, pos):
-    n, shift = 0, 0
-    while pos < len(buf):
-        b = buf[pos]; pos += 1
-        n |= (b & 0x7F) << shift
-        shift += 7
-        if not (b & 0x80):
-            return n, pos
-    raise ValueError("truncated varint")
-
-
-def _fields(buf):
-    """Yield (field_num, wire_type, raw_value) for each field in a message."""
-    pos = 0
-    while pos < len(buf):
-        tag, pos = _varint(buf, pos)
-        wt, fn = tag & 7, tag >> 3
-        if wt == 0:                                          # varint
-            v, pos = _varint(buf, pos)
-        elif wt == 1:                                        # fixed64
-            v = struct.unpack_from("<Q", buf, pos)[0]; pos += 8
-        elif wt == 2:                                        # length-delimited
-            n, pos = _varint(buf, pos)
-            v = buf[pos:pos + n]; pos += n
-        elif wt == 5:                                        # fixed32
-            v = struct.unpack_from("<I", buf, pos)[0]; pos += 4
-        else:
-            break                                            # unknown: stop
-        yield fn, wt, v
-
-
-def _any_value(buf):
-    """Parse AnyValue, return (type_tag, python_value)."""
-    for fn, wt, v in _fields(buf):
-        if fn == 1 and wt == 2:                              # string_value
-            return "str", v.decode("utf-8", errors="replace")
-        if fn == 2 and wt == 0:                              # bool_value
-            return "bool", bool(v)
-        if fn == 3 and wt == 0:                              # int_value (sint64)
-            return "int", v
-        if fn == 4 and wt == 1:                              # double_value
-            return "float", struct.unpack("<d", struct.pack("<Q", v))[0]
-    return None, None
-
-
-def _keyvalue(buf):
-    key, tag, val = None, None, None
-    for fn, wt, v in _fields(buf):
-        if fn == 1 and wt == 2:
-            key = v.decode("utf-8", errors="replace")
-        elif fn == 2 and wt == 2:
-            tag, val = _any_value(v)
-    return key, tag, val
-
-
-def _span(buf):
-    name = ""
-    start_ns = end_ns = 0
-    cached = False
-    for fn, wt, v in _fields(buf):
-        if fn == 5 and wt == 2:                              # name
-            name = v.decode("utf-8", errors="replace")
-        elif fn == 7 and wt == 1:                            # start_time_unix_nano
-            start_ns = v
-        elif fn == 8 and wt == 1:                            # end_time_unix_nano
-            end_ns = v
-        elif fn == 9 and wt == 2:                            # attributes (repeated)
-            k, tag, val = _keyvalue(v)
-            if tag == "bool" and k and "cached" in k.lower():
-                cached = val
-    return {"name": name, "dur": max(0.0, (end_ns - start_ns) / 1e9), "cached": cached}
-
-
-def _decode(body):
-    spans = []
-    for fn1, wt1, rs in _fields(body):                      # resource_spans = 1
-        if fn1 != 1 or wt1 != 2:
-            continue
-        for fn2, wt2, ss in _fields(rs):                    # scope_spans = 2
-            if fn2 != 2 or wt2 != 2:
-                continue
-            for fn3, wt3, sp in _fields(ss):                # spans = 2
-                if fn3 == 2 and wt3 == 2:
-                    spans.append(_span(sp))
-    return spans
-
-
-# ── HTTP receiver ────────────────────────────────────────────────────────────
-
-_spans = []
-_lock = threading.Lock()
-
-
-class _Handler(BaseHTTPRequestHandler):
-    protocol_version = "HTTP/1.1"
-
-    def _respond(self, code, body=b""):
-        self.close_connection = True  # actually close after response, matching the header
-        self.send_response(code)
-        self.send_header("Content-Type", "application/x-protobuf")
-        self.send_header("Content-Length", str(len(body)))
-        self.send_header("Connection", "close")
-        self.end_headers()
-        if body:
-            self.wfile.write(body)
-
-    def do_GET(self):
-        if self.path != "/shutdown":
-            self._respond(404); return
-        self._respond(200, b"shutting down")
-        threading.Thread(target=self.server.shutdown, daemon=True).start()
-
-    def do_POST(self):
-        if self.path != "/v1/traces":
-            self._respond(404); return
-        n = int(self.headers.get("Content-Length", 0))
-        body = self.rfile.read(n)
-        try:
-            decoded = _decode(body)
-        except Exception as exc:
-            print(f"[otel-receiver] decode error: {exc}", file=sys.stderr, flush=True)
-            self._respond(400, str(exc).encode()); return
-        with _lock:
-            _spans.extend(decoded)
-        self._respond(200)
-
-    def log_message(self, *_):
-        pass
-
-
-# ── Timing report ────────────────────────────────────────────────────────────
-
-def _report():
-    with _lock:
-        if not _spans:
-            print("otel-receiver: no spans received", file=sys.stderr)
-            return
-        rows = sorted(_spans, key=lambda r: r["dur"], reverse=True)
-        NAME_W = 38
-        print(f'\n{"STATUS":<6}  {"DURATION":>8}  SPAN')
-        print("─" * (6 + 2 + 8 + 2 + NAME_W + 20))
-        for r in rows:
-            status = "CACHED" if r["cached"] else "LIVE"
-            name = r["name"]
-            if len(name) > NAME_W:
-                name = name[: NAME_W - 1] + "…"
-            print(f'{status:<6}  {r["dur"]:7.2f}s  {name}')
-        print(f"\n{len(rows)} spans total")
-
-
-def main():
-    ap = argparse.ArgumentParser()
-    ap.add_argument("--port-file", default="")
-    args = ap.parse_args()
-
-    server = HTTPServer(("127.0.0.1", 0), _Handler)
-    if args.port_file:
-        with open(args.port_file, "w") as f:
-            f.write(str(server.server_address[1]))
-
-    def _shutdown(sig, frame):
-        threading.Thread(target=server.shutdown, daemon=True).start()
-
-    signal.signal(signal.SIGTERM, _shutdown)
-    signal.signal(signal.SIGINT, _shutdown)
-
-    server.serve_forever()
-    _report()
-
-
-if __name__ == "__main__":
-    main()
@@ -1,21 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-REPO_DIR="$(cd "$(dirname "$0")" && pwd)"
-
-# Load .env into environment
-set -a
-# shellcheck source=.env
-source "$REPO_DIR/.env"
-set +a
-
-# SSH_PRIVATE_KEY must not live in .env (dagger parses .env and chokes on multiline values)
-export SSH_PRIVATE_KEY=$(cat "$HOME/.ssh/id_ed25519")
-
-# Add nix profile and nix store tools (task, dagger) to PATH
-export PATH="$HOME/.nix-profile/bin:$PATH"
-for pkg in "*go-task-*/bin/task" "*dagger-*/bin/dagger" "*fgj-*/bin/fgj"; do
-    bin=$(ls -d /nix/store/$pkg 2>/dev/null | sort -V | tail -1)
-    [ -n "$bin" ] && export PATH="$(dirname "$bin"):$PATH"
-done
-
-exec python3 "$REPO_DIR/deploy_cron.py"
@@ -1,55 +0,0 @@
-#!/usr/bin/env python3
-"""
-Cron deploy script for sharedinbox website.
-Runs every 5 minutes; skips if origin/main has not changed since last trigger.
-Triggers the 'Deploy Website' Forgejo Actions workflow via fgj on each new commit.
-Forgejo Actions handles failure reporting.
-"""
-import subprocess
-import sys
-from pathlib import Path
-
-REPO_DIR = Path(__file__).parent.resolve()
-SHA_FILE = REPO_DIR / '.last_deployed_sha'
-REPO = 'guettli/sharedinbox'
-
-
-def git(*args):
-    return subprocess.run(
-        ['git', *args], cwd=REPO_DIR, check=True,
-        capture_output=True, text=True,
-    ).stdout.strip()
-
-
-def read(path: Path) -> str:
-    return path.read_text().strip() if path.exists() else ''
-
-
-def main():
-    try:
-        git('fetch', 'origin', 'main')
-    except subprocess.CalledProcessError as exc:
-        print(f'git fetch failed (transient?): {exc} — skipping this run.', file=sys.stderr)
-        return
-    remote_sha = git('rev-parse', 'origin/main')
-    last_sha = read(SHA_FILE)
-
-    if remote_sha == last_sha:
-        print(f'No changes since {remote_sha[:8]}, skipping.')
-        return
-
-    print(f'New commit {remote_sha[:8]} (was {last_sha[:8] or "none"}) — triggering workflow...')
-    result = subprocess.run(
-        ['fgj', 'actions', 'workflow', 'run', 'website.yml', '-R', REPO],
-        capture_output=True, text=True,
-    )
-    if result.returncode != 0:
-        print(f'fgj workflow run failed: {result.stderr}', file=sys.stderr)
-        sys.exit(1)
-
-    SHA_FILE.write_text(remote_sha + '\n')
-    print('Workflow triggered.')
-
-
-if __name__ == '__main__':
-    main()
@@ -4,16 +4,6 @@ This file contains tasks which got implemented.

 Tasks get moved from next.md to done.md

-## Tasks (2026-05-26)
-
- **Renovate Bot (Issue #257)**: Renovate Bot runs daily via Forgejo Actions to keep
-  dependencies up to date. All required components are in main:
-  - `renovate.json` — Renovate configuration covering pub, Dockerfile, and Forgejo Actions
-  - `ci/main.go` — `Renovate()` Dagger function using Forgejo platform and Codeberg endpoint
-  - `.forgejo/workflows/renovate.yml` — daily cron (06:00 UTC) workflow
-  - `Taskfile.yml` — `renovate` task
-  - Issue #257 closed.
-
 ## Tasks (2026-05-11)

 - **Stabilize Email List UI during Selection (Issue #14)**: Prevented layout shifts when entering
@@ -29,11 +29,7 @@
          cairo
          gdk-pixbuf
          harfbuzz
-        # Dagger remote setup dependencies
-        stunnel
-        netcat
        ];
-
        fgj = pkgs.stdenv.mkDerivation {
          pname = "fgj";
          version = "0.4.0";
@@ -94,9 +90,8 @@
            sqlite
            # python3 base + Google Play API client (for scripts/deploy_playstore.py)
            (python3.withPackages (ps: with ps; [
-              google-api-python-client
-              google-auth-httplib2
-              httplib2
+              google-auth
+              requests
            ]))  # used by stalwart-dev/start and deploy_playstore.py
            fgj      # Codeberg/Forgejo CLI (like gh for GitHub)
          ]);
@@ -112,28 +112,12 @@ void main() {
  late String userPass;

  setUpAll(() {
-    const required = [
-      'STALWART_IMAP_HOST',
-      'STALWART_IMAP_PORT',
-      'STALWART_SMTP_HOST',
-      'STALWART_SMTP_PORT',
-      'STALWART_USER_B',
-      'STALWART_PASS_B',
-    ];
-    final missing = required.where((k) => Platform.environment[k] == null).toList();
-    if (missing.isNotEmpty) {
-      fail(
-        'Missing required environment variables: ${missing.join(', ')}. '
-        'This test requires a running Stalwart instance — '
-        'run via stalwart-dev/integration_ui_test.sh.',
-      );
-    }
-    imapHost = Platform.environment['STALWART_IMAP_HOST']!;
-    imapPort = int.parse(Platform.environment['STALWART_IMAP_PORT']!);
-    smtpHost = Platform.environment['STALWART_SMTP_HOST']!;
-    smtpPort = int.parse(Platform.environment['STALWART_SMTP_PORT']!);
-    userEmail = Platform.environment['STALWART_USER_B']!;
-    userPass = Platform.environment['STALWART_PASS_B']!;
+    imapHost = Platform.environment['STALWART_IMAP_HOST'] ?? '127.0.0.1';
+    imapPort = int.parse(Platform.environment['STALWART_IMAP_PORT'] ?? '1430');
+    smtpHost = Platform.environment['STALWART_SMTP_HOST'] ?? '127.0.0.1';
+    smtpPort = int.parse(Platform.environment['STALWART_SMTP_PORT'] ?? '1025');
+    userEmail = Platform.environment['STALWART_USER_B'] ?? 'alice@example.com';
+    userPass = Platform.environment['STALWART_PASS_B'] ?? 'secret';
  });

  testWidgets(
@@ -317,7 +301,7 @@ void main() {

      // ── Check Sent folder ──────────────────────────────────────────────────
      // Use the drawer to switch folders (no back button on Linux desktop).
-      await tester.tap(find.byTooltip('Open folders'));
+      await tester.tap(find.byTooltip('Open navigation menu'));
      await tester.pumpAndSettle();
      await tester.tap(find.text('Sent'));
      await tester.pumpAndSettle();
@@ -331,7 +315,7 @@ void main() {
      expect(find.text(subject), findsOneWidget);

      // ── Check Inbox ────────────────────────────────────────────────────────
-      await tester.tap(find.byTooltip('Open folders'));
+      await tester.tap(find.byTooltip('Open navigation menu'));
      await tester.pumpAndSettle();
      await tester.tap(find.text('INBOX'));
      await tester.pumpAndSettle();
@@ -1 +0,0 @@
-const int dbSchemaVersion = 34;
@@ -1,6 +0,0 @@
-enum MenuPosition { bottom, top }
-
-class UserPreferences {
-  const UserPreferences({this.menuPosition = MenuPosition.bottom});
-  final MenuPosition menuPosition;
-}
@@ -11,13 +11,4 @@ abstract class MailboxRepository {

  /// Deletes all locally-cached mailbox rows for [accountId].
  Future<void> clearForResync(String accountId);
-
-  /// Creates a new mailbox named [name] for [accountId] and tags it with
-  /// [role] in the local database. For JMAP accounts the role is also sent
-  /// to the server. Returns the newly created [Mailbox].
-  Future<Mailbox> createMailboxWithRole(
-    String accountId,
-    String name,
-    String role,
-  );
 }
@@ -19,8 +19,6 @@ class SyncLogEntry {
    required this.id,
    required this.result,
    this.errorMessage,
-    this.stackTrace,
-    this.isPermanent = false,
    required this.protocol,
    required this.emailsFetched,
    required this.emailsSkipped,
@@ -36,8 +34,6 @@ class SyncLogEntry {
  final int id;
  final String result; // 'ok' or 'error'
  final String? errorMessage;
-  final String? stackTrace;
-  final bool isPermanent;
  final String protocol; // 'imap' or 'jmap'
  final int emailsFetched;
  final int emailsSkipped;
@@ -58,8 +54,6 @@ abstract class SyncLogRepository {
    required String accountId,
    required bool success,
    String? errorMessage,
-    String? stackTrace,
-    bool isPermanent = false,
    required String protocol,
    required int emailsFetched,
    required int emailsSkipped,
@@ -87,8 +81,6 @@ class NoOpSyncLogRepository implements SyncLogRepository {
    required String accountId,
    required bool success,
    String? errorMessage,
-    String? stackTrace,
-    bool isPermanent = false,
    required String protocol,
    required int emailsFetched,
    required int emailsSkipped,
@@ -1,6 +0,0 @@
-import 'package:sharedinbox/core/models/user_preferences.dart';
-
-abstract class UserPreferencesRepository {
-  Stream<UserPreferences> observePreferences();
-  Future<void> updateMenuPosition(MenuPosition position);
-}
@@ -1,40 +1,31 @@
 import 'dart:io';

-import 'package:flutter/services.dart';
 import 'package:flutter_local_notifications/flutter_local_notifications.dart';

 const _kChannelId = 'new_mail';
 const _kChannelName = 'New mail';

 final _plugin = FlutterLocalNotificationsPlugin();
-bool _initialized = false;

 Future<void> initNotifications() async {
-  try {
-    const android = AndroidInitializationSettings('@mipmap/ic_launcher');
-    await _plugin.initialize(
-      settings: const InitializationSettings(android: android),
-      onDidReceiveNotificationResponse: (_) {},
-    );
-    await _plugin
-        .resolvePlatformSpecificImplementation<
-            AndroidFlutterLocalNotificationsPlugin>()
-        ?.requestNotificationsPermission();
-    _initialized = true;
-  } on MissingPluginException {
-    // Plugin not registered on this device; notifications silently disabled.
-  } catch (_) {
-    // Unexpected initialization failure; notifications silently disabled.
-  }
+  const android = AndroidInitializationSettings('@mipmap/ic_launcher');
+  await _plugin.initialize(
+    const InitializationSettings(android: android),
+    onDidReceiveNotificationResponse: (_) {},
+  );
+  await _plugin
+      .resolvePlatformSpecificImplementation<
+          AndroidFlutterLocalNotificationsPlugin>()
+      ?.requestNotificationsPermission();
 }

 Future<void> showNewMailNotification(String accountEmail) async {
-  if (!Platform.isAndroid || !_initialized) return;
+  if (!Platform.isAndroid) return;
  await _plugin.show(
-    id: accountEmail.hashCode & 0x7FFFFFFF,
-    title: 'New mail',
-    body: accountEmail,
-    notificationDetails: const NotificationDetails(
+    accountEmail.hashCode & 0x7FFFFFFF,
+    'New mail',
+    accountEmail,
+    const NotificationDetails(
      android: AndroidNotificationDetails(
        _kChannelId,
        _kChannelName,
@@ -4,39 +4,38 @@ import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:sharedinbox/core/models/undo_action.dart';
 import 'package:sharedinbox/di.dart';

-class UndoService extends Notifier<List<UndoAction>> {
+class UndoService extends StateNotifier<List<UndoAction>> {
+  UndoService(this._ref) : super([]);
+
+  final Ref _ref;
  static const int _maxHistory = 10;

-  // Resolves once build() has loaded persisted history.
-  late Future<void> _ready;
+  // Resolves once init() has loaded persisted history. Default to an already-
+  // resolved future so operations are safe even if init() is never called.
+  Future<void> _ready = Future.value();

-  @override
-  List<UndoAction> build() {
-    _ready = ref.read(undoRepositoryProvider).getHistory().then((history) {
-      if (ref.mounted) state = history;
+  Future<void> init() async {
+    _ready = _ref.read(undoRepositoryProvider).getHistory().then((history) {
+      if (mounted) state = history;
    });
-    return [];
+    await _ready;
  }

-  /// Waits for the persisted history to finish loading. Called by tests to
-  /// ensure the provider is ready before asserting state.
-  Future<void> init() => _ready;
-
  Future<void> pushAction(UndoAction action) async {
    await _ready;
    final newList = [...state, action];
    if (newList.length > _maxHistory) {
      final removed = newList.removeAt(0);
-      await ref.read(undoRepositoryProvider).deleteAction(removed.id);
+      await _ref.read(undoRepositoryProvider).deleteAction(removed.id);
    }
    state = newList;
-    await ref.read(undoRepositoryProvider).saveAction(action);
+    await _ref.read(undoRepositoryProvider).saveAction(action);
  }

  Future<void> clear() async {
    await _ready;
    state = [];
-    unawaited(ref.read(undoRepositoryProvider).clearHistory());
+    unawaited(_ref.read(undoRepositoryProvider).clearHistory());
  }

  Future<void> undo({String? actionId}) async {
@@ -58,7 +57,7 @@ class UndoService extends Notifier<List<UndoAction>> {
    // happened and retry if the undo failed (e.g. after an IMAP sync reverted
    // the local change). The inverse action added below allows undoing the undo.

-    final repo = ref.read(emailRepositoryProvider);
+    final repo = _ref.read(emailRepositoryProvider);

    for (final id in action.emailIds) {
      // 1. Try to cancel the original change (if not started yet).
@@ -1,7 +1,6 @@
 import 'dart:async';

 import 'package:enough_mail/enough_mail.dart' as imap;
-import 'package:flutter/services.dart' show MissingPluginException;
 import 'package:sharedinbox/core/models/account.dart';
 import 'package:sharedinbox/core/models/email.dart' show SyncEmailsResult;
 import 'package:sharedinbox/core/repositories/account_repository.dart';
@@ -260,8 +259,6 @@ class _AccountSync implements _SyncLoop {
            accountId: account.id,
            success: false,
            errorMessage: e.toString(),
-            stackTrace: st.toString(),
-            isPermanent: isPermanent,
            protocol: 'imap',
            emailsFetched: 0,
            emailsSkipped: 0,
@@ -297,7 +294,6 @@ class _AccountSync implements _SyncLoop {

  bool _isPermanentError(Object e) {
    if (isTlsConfigError(e)) return true;
-    if (e is MissingPluginException) return true;
    final s = e.toString().toLowerCase();
    // enough_mail doesn't always have typed exceptions for auth, so we check strings.
    return s.contains('invalid credentials') ||
@@ -515,8 +511,6 @@ class _JmapAccountSync implements _SyncLoop {
            accountId: account.id,
            success: false,
            errorMessage: e.toString(),
-            stackTrace: st.toString(),
-            isPermanent: isPermanent,
            protocol: 'jmap',
            emailsFetched: 0,
            emailsSkipped: 0,
@@ -552,7 +546,6 @@ class _JmapAccountSync implements _SyncLoop {

  bool _isPermanentError(Object e) {
    if (isTlsConfigError(e)) return true;
-    if (e is MissingPluginException) return true;
    final s = e.toString().toLowerCase();
    return s.contains('invalid credentials') ||
        s.contains('authentication failed') ||
@@ -5,8 +5,6 @@ import 'dart:io';
 import 'package:drift/drift.dart';
 import 'package:drift/native.dart';
 import 'package:enough_mail/enough_mail.dart' as imap;
-import 'package:flutter/services.dart';
-import 'package:flutter/widgets.dart';
 import 'package:path/path.dart' as p;
 import 'package:path_provider/path_provider.dart';

@@ -25,9 +23,6 @@ const _kResourceType = 'background_check';

@pragma('vm:entry-point')
 void callbackDispatcher() {
-  // Required so that path_provider and other plugins are available in this
-  // background isolate (issue #192).
-  WidgetsFlutterBinding.ensureInitialized();
  Workmanager().executeTask((_, __) async {
    try {
      await _doBackgroundSync();
@@ -37,22 +32,14 @@ void callbackDispatcher() {
 }

 Future<void> registerBackgroundSync() async {
-  try {
-    await Workmanager().initialize(callbackDispatcher);
-    await Workmanager().registerPeriodicTask(
-      _kTaskName,
-      _kTaskName,
-      frequency: const Duration(minutes: 15),
-      constraints: Constraints(networkType: NetworkType.connected),
-      existingWorkPolicy: ExistingPeriodicWorkPolicy.keep,
-    );
-  } on PlatformException {
-    // WorkManager channel unavailable on this device; background sync disabled.
-  } on MissingPluginException {
-    // Plugin not registered on this device; background sync disabled.
-  } catch (_) {
-    // Unexpected initialization failure; background sync disabled.
-  }
+  await Workmanager().initialize(callbackDispatcher);
+  await Workmanager().registerPeriodicTask(
+    _kTaskName,
+    _kTaskName,
+    frequency: const Duration(minutes: 15),
+    constraints: Constraints(networkType: NetworkType.connected),
+    existingWorkPolicy: ExistingPeriodicWorkPolicy.keep,
+  );
 }

 Future<void> _doBackgroundSync() async {
@@ -3,10 +3,8 @@ import 'dart:io';

 import 'package:drift/drift.dart';
 import 'package:drift/native.dart';
-import 'package:flutter/services.dart';
 import 'package:path/path.dart' as p;
 import 'package:path_provider/path_provider.dart';
-import 'package:sharedinbox/core/db_schema_version.dart';

 part 'database.g.dart';

@@ -193,9 +191,6 @@ class SyncLogs extends Table {
  DateTimeColumn get finishedAt => dateTime()();
  // Added in schema v13: raw protocol log when account.verbose == true.
  TextColumn get protocolLog => text().nullable()();
-  // Added in schema v33: stack trace and permanent flag for error entries.
-  TextColumn get errorStackTrace => text().nullable()();
-  BoolColumn get isPermanent => boolean().withDefault(const Constant(false))();
 }

 /// Per-mailbox breakdown for a single sync cycle.
@@ -307,17 +302,6 @@ class LocalSieveApplied extends Table {
  Set<Column> get primaryKey => {accountId, messageId};
 }

-/// App-wide user preferences, stored as a singleton row (id always 1).
-@DataClassName('UserPreferencesRow')
-class UserPreferences extends Table {
-  IntColumn get id => integer()();
-  // 'bottom' (default) | 'top'
-  TextColumn get menuPosition => text().withDefault(const Constant('bottom'))();
-
-  @override
-  Set<Column> get primaryKey => {id};
-}
-
 // ── Database ──────────────────────────────────────────────────────────────────

@DriftDatabase(
@@ -338,14 +322,13 @@ class UserPreferences extends Table {
    LocalSieveScripts,
    LocalSieveApplied,
    ShareKeys,
-    UserPreferences,
  ],
 )
 class AppDatabase extends _$AppDatabase {
  AppDatabase([QueryExecutor? executor]) : super(executor ?? _openConnection());

  @override
-  int get schemaVersion => dbSchemaVersion;
+  int get schemaVersion => 32;

  Future<void> _createEmailFts() async {
    await customStatement('''
@@ -586,13 +569,6 @@ class AppDatabase extends _$AppDatabase {
          if (from < 32) {
            await m.createTable(localSieveApplied);
          }
-          if (from >= 7 && from < 33) {
-            await m.addColumn(syncLogs, syncLogs.errorStackTrace);
-            await m.addColumn(syncLogs, syncLogs.isPermanent);
-          }
-          if (from < 34) {
-            await m.createTable(userPreferences);
-          }
        },
      );
 }
@@ -602,96 +578,20 @@ String? _dbPath;

 /// Call after WidgetsFlutterBinding.ensureInitialized() so that the
 /// path_provider plugin channel is registered before the first DB access.
-/// On some Android versions the Pigeon channel is not ready at the very
-/// start of main(); if it fails, _openConnection() retries lazily.
 Future<void> initDatabasePath() async {
-  try {
-    final dir = await getApplicationSupportDirectory();
-    _dbPath = p.join(dir.path, 'sharedinbox.db');
-  } on PlatformException {
-    // Channel not yet established; LazyDatabase will resolve the path
-    // on first access, after runApp() completes initialization.
-  }
+  final dir = await getApplicationSupportDirectory();
+  _dbPath = p.join(dir.path, 'sharedinbox.db');
 }

-/// Resolve the application support path, retrying on PlatformException to
-/// survive a race where the path_provider Pigeon channel isn't ready yet.
-Future<String> _resolveDatabasePath() async {
-  if (_dbPath != null) return _dbPath!;
-  // initDatabasePath() failed (channel not ready before runApp). Retry now
-  // that the engine is fully initialised, with back-off. Some slow Android
-  // devices need several seconds for the Pigeon channel to become ready
-  // (issue #166), so use a longer schedule than the initial attempt.
-  const delays = [200, 500, 1000, 2000, 4000];
-  for (final ms in delays) {
-    try {
-      final dir = await getApplicationSupportDirectory();
-      _dbPath = p.join(dir.path, 'sharedinbox.db');
-      return _dbPath!;
-    } on PlatformException {
-      await Future<void>.delayed(Duration(milliseconds: ms));
-    }
-  }
-  // On Android, path_provider can be permanently broken on some devices
-  // regardless of how long we wait (issue #192).  Derive the path from
-  // /proc/self/cmdline (the Android process name == package name) without
-  // a platform channel as a last resort so the app can still open its DB.
-  if (Platform.isAndroid) {
-    final fallback = await _androidFallbackPath();
-    if (fallback != null) {
-      _dbPath = fallback;
-      return _dbPath!;
-    }
-  }
-  throw PlatformException(
-    code: 'channel-error',
-    message: 'path_provider unavailable after ${delays.length + 1} attempts — '
-        'cannot open database.',
-  );
-}
-
-// Reads /proc/self/cmdline to extract the Android package name, then
-// constructs the standard app files-dir path without a platform channel.
-// Returns null when the path cannot be determined or created.
-Future<String?> _androidFallbackPath() async {
-  try {
-    final bytes = await File('/proc/self/cmdline').readAsBytes();
-    final end = bytes.indexOf(0);
-    final packageName = String.fromCharCodes(
-      end >= 0 ? bytes.sublist(0, end) : bytes,
-    ).trim();
-    // A valid Android package name contains dots but not slashes.
-    if (packageName.isEmpty ||
-        !packageName.contains('.') ||
-        packageName.contains('/')) {
-      return null;
-    }
-    for (final base in [
-      '/data/user/0/$packageName/files',
-      '/data/data/$packageName/files',
-    ]) {
-      try {
-        await Directory(base).create(recursive: true);
-        return p.join(base, 'sharedinbox.db');
-      } catch (_) {
-        continue;
-      }
-    }
-    return null;
-  } catch (_) {
-    return null;
-  }
-}
-
-// These functions are only called from unit tests (database_path_test.dart).
-// They expose internals that cannot be reached via the public API.
-Future<String> resolveDatabasePathForTesting() => _resolveDatabasePath();
-void resetDatabasePathForTesting() => _dbPath = null;
-Future<String?> androidFallbackPathForTesting() => _androidFallbackPath();
-
 LazyDatabase _openConnection() {
  return LazyDatabase(() async {
-    final file = File(await _resolveDatabasePath());
+    final file = File(
+      _dbPath ??
+          p.join(
+            (await getApplicationSupportDirectory()).path,
+            'sharedinbox.db',
+          ),
+    );
    return NativeDatabase.createInBackground(
      file,
      setup: (db) {
@@ -79,14 +79,6 @@ class MailboxRepositoryImpl implements MailboxRepository {
    );
    try {
      final mailboxes = await client.listMailboxes(recursive: true);
-
-      // Pre-load existing DB roles so we can preserve manually-set roles for
-      // folders the server doesn't tag with a special-use attribute.
-      final existingRows = await (_db.select(_db.mailboxes)
-            ..where((t) => t.accountId.equals(account.id)))
-          .get();
-      final existingRoles = {for (final r in existingRows) r.id: r.role};
-
      for (final mb in mailboxes) {
        final path = mb.path;
        final id = '${account.id}:$path';
@@ -104,12 +96,6 @@ class MailboxRepositoryImpl implements MailboxRepository {
          log('STATUS skipped for $path: $e');
        }

-        // Use the server-assigned role when available; fall back to the
-        // existing DB role so that manually-created folders (e.g. a user
-        // who just created their Archive folder) keep their role across syncs
-        // when the IMAP server does not expose a special-use attribute.
-        final role = _imapRole(mb) ?? existingRoles[id];
-
        await _db.into(_db.mailboxes).insertOnConflictUpdate(
              MailboxesCompanion.insert(
                id: id,
@@ -118,7 +104,7 @@ class MailboxRepositoryImpl implements MailboxRepository {
                name: mb.name,
                unreadCount: Value(unread),
                totalCount: Value(total),
-                role: Value(role),
+                role: Value(_imapRole(mb)),
              ),
            );
      }
@@ -324,104 +310,4 @@ class MailboxRepositoryImpl implements MailboxRepository {
          ..where((t) => t.accountId.equals(accountId)))
        .go();
  }
-
-  @override
-  Future<model.Mailbox> createMailboxWithRole(
-    String accountId,
-    String name,
-    String role,
-  ) async {
-    final account = (await _accounts.getAccount(accountId))!;
-    final password = await _accounts.getPassword(accountId);
-    switch (account.type) {
-      case account_model.AccountType.imap:
-        return _createMailboxWithRoleImap(account, password, name, role);
-      case account_model.AccountType.jmap:
-        return _createMailboxWithRoleJmap(account, password, name, role);
-    }
-  }
-
-  Future<model.Mailbox> _createMailboxWithRoleImap(
-    account_model.Account account,
-    String password,
-    String name,
-    String role,
-  ) async {
-    final client = await _imapConnect(
-      account,
-      _effectiveUsername(account),
-      password,
-    );
-    try {
-      await client.createMailbox(name);
-    } finally {
-      await client.logout();
-    }
-    final id = '${account.id}:$name';
-    await _db.into(_db.mailboxes).insertOnConflictUpdate(
-          MailboxesCompanion.insert(
-            id: id,
-            accountId: account.id,
-            path: name,
-            name: name,
-            role: Value(role),
-          ),
-        );
-    final row = await (_db.select(_db.mailboxes)..where((t) => t.id.equals(id)))
-        .getSingle();
-    return _toModel(row);
-  }
-
-  Future<model.Mailbox> _createMailboxWithRoleJmap(
-    account_model.Account account,
-    String password,
-    String name,
-    String role,
-  ) async {
-    final jmapUrl = account.jmapUrl;
-    if (jmapUrl == null || jmapUrl.isEmpty) {
-      throw Exception('JMAP account ${account.id} has no jmapUrl');
-    }
-    final jmap = await JmapClient.connect(
-      httpClient: _httpClient,
-      jmapUrl: Uri.parse(jmapUrl),
-      username: _effectiveUsername(account),
-      password: password,
-    );
-    final responses = await jmap.call([
-      [
-        'Mailbox/set',
-        {
-          'accountId': jmap.accountId,
-          'create': {
-            'new-mailbox': {'name': name, 'role': role},
-          },
-        },
-        '0',
-      ],
-    ]);
-    final result = _responseArgs(responses, 0, 'Mailbox/set');
-    final created = result['created'] as Map<String, dynamic>?;
-    final newId =
-        (created?['new-mailbox'] as Map<String, dynamic>?)?['id'] as String?;
-    if (newId == null) {
-      throw Exception(
-        'Failed to create mailbox "$name": server returned no ID',
-      );
-    }
-    final dbId = '${account.id}:$newId';
-    await _db.into(_db.mailboxes).insertOnConflictUpdate(
-          MailboxesCompanion.insert(
-            id: dbId,
-            accountId: account.id,
-            path: newId,
-            name: name,
-            role: Value(role),
-          ),
-        );
-    final row = await (_db.select(_db.mailboxes)
-          ..where((t) => t.id.equals(dbId)))
-        .getSingle();
-    return _toModel(row);
-  }
 }
@@ -13,8 +13,6 @@ class SyncLogRepositoryImpl implements SyncLogRepository {
    required String accountId,
    required bool success,
    String? errorMessage,
-    String? stackTrace,
-    bool isPermanent = false,
    required String protocol,
    required int emailsFetched,
    required int emailsSkipped,
@@ -32,8 +30,6 @@ class SyncLogRepositoryImpl implements SyncLogRepository {
              accountId: accountId,
              result: success ? 'ok' : 'error',
              errorMessage: Value(errorMessage),
-              errorStackTrace: Value(stackTrace),
-              isPermanent: Value(isPermanent),
              protocol: Value(protocol),
              itemsSynced: Value(emailsFetched),
              emailsSkipped: Value(emailsSkipped),
@@ -79,8 +75,6 @@ class SyncLogRepositoryImpl implements SyncLogRepository {
            id: r.id,
            result: r.result,
            errorMessage: r.errorMessage,
-            stackTrace: r.errorStackTrace,
-            isPermanent: r.isPermanent,
            protocol: r.protocol,
            emailsFetched: r.itemsSynced,
            emailsSkipped: r.emailsSkipped,
@@ -1,38 +0,0 @@
-import 'package:drift/drift.dart';
-import 'package:sharedinbox/core/models/user_preferences.dart' as pref;
-import 'package:sharedinbox/core/repositories/user_preferences_repository.dart';
-import 'package:sharedinbox/data/db/database.dart';
-
-class UserPreferencesRepositoryImpl implements UserPreferencesRepository {
-  UserPreferencesRepositoryImpl(this._db);
-
-  final AppDatabase _db;
-  static const _rowId = 1;
-
-  @override
-  Stream<pref.UserPreferences> observePreferences() {
-    return (_db.select(_db.userPreferences)..where((t) => t.id.equals(_rowId)))
-        .watchSingleOrNull()
-        .map(_rowToModel);
-  }
-
-  @override
-  Future<void> updateMenuPosition(pref.MenuPosition position) async {
-    await _db.into(_db.userPreferences).insertOnConflictUpdate(
-          UserPreferencesCompanion(
-            id: const Value(_rowId),
-            menuPosition: Value(position.name),
-          ),
-        );
-  }
-
-  static pref.UserPreferences _rowToModel(UserPreferencesRow? row) {
-    if (row == null) return const pref.UserPreferences();
-    return pref.UserPreferences(
-      menuPosition: pref.MenuPosition.values.firstWhere(
-        (e) => e.name == row.menuPosition,
-        orElse: () => pref.MenuPosition.bottom,
-      ),
-    );
-  }
-}
@@ -5,16 +5,13 @@ import 'package:http/http.dart' as http;
 import 'package:sharedinbox/core/models/account.dart' as model;
 import 'package:sharedinbox/core/models/email.dart';
 import 'package:sharedinbox/core/models/undo_action.dart';
-import 'package:sharedinbox/core/models/user_preferences.dart';
 import 'package:sharedinbox/core/repositories/account_repository.dart';
 import 'package:sharedinbox/core/repositories/draft_repository.dart';
 import 'package:sharedinbox/core/repositories/email_repository.dart';
 import 'package:sharedinbox/core/repositories/mailbox_repository.dart';
 import 'package:sharedinbox/core/repositories/search_history_repository.dart';
 import 'package:sharedinbox/core/repositories/share_key_repository.dart';
-import 'package:sharedinbox/core/repositories/sync_log_repository.dart';
 import 'package:sharedinbox/core/repositories/undo_repository.dart';
-import 'package:sharedinbox/core/repositories/user_preferences_repository.dart';
 import 'package:sharedinbox/core/services/account_discovery_service.dart';
 import 'package:sharedinbox/core/services/connection_test_service.dart';
 import 'package:sharedinbox/core/services/managesieve_probe_service.dart';
@@ -23,8 +20,7 @@ import 'package:sharedinbox/core/services/undo_service.dart';
 import 'package:sharedinbox/core/storage/secure_storage.dart';
 import 'package:sharedinbox/core/sync/account_sync_manager.dart';
 import 'package:sharedinbox/core/sync/reliability_runner.dart';
-import 'package:sharedinbox/data/db/database.dart'
-    hide Email, EmailBody, UserPreferences;
+import 'package:sharedinbox/data/db/database.dart' hide Email, EmailBody;
 import 'package:sharedinbox/data/db/local_sieve_repository.dart';
 import 'package:sharedinbox/data/imap/imap_client_factory.dart';
 import 'package:sharedinbox/data/jmap/sieve_repository.dart';
@@ -36,7 +32,6 @@ import 'package:sharedinbox/data/repositories/search_history_repository_impl.dar
 import 'package:sharedinbox/data/repositories/share_key_repository_impl.dart';
 import 'package:sharedinbox/data/repositories/sync_log_repository_impl.dart';
 import 'package:sharedinbox/data/repositories/undo_repository_impl.dart';
-import 'package:sharedinbox/data/repositories/user_preferences_repository_impl.dart';
 import 'package:sharedinbox/data/storage/flutter_secure_storage_impl.dart';

 /// Swappable IMAP connection factory — override in tests to use plaintext.
@@ -106,7 +101,7 @@ final searchHistoryRepositoryProvider =
  return SearchHistoryRepositoryImpl(ref.watch(dbProvider));
 });

-final syncLogRepositoryProvider = Provider<SyncLogRepository>((ref) {
+final syncLogRepositoryProvider = Provider((ref) {
  return SyncLogRepositoryImpl(ref.watch(dbProvider));
 });

@@ -186,7 +181,11 @@ final manageSieveProbeServiceProvider = Provider<ManageSieveProbeService>((
 });

 final undoServiceProvider =
-    NotifierProvider<UndoService, List<UndoAction>>(UndoService.new);
+    StateNotifierProvider<UndoService, List<UndoAction>>((ref) {
+  final service = UndoService(ref);
+  unawaited(service.init());
+  return service;
+});

 /// Loads email header + body and marks the email as seen.
 /// Owned by [EmailDetailScreen]; decouples data loading from the widget tree.
@@ -195,18 +194,16 @@ final emailDetailProvider = AsyncNotifierProvider.autoDispose
  EmailDetailNotifier.new,
 );

-class EmailDetailNotifier extends AsyncNotifier<(Email?, EmailBody)> {
-  EmailDetailNotifier(this._emailId);
-  final String _emailId;
-
+class EmailDetailNotifier
+    extends AutoDisposeFamilyAsyncNotifier<(Email?, EmailBody), String> {
  @override
-  Future<(Email?, EmailBody)> build() async {
+  Future<(Email?, EmailBody)> build(String emailId) async {
    final repo = ref.read(emailRepositoryProvider);
    final results = await Future.wait([
-      repo.getEmail(_emailId),
-      repo.getEmailBody(_emailId),
+      repo.getEmail(emailId),
+      repo.getEmailBody(emailId),
    ]);
-    unawaited(repo.setFlag(_emailId, seen: true));
+    unawaited(repo.setFlag(emailId, seen: true));
    return (results[0] as Email?, results[1] as EmailBody);
  }
 }
@@ -231,13 +228,3 @@ final accountConnectionStatusProvider =
      .read(connectionTestServiceProvider)
      .testConnection(account, password);
 });
-
-final userPreferencesRepositoryProvider =
-    Provider<UserPreferencesRepository>((ref) {
-  return UserPreferencesRepositoryImpl(ref.watch(dbProvider));
-});
-
-final userPreferencesProvider =
-    StreamProvider.autoDispose<UserPreferences>((ref) {
-  return ref.watch(userPreferencesRepositoryProvider).observePreferences();
-});
@@ -3,7 +3,6 @@ import 'dart:io';

 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
-import 'package:flutter_riverpod/misc.dart' show Override;

 import 'package:sharedinbox/core/services/notification_service.dart';
 import 'package:sharedinbox/core/sync/background_sync.dart';
@@ -20,7 +20,6 @@ import 'package:sharedinbox/ui/screens/sieve_scripts_screen.dart';
 import 'package:sharedinbox/ui/screens/sync_log_screen.dart';
 import 'package:sharedinbox/ui/screens/thread_detail_screen.dart';
 import 'package:sharedinbox/ui/screens/undo_log_screen.dart';
-import 'package:sharedinbox/ui/screens/user_preferences_screen.dart';
 import 'package:sharedinbox/ui/widgets/undo_shell.dart';

 final router = GoRouter(
@@ -57,10 +56,6 @@ final router = GoRouter(
              path: 'about',
              builder: (ctx, state) => const AboutScreen(),
            ),
-            GoRoute(
-              path: 'preferences',
-              builder: (ctx, state) => const UserPreferencesScreen(),
-            ),
            GoRoute(
              path: ':accountId/edit',
              builder: (ctx, state) => EditAccountScreen(
@@ -1,13 +1,13 @@
 import 'dart:async';
+import 'dart:io';

 import 'package:flutter/material.dart';
 import 'package:flutter/services.dart';
-import 'package:flutter_markdown_plus/flutter_markdown_plus.dart';
+import 'package:flutter_markdown/flutter_markdown.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:package_info_plus/package_info_plus.dart';
 import 'package:sharedinbox/core/models/account.dart';
 import 'package:sharedinbox/di.dart';
-import 'package:sharedinbox/ui/utils/about_markdown.dart';
 import 'package:url_launcher/url_launcher.dart';

 class AboutScreen extends ConsumerStatefulWidget {
@@ -19,22 +19,53 @@ class AboutScreen extends ConsumerStatefulWidget {

 class _AboutScreenState extends ConsumerState<AboutScreen> {
  final Future<PackageInfo> _packageInfoFuture = PackageInfo.fromPlatform();
-  late final Future<String?> _deviceModelFuture;
  late final Stream<List<Account>> _accountsStream;
-  String? _deviceModel;
+
+  static const _gitHash = String.fromEnvironment('GIT_HASH');

  @override
  void initState() {
    super.initState();
    _accountsStream = ref.read(accountRepositoryProvider).observeAccounts();
-    _deviceModelFuture = getDeviceModel();
-    unawaited(
-      _deviceModelFuture.then((model) {
-        if (mounted) setState(() => _deviceModel = model);
-      }),
-    );
  }

+  String _buildMarkdown(
+    BuildContext context,
+    PackageInfo? pkg,
+    int imapCount,
+    int jmapCount,
+  ) {
+    final size = MediaQuery.of(context).size;
+    final pixelRatio = MediaQuery.of(context).devicePixelRatio;
+    final physW = (size.width * pixelRatio).toInt();
+    final physH = (size.height * pixelRatio).toInt();
+    final version =
+        pkg != null ? '${pkg.version}+${pkg.buildNumber}' : 'unknown';
+    final versionDisplay = _gitHash.isNotEmpty
+        ? '[$version](https://codeberg.org/guettli/sharedinbox/commit/$_gitHash)'
+        : version;
+    final osName = _capitalize(Platform.operatingSystem);
+    final isDark = MediaQuery.of(context).platformBrightness == Brightness.dark;
+
+    return '## sharedinbox.de\n\n'
+        '| Property | Value |\n'
+        '|----------|-------|\n'
+        '| App Version | $versionDisplay |\n'
+        '| Platform | ${Platform.operatingSystem} |\n'
+        '| $osName Version | ${Platform.operatingSystemVersion} |\n'
+        '| Resolution | ${physW}x$physH px'
+        ' (logical: ${size.width.toInt()}x${size.height.toInt()} pt,'
+        ' ratio: ${pixelRatio.toStringAsFixed(1)}x) |\n'
+        '| Dart Version | ${Platform.version.split(' ').first} |\n'
+        '| Processors | ${Platform.numberOfProcessors} |\n'
+        '| Dark Mode | ${isDark ? 'yes' : 'no'} |\n'
+        '| IMAP Accounts | $imapCount |\n'
+        '| JMAP Accounts | $jmapCount |\n';
+  }
+
+  static String _capitalize(String s) =>
+      s.isEmpty ? s : '${s[0].toUpperCase()}${s.substring(1)}';
+
  Future<void> _copyToClipboard(
    BuildContext context,
    int imapCount,
@@ -44,20 +75,10 @@ class _AboutScreenState extends ConsumerState<AboutScreen> {
    try {
      pkg = await _packageInfoFuture;
    } catch (_) {}
-    String? deviceModel;
-    try {
-      deviceModel = await _deviceModelFuture;
-    } catch (_) {}
    if (!context.mounted) return;
    await Clipboard.setData(
      ClipboardData(
-        text: buildAboutMarkdown(
-          context: context,
-          pkg: pkg,
-          imapCount: imapCount,
-          jmapCount: jmapCount,
-          deviceModel: deviceModel,
-        ),
+        text: _buildMarkdown(context, pkg, imapCount, jmapCount),
      ),
    );
    if (context.mounted) {
@@ -70,30 +91,6 @@ class _AboutScreenState extends ConsumerState<AboutScreen> {
    }
  }

-  Future<void> _launchUrl(BuildContext context, Uri url) async {
-    try {
-      final launched =
-          await launchUrl(url, mode: LaunchMode.externalApplication);
-      if (!launched && context.mounted) {
-        ScaffoldMessenger.of(context).showSnackBar(
-          const SnackBar(
-            duration: Duration(seconds: 5),
-            content: Text('Could not open browser.'),
-          ),
-        );
-      }
-    } catch (e) {
-      if (context.mounted) {
-        ScaffoldMessenger.of(context).showSnackBar(
-          SnackBar(
-            duration: const Duration(seconds: 5),
-            content: Text('Error: $e'),
-          ),
-        );
-      }
-    }
-  }
-
  Future<void> _createIssue(
    BuildContext context,
    int imapCount,
@@ -103,19 +100,9 @@ class _AboutScreenState extends ConsumerState<AboutScreen> {
    try {
      pkg = await _packageInfoFuture;
    } catch (_) {}
-    String? deviceModel;
-    try {
-      deviceModel = await _deviceModelFuture;
-    } catch (_) {}
    if (!context.mounted) return;
    final body = Uri.encodeComponent(
-      buildAboutMarkdown(
-        context: context,
-        pkg: pkg,
-        imapCount: imapCount,
-        jmapCount: jmapCount,
-        deviceModel: deviceModel,
-      ),
+      _buildMarkdown(context, pkg, imapCount, jmapCount),
    );
    final url = Uri.parse(
      'https://codeberg.org/guettli/sharedinbox/issues/new?body=$body',
@@ -166,18 +153,20 @@ class _AboutScreenState extends ConsumerState<AboutScreen> {
                      return const Center(child: CircularProgressIndicator());
                    }
                    return Markdown(
-                      data: buildAboutMarkdown(
-                        context: context,
-                        pkg: snapshot.data,
-                        imapCount: imapCount,
-                        jmapCount: jmapCount,
-                        deviceModel: _deviceModel,
+                      data: _buildMarkdown(
+                        context,
+                        snapshot.data,
+                        imapCount,
+                        jmapCount,
                      ),
                      selectable: true,
                      onTapLink: (text, href, title) {
                        if (href != null) {
                          unawaited(
-                            _launchUrl(context, Uri.parse(href)),
+                            launchUrl(
+                              Uri.parse(href),
+                              mode: LaunchMode.externalApplication,
+                            ),
                          );
                        }
                      },
@@ -1,5 +1,4 @@
 import 'dart:async';
-import 'dart:convert';

 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
@@ -67,14 +66,6 @@ class AccountListScreen extends ConsumerWidget {
                unawaited(context.push('/accounts/about'));
              },
            ),
-            ListTile(
-              leading: const Icon(Icons.settings),
-              title: const Text('Preferences'),
-              onTap: () {
-                Navigator.pop(context); // Close drawer
-                unawaited(context.push('/accounts/preferences'));
-              },
-            ),
          ],
        ),
      ),
@@ -133,6 +124,7 @@ class _AccountTile extends ConsumerWidget {
              if (h == null) return const Text('Sync health: Not verified yet');
              final date = h.lastVerifiedAt.toLocal().toString().split('.')[0];
              return Row(
+                mainAxisSize: MainAxisSize.min,
                children: [
                  const Text('Sync health: '),
                  Icon(
@@ -141,13 +133,7 @@ class _AccountTile extends ConsumerWidget {
                    color: h.isHealthy ? Colors.green : Colors.orange,
                  ),
                  const SizedBox(width: 4),
-                  Flexible(
-                    child: Text(
-                      h.isHealthy
-                          ? 'Healthy'
-                          : _formatDiscrepancies(h.discrepancySummary),
-                    ),
-                  ),
+                  Text(h.isHealthy ? 'Healthy' : 'Discrepancies found'),
                  Text(' ($date)', style: const TextStyle(fontSize: 10)),
                ],
              );
@@ -307,30 +293,6 @@ class _AccountTile extends ConsumerWidget {
  }
 }

-String _formatDiscrepancies(String? summary) {
-  if (summary == null) return 'Discrepancies found';
-  try {
-    final decoded = jsonDecode(summary) as Map<String, dynamic>;
-    var missingLocally = 0;
-    var missingOnServer = 0;
-    var flagMismatches = 0;
-    for (final v in decoded.values) {
-      final m = v as Map<String, dynamic>;
-      missingLocally += (m['missingLocally'] as int? ?? 0);
-      missingOnServer += (m['missingOnServer'] as int? ?? 0);
-      flagMismatches += (m['flagMismatches'] as int? ?? 0);
-    }
-    final parts = <String>[];
-    if (missingLocally > 0) parts.add('missing locally: $missingLocally');
-    if (missingOnServer > 0) parts.add('missing on server: $missingOnServer');
-    if (flagMismatches > 0) parts.add('flag mismatches: $flagMismatches');
-    if (parts.isEmpty) return 'Discrepancies found';
-    return 'Discrepancies found (${parts.join(', ')})';
-  } catch (_) {
-    return 'Discrepancies found';
-  }
-}
-
 class _OnboardingView extends StatelessWidget {
  const _OnboardingView();

@@ -32,15 +32,11 @@ enum _Step { generatingKey, showingPubKey, scanning, importing, done, error }
 class _AccountReceiveScreenState extends ConsumerState<AccountReceiveScreen> {
  _Step _step = _Step.generatingKey;
  ShareKeyMaterial? _keyMaterial;
-  DateTime? _keyExpiresAt;
  String? _pubKeyQr;
  String? _errorMessage;
  bool _scannerActive = false;

  MobileScannerController? _scannerController;
-  // True when the scanner plugin fails to initialise at runtime (e.g.
-  // MissingPluginException on some Android builds).
-  bool _scannerFailed = false;

  @override
  void initState() {
@@ -65,7 +61,6 @@ class _AccountReceiveScreenState extends ConsumerState<AccountReceiveScreen> {
      );
      setState(() {
        _keyMaterial = material;
-        _keyExpiresAt = DateTime.now().toUtc().add(const Duration(minutes: 20));
        _pubKeyQr = qr;
        _step = _Step.showingPubKey;
      });
@@ -81,37 +76,8 @@ class _AccountReceiveScreenState extends ConsumerState<AccountReceiveScreen> {
    setState(() {
      _step = _Step.scanning;
      _scannerActive = true;
+      _scannerController = MobileScannerController();
    });
-    if (_cameraScanSupported()) {
-      unawaited(_initScanner());
-    }
-  }
-
-  // Pre-flight: probe the scanner's permission-state method to verify the
-  // plugin is registered.  MissingPluginException is thrown on Android builds
-  // where the plugin is not linked (issue #204).  All other exceptions mean
-  // the plugin exists but something else failed — the MobileScanner widget
-  // will surface those via its own error builder.
-  Future<void> _initScanner() async {
-    bool available = false;
-    try {
-      await const MethodChannel(
-        'dev.steenbakker.mobile_scanner/scanner/method',
-      ).invokeMethod<int>('state');
-      available = true;
-    } on MissingPluginException {
-      // Plugin not registered on this device; text fallback will be shown.
-    } catch (_) {
-      // Plugin registered but state check failed; let the scanner widget
-      // handle it via its errorBuilder.
-      available = true;
-    }
-    if (!mounted) return;
-    if (available) {
-      setState(() => _scannerController = MobileScannerController());
-    } else {
-      setState(() => _scannerFailed = true);
-    }
  }

  Future<void> _onScanned(String rawValue) async {
@@ -278,7 +244,7 @@ class _AccountReceiveScreenState extends ConsumerState<AccountReceiveScreen> {
            },
          ),
          const SizedBox(height: 8),
-          _ExpiryHint(expiresAt: _keyExpiresAt!),
+          const _ExpiryHint(),
          const SizedBox(height: 32),
          if (_errorMessage != null) ...[
            Text(
@@ -300,14 +266,11 @@ class _AccountReceiveScreenState extends ConsumerState<AccountReceiveScreen> {
  }

  Widget _buildScannerView(BuildContext context) {
-    // Fall back to text input when the platform has no camera support or when
-    // the scanner plugin fails to initialise at runtime (MissingPluginException).
-    if (!_cameraScanSupported() || _scannerFailed) {
+    // On platforms where the camera scanner is not available (Linux desktop),
+    // fall back to a text-input field.
+    if (!_cameraScanSupported()) {
      return _buildTextFallbackView(context);
    }
-    if (_scannerController == null) {
-      return const Center(child: CircularProgressIndicator());
-    }

    return Stack(
      children: [
@@ -408,37 +371,8 @@ bool _cameraScanSupported() =>
    Platform.isMacOS ||
    Platform.isWindows;

-class _ExpiryHint extends StatefulWidget {
-  const _ExpiryHint({required this.expiresAt});
-
-  final DateTime expiresAt;
-
-  @override
-  State<_ExpiryHint> createState() => _ExpiryHintState();
-}
-
-class _ExpiryHintState extends State<_ExpiryHint> {
-  late Timer _timer;
-
-  @override
-  void initState() {
-    super.initState();
-    _timer = Timer.periodic(const Duration(seconds: 1), (_) => setState(() {}));
-  }
-
-  @override
-  void dispose() {
-    _timer.cancel();
-    super.dispose();
-  }
-
-  String _formatRemaining() {
-    final remaining = widget.expiresAt.difference(DateTime.now().toUtc());
-    if (remaining.isNegative) return 'expired';
-    final minutes = remaining.inMinutes;
-    final seconds = remaining.inSeconds % 60;
-    return '${minutes.toString().padLeft(2, '0')}:${seconds.toString().padLeft(2, '0')}';
-  }
+class _ExpiryHint extends StatelessWidget {
+  const _ExpiryHint();

  @override
  Widget build(BuildContext context) {
@@ -448,7 +382,7 @@ class _ExpiryHintState extends State<_ExpiryHint> {
        Icon(Icons.timer_outlined, size: 14, color: Colors.grey[600]),
        const SizedBox(width: 4),
        Text(
-          'This key expires in ${_formatRemaining()}',
+          'This key expires in 20 minutes',
          style: TextStyle(fontSize: 12, color: Colors.grey[600]),
        ),
      ],
@@ -45,42 +45,12 @@ class _AccountSendScreenState extends ConsumerState<AccountSendScreen> {
  bool _scannerActive = true;

  MobileScannerController? _scannerController;
-  // True when the scanner plugin fails to initialise at runtime (e.g.
-  // MissingPluginException on some Android builds).
-  bool _scannerFailed = false;

  @override
  void initState() {
    super.initState();
    if (_cameraScanSupported()) {
-      unawaited(_initScanner());
-    }
-  }
-
-  // Pre-flight: probe the scanner's permission-state method to verify the
-  // plugin is registered.  MissingPluginException is thrown on Android builds
-  // where the plugin is not linked (issue #204).  All other exceptions mean
-  // the plugin exists but something else failed — the MobileScanner widget
-  // will surface those via its own error builder.
-  Future<void> _initScanner() async {
-    bool available = false;
-    try {
-      await const MethodChannel(
-        'dev.steenbakker.mobile_scanner/scanner/method',
-      ).invokeMethod<int>('state');
-      available = true;
-    } on MissingPluginException {
-      // Plugin not registered on this device; text fallback will be shown.
-    } catch (_) {
-      // Plugin registered but state check failed; let the scanner widget
-      // handle it via its errorBuilder.
-      available = true;
-    }
-    if (!mounted) return;
-    if (available) {
-      setState(() => _scannerController = MobileScannerController());
-    } else {
-      setState(() => _scannerFailed = true);
+      _scannerController = MobileScannerController();
    }
  }

@@ -208,12 +178,9 @@ class _AccountSendScreenState extends ConsumerState<AccountSendScreen> {
  }

  Widget _buildScanStep(BuildContext context) {
-    if (!_cameraScanSupported() || _scannerFailed) {
+    if (!_cameraScanSupported()) {
      return _buildTextFallbackView(context);
    }
-    if (_scannerController == null) {
-      return const Center(child: CircularProgressIndicator());
-    }

    return Stack(
      children: [
@@ -1,7 +1,8 @@
 import 'dart:async';

 import 'package:flutter/material.dart';
-import 'package:flutter_markdown_plus/flutter_markdown_plus.dart';
+import 'package:flutter/services.dart' show rootBundle;
+import 'package:flutter_markdown/flutter_markdown.dart';
 import 'package:url_launcher/url_launcher.dart';

 class ChangeLogScreen extends StatelessWidget {
@@ -12,8 +13,7 @@ class ChangeLogScreen extends StatelessWidget {
    return Scaffold(
      appBar: AppBar(title: const Text('ChangeLog')),
      body: FutureBuilder<String>(
-        future:
-            DefaultAssetBundle.of(context).loadString('assets/changelog.txt'),
+        future: rootBundle.loadString('assets/changelog.txt'),
        builder: (context, snapshot) {
          if (snapshot.connectionState == ConnectionState.waiting) {
            return const Center(child: CircularProgressIndicator());
@@ -162,7 +162,7 @@ class _ComposeScreenState extends ConsumerState<ComposeScreen> {
  }

  Future<void> _pickAttachments() async {
-    final result = await FilePicker.pickFiles();
+    final result = await FilePicker.platform.pickFiles(allowMultiple: true);
    if (result == null) return;
    final files = result.files.where((f) => f.path != null).toList();
    if (!mounted) return;
@@ -1,6 +1,5 @@
 import 'dart:io';

-import 'package:flutter/foundation.dart';
 import 'package:flutter/material.dart';
 import 'package:flutter/services.dart';
 import 'package:package_info_plus/package_info_plus.dart';
@@ -11,45 +10,21 @@ class CrashScreen extends StatelessWidget {
    super.key,
    required this.exception,
    required this.stackTrace,
-    this.gitHash = const String.fromEnvironment('GIT_HASH'),
  });

  final Object exception;
  final StackTrace? stackTrace;
-  final String gitHash;
-
-  String get _buildMode {
-    if (kDebugMode) return 'debug';
-    if (kProfileMode) return 'profile';
-    return 'release';
-  }
-
-  Future<String> _fetchVersion() async {
-    try {
-      final info = await PackageInfo.fromPlatform();
-      return '${info.version}+${info.buildNumber}';
-    } catch (_) {
-      return 'unknown';
-    }
-  }

  Future<String> _buildReport() async {
-    final version = await _fetchVersion();
+    String version = 'unknown';
+    try {
+      final info = await PackageInfo.fromPlatform();
+      version = '${info.version}+${info.buildNumber}';
+    } catch (_) {}
    final platform =
        '${Platform.operatingSystem} ${Platform.operatingSystemVersion}';
-    final versionDisplay = gitHash.isNotEmpty
-        ? '[$version](https://codeberg.org/guettli/sharedinbox/commit/$gitHash)'
-        : version;
-    final gitLine = gitHash.isNotEmpty
-        ? 'Git Commit: [$gitHash](https://codeberg.org/guettli/sharedinbox/commit/$gitHash)\n'
-        : '';
-    final timestamp = DateTime.now().toUtc().toIso8601String();
-    return 'App Version: $versionDisplay\n'
-        'Build Mode: $_buildMode\n'
-        '$gitLine'
-        'Platform: $platform\n'
-        'Dart: ${Platform.version}\n'
-        'Timestamp: $timestamp\n\n'
+    return 'App Version: $version\n'
+        'Platform: $platform\n\n'
        'Error:\n```\n$exception\n```\n\n'
        'Stack Trace:\n```\n$stackTrace\n```';
  }
@@ -62,86 +37,39 @@ class CrashScreen extends StatelessWidget {
          title: const Text('Something went wrong'),
          backgroundColor: Theme.of(context).colorScheme.errorContainer,
        ),
-        body: Builder(
-          builder: (ctx) => SingleChildScrollView(
-            padding: const EdgeInsets.all(16),
-            child: Column(
-              crossAxisAlignment: CrossAxisAlignment.stretch,
-              children: [
-                const Icon(Icons.error_outline, color: Colors.red, size: 64),
+        body: SingleChildScrollView(
+          padding: const EdgeInsets.all(16),
+          child: Column(
+            crossAxisAlignment: CrossAxisAlignment.stretch,
+            children: [
+              const Icon(Icons.error_outline, color: Colors.red, size: 64),
+              const SizedBox(height: 16),
+              Text(
+                'sharedinbox.de encountered an unexpected error and needs to be restarted.',
+                style: Theme.of(context).textTheme.titleMedium,
+                textAlign: TextAlign.center,
+              ),
+              const SizedBox(height: 24),
+              const Text(
+                'Error Details:',
+                style: TextStyle(fontWeight: FontWeight.bold),
+              ),
+              const SizedBox(height: 8),
+              Container(
+                padding: const EdgeInsets.all(12),
+                decoration: BoxDecoration(
+                  color: Colors.grey[200],
+                  borderRadius: BorderRadius.circular(8),
+                ),
+                child: Text(
+                  exception.toString(),
+                  style: const TextStyle(fontFamily: 'monospace', fontSize: 12),
+                ),
+              ),
+              if (stackTrace != null) ...[
                const SizedBox(height: 16),
-                Text(
-                  'sharedinbox.de encountered an unexpected error and needs to be restarted.',
-                  style: Theme.of(ctx).textTheme.titleMedium,
-                  textAlign: TextAlign.center,
-                ),
-                const SizedBox(height: 4),
-                FutureBuilder<String>(
-                  future: _fetchVersion(),
-                  builder: (context, snapshot) => Text(
-                    'v${snapshot.data ?? '…'}  •  $_buildMode  •  '
-                    '${Platform.operatingSystem} ${Platform.operatingSystemVersion}',
-                    style: Theme.of(context).textTheme.bodySmall?.copyWith(
-                          color: Colors.grey[600],
-                        ),
-                    textAlign: TextAlign.center,
-                  ),
-                ),
-                if (gitHash.isNotEmpty) ...[
-                  const SizedBox(height: 8),
-                  FutureBuilder<PackageInfo>(
-                    future: PackageInfo.fromPlatform(),
-                    builder: (_, snapshot) {
-                      if (!snapshot.hasData) return const SizedBox.shrink();
-                      final version =
-                          '${snapshot.data!.version}+${snapshot.data!.buildNumber}';
-                      return GestureDetector(
-                        onTap: () async {
-                          final url = Uri.parse(
-                            'https://codeberg.org/guettli/sharedinbox/commit/$gitHash',
-                          );
-                          await launchUrl(
-                            url,
-                            mode: LaunchMode.externalApplication,
-                          );
-                        },
-                        child: Text(
-                          'App Version: $version',
-                          style: const TextStyle(
-                            fontSize: 12,
-                            color: Colors.blue,
-                            decoration: TextDecoration.underline,
-                          ),
-                          textAlign: TextAlign.center,
-                        ),
-                      );
-                    },
-                  ),
-                  const SizedBox(height: 4),
-                  GestureDetector(
-                    onTap: () async {
-                      final url = Uri.parse(
-                        'https://codeberg.org/guettli/sharedinbox/commit/$gitHash',
-                      );
-                      await launchUrl(
-                        url,
-                        mode: LaunchMode.externalApplication,
-                      );
-                    },
-                    child: Text(
-                      'Git Commit: $gitHash',
-                      style: const TextStyle(
-                        fontSize: 12,
-                        color: Colors.blue,
-                        decoration: TextDecoration.underline,
-                      ),
-                      textAlign: TextAlign.center,
-                    ),
-                  ),
-                ],
-                const SizedBox(height: 24),
                const Text(
-                  'Error Details:',
+                  'Stack Trace:',
                  style: TextStyle(fontWeight: FontWeight.bold),
                ),
                const SizedBox(height: 8),
@@ -152,94 +80,70 @@ class CrashScreen extends StatelessWidget {
                    borderRadius: BorderRadius.circular(8),
                  ),
                  child: Text(
-                    exception.toString(),
+                    stackTrace.toString(),
                    style: const TextStyle(
                      fontFamily: 'monospace',
-                      fontSize: 12,
+                      fontSize: 10,
                    ),
                  ),
                ),
-                if (stackTrace != null) ...[
-                  const SizedBox(height: 16),
-                  const Text(
-                    'Stack Trace:',
-                    style: TextStyle(fontWeight: FontWeight.bold),
-                  ),
-                  const SizedBox(height: 8),
-                  Container(
-                    padding: const EdgeInsets.all(12),
-                    decoration: BoxDecoration(
-                      color: Colors.grey[200],
-                      borderRadius: BorderRadius.circular(8),
-                    ),
-                    child: Text(
-                      stackTrace.toString(),
-                      style: const TextStyle(
-                        fontFamily: 'monospace',
-                        fontSize: 10,
+              ],
+              const SizedBox(height: 24),
+              FilledButton.icon(
+                onPressed: () async {
+                  final data = await _buildReport();
+                  await Clipboard.setData(ClipboardData(text: data));
+                  if (context.mounted) {
+                    ScaffoldMessenger.of(context).showSnackBar(
+                      const SnackBar(
+                        duration: Duration(seconds: 5),
+                        content: Text('Copied to clipboard'),
                      ),
-                    ),
-                  ),
-                ],
-                const SizedBox(height: 24),
-                FilledButton.icon(
-                  onPressed: () async {
-                    final data = await _buildReport();
-                    await Clipboard.setData(ClipboardData(text: data));
-                    if (ctx.mounted) {
-                      ScaffoldMessenger.of(ctx).showSnackBar(
+                    );
+                  }
+                },
+                icon: const Icon(Icons.copy),
+                label: const Text('Copy to Clipboard'),
+              ),
+              const SizedBox(height: 16),
+              OutlinedButton.icon(
+                onPressed: () async {
+                  final report = await _buildReport();
+                  final title = Uri.encodeComponent(
+                    'Crash: ${exception.toString().split('\n').first}',
+                  );
+                  final body = Uri.encodeComponent(report);
+                  final url = Uri.parse(
+                    'https://codeberg.org/guettli/sharedinbox/issues/new?title=$title&body=$body',
+                  );
+                  try {
+                    final launched = await launchUrl(
+                      url,
+                      mode: LaunchMode.externalApplication,
+                    );
+                    if (!launched && context.mounted) {
+                      ScaffoldMessenger.of(context).showSnackBar(
                        const SnackBar(
                          duration: Duration(seconds: 5),
-                          content: Text('Copied to clipboard'),
+                          content: Text('Could not open browser.'),
                        ),
                      );
                    }
-                  },
-                  icon: const Icon(Icons.copy),
-                  label: const Text('Copy to Clipboard'),
-                ),
-                const SizedBox(height: 16),
-                OutlinedButton.icon(
-                  onPressed: () async {
-                    // URL carries only the title to avoid exceeding browser
-                    // URL-length limits — long stack traces caused "create
-                    // issue failed" (#146).  Use "Copy to Clipboard" first to
-                    // get the full report, then paste it in the issue body.
-                    final title = Uri.encodeComponent(
-                      'Crash: ${exception.toString().split('\n').first}',
-                    );
-                    final url = Uri.parse(
-                      'https://codeberg.org/guettli/sharedinbox/issues/new?title=$title',
-                    );
-                    try {
-                      final launched = await launchUrl(
-                        url,
-                        mode: LaunchMode.externalApplication,
+                  } catch (e) {
+                    if (context.mounted) {
+                      ScaffoldMessenger.of(context).showSnackBar(
+                        SnackBar(
+                          duration: const Duration(seconds: 5),
+                          content: Text('Error: $e'),
+                        ),
                      );
-                      if (!launched && ctx.mounted) {
-                        ScaffoldMessenger.of(ctx).showSnackBar(
-                          const SnackBar(
-                            duration: Duration(seconds: 5),
-                            content: Text('Could not open browser.'),
-                          ),
-                        );
-                      }
-                    } catch (e) {
-                      if (ctx.mounted) {
-                        ScaffoldMessenger.of(ctx).showSnackBar(
-                          SnackBar(
-                            duration: const Duration(seconds: 5),
-                            content: Text('Error: $e'),
-                          ),
-                        );
-                      }
                    }
-                  },
-                  icon: const Icon(Icons.bug_report),
-                  label: const Text('Report Issue on Codeberg'),
-                ),
-              ],
-            ),
+                  }
+                },
+                icon: const Icon(Icons.bug_report),
+                label: const Text('Report Issue on Codeberg'),
+              ),
+            ],
          ),
        ),
      ),
@@ -38,7 +38,6 @@ class _EditAccountScreenState extends ConsumerState<EditAccountScreen> {
  var _sieveSsl = true;
  var _verbose = false;
  final _jmapUrlCtrl = TextEditingController();
-  bool _hasStoredPassword = false;

  // -- "Try connection" state ------------------------------------------------
  bool _tryTesting = false;
@@ -51,7 +50,6 @@ class _EditAccountScreenState extends ConsumerState<EditAccountScreen> {
    _smtpHostCtrl.addListener(_rebuild);
    _sieveHostCtrl.addListener(_rebuild);
    _imapHostCtrl.addListener(_rebuild);
-    _passwordCtrl.addListener(_rebuild);
    unawaited(_load());
  }

@@ -65,11 +63,6 @@ class _EditAccountScreenState extends ConsumerState<EditAccountScreen> {
      context.pop();
      return;
    }
-    try {
-      await repo.getPassword(account.id);
-      _hasStoredPassword = true;
-    } catch (_) {}
-    if (!mounted) return;
    _account = account;
    _displayNameCtrl.text = account.displayName;
    _usernameCtrl.text = account.username;
@@ -91,7 +84,6 @@ class _EditAccountScreenState extends ConsumerState<EditAccountScreen> {
    _smtpHostCtrl.removeListener(_rebuild);
    _sieveHostCtrl.removeListener(_rebuild);
    _imapHostCtrl.removeListener(_rebuild);
-    _passwordCtrl.removeListener(_rebuild);
    for (final c in [
      _displayNameCtrl,
      _usernameCtrl,
@@ -275,12 +267,10 @@ class _EditAccountScreenState extends ConsumerState<EditAccountScreen> {
            ),
            _field(
              _passwordCtrl,
-              _hasStoredPassword
-                  ? 'New password (leave blank to keep)'
-                  : 'Password',
+              'New password (leave blank to keep)',
              key: const Key('editPasswordField'),
              obscure: true,
-              required: !_hasStoredPassword,
+              required: false,
            ),
            if (account.type == AccountType.jmap) ...[
              const Divider(height: 32),
@@ -355,17 +345,10 @@ class _EditAccountScreenState extends ConsumerState<EditAccountScreen> {
              testing: _tryTesting,
              okMessage: _tryOk,
              errorMessage: _tryErr,
-              onPressed: _hasStoredPassword || _passwordCtrl.text.isNotEmpty
-                  ? _tryConnection
-                  : null,
+              onPressed: _tryConnection,
            ),
            const SizedBox(height: 8),
-            FilledButton(
-              onPressed: _hasStoredPassword || _passwordCtrl.text.isNotEmpty
-                  ? _save
-                  : null,
-              child: const Text('Save'),
-            ),
+            FilledButton(onPressed: _save, child: const Text('Save')),
          ],
        ),
      ),
@@ -1,79 +0,0 @@
-import 'package:flutter/material.dart';
-
-import 'package:sharedinbox/core/models/mailbox.dart';
-import 'package:sharedinbox/core/repositories/mailbox_repository.dart';
-
-enum _MissingFolderChoice { chooseExisting, createNew }
-
-/// Resolves a mailbox by role, prompting the user to choose or create one when
-/// the role is not found.  Returns the target [Mailbox], or null if cancelled.
-Future<Mailbox?> resolveMailboxByRole(
-  BuildContext context,
-  MailboxRepository mailboxRepo,
-  String accountId,
-  String currentMailboxPath,
-  String role, {
-  required String dialogTitle,
-  required String createFolderName,
-}) async {
-  Mailbox? mailbox = await mailboxRepo.findMailboxByRole(accountId, role);
-  if (!context.mounted) return null;
-  if (mailbox != null) return mailbox;
-
-  final choice = await showDialog<_MissingFolderChoice>(
-    context: context,
-    builder: (ctx) => AlertDialog(
-      title: Text(dialogTitle),
-      actions: [
-        TextButton(
-          onPressed: () =>
-              Navigator.pop(ctx, _MissingFolderChoice.chooseExisting),
-          child: const Text('Choose existing folder'),
-        ),
-        FilledButton(
-          onPressed: () => Navigator.pop(ctx, _MissingFolderChoice.createNew),
-          child: Text('Create "$createFolderName"'),
-        ),
-      ],
-    ),
-  );
-  if (!context.mounted || choice == null) return null;
-
-  switch (choice) {
-    case _MissingFolderChoice.chooseExisting:
-      final mailboxes = await mailboxRepo.observeMailboxes(accountId).first;
-      if (!context.mounted) return null;
-      final chosen = await showModalBottomSheet<String>(
-        context: context,
-        builder: (ctx) => ListView(
-          shrinkWrap: true,
-          children: [
-            const ListTile(
-              title: Text(
-                'Move to…',
-                style: TextStyle(fontWeight: FontWeight.bold),
-              ),
-            ),
-            for (final m
-                in mailboxes.where((m) => m.path != currentMailboxPath))
-              ListTile(
-                leading: const Icon(Icons.folder_outlined),
-                title: Text(m.name),
-                onTap: () => Navigator.pop(ctx, m.path),
-              ),
-          ],
-        ),
-      );
-      if (chosen == null || !context.mounted) return null;
-      mailbox = mailboxes.firstWhere((m) => m.path == chosen);
-    case _MissingFolderChoice.createNew:
-      mailbox = await mailboxRepo.createMailboxWithRole(
-        accountId,
-        createFolderName,
-        role,
-      );
-      if (!context.mounted) return null;
-  }
-
-  return mailbox;
-}
@@ -16,7 +16,6 @@ import 'package:sharedinbox/core/models/undo_action.dart';
 import 'package:sharedinbox/core/utils/format_utils.dart';
 import 'package:sharedinbox/core/utils/html_utils.dart';
 import 'package:sharedinbox/di.dart';
-import 'package:sharedinbox/ui/screens/email_action_helpers.dart';
 import 'package:sharedinbox/ui/widgets/secure_email_webview.dart';
 import 'package:sharedinbox/ui/widgets/snooze_picker.dart';
 import 'package:url_launcher/url_launcher.dart';
@@ -44,15 +43,15 @@ class _EmailDetailScreenState extends ConsumerState<EmailDetailScreen> {
    ref.listen<AsyncValue<(Email?, EmailBody)>>(
      emailDetailProvider(widget.emailId),
      (_, next) {
-        final email = next.value?.$1;
+        final email = next.valueOrNull?.$1;
        if (email != null && mounted) {
          setState(() => _isFlagged = email.isFlagged);
        }
      },
    );

-    final header = detail.value?.$1;
-    final body = detail.value?.$2;
+    final header = detail.valueOrNull?.$1;
+    final body = detail.valueOrNull?.$2;

    final isMobile = defaultTargetPlatform == TargetPlatform.android ||
        defaultTargetPlatform == TargetPlatform.iOS;
@@ -71,9 +70,16 @@ class _EmailDetailScreenState extends ConsumerState<EmailDetailScreen> {
            onPressed: header == null
                ? null
                : () {
-                    unawaited(
-                      _replyWithRecipientDialog(context, header, body),
-                    );
+                    unawaited(_reply(context, header, body, replyAll: false));
+                  },
+          ),
+          IconButton(
+            icon: const Icon(Icons.reply_all),
+            tooltip: 'Reply all',
+            onPressed: header == null
+                ? null
+                : () {
+                    unawaited(_reply(context, header, body, replyAll: true));
                  },
          ),
          IconButton(
@@ -86,13 +92,34 @@ class _EmailDetailScreenState extends ConsumerState<EmailDetailScreen> {
                  },
          ),
          IconButton(
-            icon: const Icon(Icons.archive),
-            tooltip: 'Archive',
-            onPressed: header == null
-                ? null
-                : () {
-                    unawaited(_archive(context, header));
-                  },
+            icon: const Icon(Icons.mark_email_unread_outlined),
+            tooltip: 'Mark as unread',
+            onPressed: () async {
+              await repo.setFlag(widget.emailId, seen: false);
+              if (context.mounted) context.pop();
+            },
+          ),
+          IconButton(
+            icon: Icon(
+              _isFlagged ? Icons.star : Icons.star_border,
+              color: _isFlagged ? Colors.amber : null,
+            ),
+            tooltip: _isFlagged ? 'Unflag' : 'Flag',
+            onPressed: () async {
+              final next = !_isFlagged;
+              await repo.setFlag(widget.emailId, flagged: next);
+              if (mounted) setState(() => _isFlagged = next);
+            },
+          ),
+          IconButton(
+            icon: const Icon(Icons.drive_file_move_outline),
+            tooltip: 'Move to folder',
+            onPressed: header == null ? null : () => _moveTo(context, header),
+          ),
+          IconButton(
+            icon: const Icon(Icons.access_time),
+            tooltip: 'Snooze',
+            onPressed: header == null ? null : () => _snooze(context, header),
          ),
          IconButton(
            icon: const Icon(Icons.delete),
@@ -119,43 +146,8 @@ class _EmailDetailScreenState extends ConsumerState<EmailDetailScreen> {
              if (context.mounted) context.pop();
            },
          ),
-          IconButton(
-            icon: const Icon(Icons.report_outlined),
-            tooltip: 'Mark as spam',
-            onPressed: header == null
-                ? null
-                : () {
-                    unawaited(_markAsSpam(context, header));
-                  },
-          ),
-          IconButton(
-            icon: const Icon(Icons.drive_file_move_outline),
-            tooltip: 'Move to folder',
-            onPressed: header == null ? null : () => _moveTo(context, header),
-          ),
-          IconButton(
-            icon: const Icon(Icons.access_time),
-            tooltip: 'Snooze',
-            onPressed: header == null ? null : () => _snooze(context, header),
-          ),
-          IconButton(
-            icon: Icon(
-              _isFlagged ? Icons.star : Icons.star_border,
-              color: _isFlagged ? Colors.amber : null,
-            ),
-            tooltip: _isFlagged ? 'Unflag' : 'Flag',
-            onPressed: () async {
-              final next = !_isFlagged;
-              await repo.setFlag(widget.emailId, flagged: next);
-              if (mounted) setState(() => _isFlagged = next);
-            },
-          ),
          PopupMenuButton<String>(
            itemBuilder: (ctx) => [
-              const PopupMenuItem(
-                value: 'mark_unread',
-                child: Text('Mark as unread'),
-              ),
              const PopupMenuItem(
                value: 'headers',
                child: Text('Show Mail Headers'),
@@ -169,11 +161,8 @@ class _EmailDetailScreenState extends ConsumerState<EmailDetailScreen> {
                child: Text('Show Raw Email'),
              ),
            ],
-            onSelected: (value) async {
-              if (value == 'mark_unread') {
-                await repo.setFlag(widget.emailId, seen: false);
-                if (context.mounted) context.pop();
-              } else if (value == 'headers' && body != null) {
+            onSelected: (value) {
+              if (value == 'headers' && body != null) {
                _showHeaders(context, body);
              } else if (value == 'structure' && body != null) {
                _showStructure(context, body);
@@ -314,78 +303,17 @@ class _EmailDetailScreenState extends ConsumerState<EmailDetailScreen> {
    return '\n\n— On $date, $from wrote:\n$quoted';
  }

-  Future<void> _replyWithRecipientDialog(
-    BuildContext context,
-    Email header,
-    EmailBody? body,
-  ) async {
-    final account =
-        await ref.read(accountRepositoryProvider).getAccount(header.accountId);
-    final ownEmail = account?.email.toLowerCase() ?? '';
-
-    final seen = <String>{};
-    final candidates = <_Candidate>[];
-
-    void addIfNew(EmailAddress addr, _Placement defaultPlacement) {
-      final key = addr.email.toLowerCase();
-      if (key == ownEmail || seen.contains(key)) return;
-      seen.add(key);
-      candidates.add(_Candidate(addr, defaultPlacement));
-    }
-
-    for (final addr in header.from) {
-      addIfNew(addr, _Placement.to);
-    }
-    for (final addr in header.to) {
-      addIfNew(addr, _Placement.to);
-    }
-    for (final addr in header.cc) {
-      addIfNew(addr, _Placement.cc);
-    }
-
-    if (!context.mounted) return;
-
-    if (candidates.length <= 1) {
-      final to = candidates
-          .where((c) => c.placement == _Placement.to)
-          .map((c) => c.address.email)
-          .join(', ');
-      final cc = candidates
-          .where((c) => c.placement == _Placement.cc)
-          .map((c) => c.address.email)
-          .join(', ');
-      await _composeReply(context, header, body, to: to, cc: cc);
-      return;
-    }
-
-    final confirmed = await showDialog<List<_Candidate>>(
-      context: context,
-      builder: (ctx) => _ReplyAllDialog(candidates: candidates),
-    );
-
-    if (confirmed == null || !context.mounted) return;
-
-    final to = confirmed
-        .where((c) => c.placement == _Placement.to)
-        .map((c) => c.address.email)
-        .join(', ');
-    final cc = confirmed
-        .where((c) => c.placement == _Placement.cc)
-        .map((c) => c.address.email)
-        .join(', ');
-    await _composeReply(context, header, body, to: to, cc: cc);
-  }
-
-  Future<void> _composeReply(
+  Future<void> _reply(
    BuildContext context,
    Email header,
    EmailBody? body, {
-    required String to,
-    required String cc,
+    required bool replyAll,
  }) async {
+    final to = header.from.isNotEmpty ? header.from.first.email : '';
    final subject = (header.subject?.startsWith('Re:') ?? false)
        ? header.subject!
        : 'Re: ${header.subject ?? ''}';
+    final cc = replyAll ? header.to.map((a) => a.email).join(', ') : '';
    final quoted = await _quotedBody(header, body);
    if (!context.mounted) return;
    unawaited(
@@ -402,72 +330,6 @@ class _EmailDetailScreenState extends ConsumerState<EmailDetailScreen> {
    );
  }

-  Future<void> _archive(BuildContext context, Email header) async {
-    final mailbox = await resolveMailboxByRole(
-      context,
-      ref.read(mailboxRepositoryProvider),
-      header.accountId,
-      header.mailboxPath,
-      'archive',
-      dialogTitle: 'No archive folder found',
-      createFolderName: 'Archive',
-    );
-
-    if (mailbox == null || !context.mounted) return;
-
-    await ref
-        .read(emailRepositoryProvider)
-        .moveEmail(widget.emailId, mailbox.path);
-
-    unawaited(
-      ref.read(undoServiceProvider.notifier).pushAction(
-            UndoAction(
-              id: DateTime.now().toIso8601String(),
-              accountId: header.accountId,
-              type: UndoType.move,
-              emailIds: [widget.emailId],
-              sourceMailboxPath: header.mailboxPath,
-              destinationMailboxPath: mailbox.path,
-            ),
-          ),
-    );
-
-    if (context.mounted) context.pop();
-  }
-
-  Future<void> _markAsSpam(BuildContext context, Email header) async {
-    final mailbox = await resolveMailboxByRole(
-      context,
-      ref.read(mailboxRepositoryProvider),
-      header.accountId,
-      header.mailboxPath,
-      'junk',
-      dialogTitle: 'No spam folder found',
-      createFolderName: 'Junk',
-    );
-
-    if (mailbox == null || !context.mounted) return;
-
-    await ref
-        .read(emailRepositoryProvider)
-        .moveEmail(widget.emailId, mailbox.path);
-
-    unawaited(
-      ref.read(undoServiceProvider.notifier).pushAction(
-            UndoAction(
-              id: DateTime.now().toIso8601String(),
-              accountId: header.accountId,
-              type: UndoType.move,
-              emailIds: [widget.emailId],
-              sourceMailboxPath: header.mailboxPath,
-              destinationMailboxPath: mailbox.path,
-            ),
-          ),
-    );
-
-    if (context.mounted) context.pop();
-  }
-
  Future<void> _forward(
    BuildContext context,
    Email header,
@@ -808,94 +670,6 @@ class _EmailDetailScreenState extends ConsumerState<EmailDetailScreen> {
  }
 }

-enum _Placement { to, cc, skip }
-
-class _Candidate {
-  _Candidate(this.address, this.placement);
-  final EmailAddress address;
-  _Placement placement;
-}
-
-class _ReplyAllDialog extends StatefulWidget {
-  const _ReplyAllDialog({required this.candidates});
-  final List<_Candidate> candidates;
-
-  @override
-  State<_ReplyAllDialog> createState() => _ReplyAllDialogState();
-}
-
-class _ReplyAllDialogState extends State<_ReplyAllDialog> {
-  late final List<_Candidate> _candidates;
-
-  @override
-  void initState() {
-    super.initState();
-    _candidates = [
-      for (final c in widget.candidates) _Candidate(c.address, c.placement),
-    ];
-  }
-
-  @override
-  Widget build(BuildContext context) {
-    return AlertDialog(
-      title: const Text('Reply All'),
-      content: SizedBox(
-        width: double.maxFinite,
-        child: ListView(
-          shrinkWrap: true,
-          children: [
-            for (final c in _candidates)
-              Padding(
-                padding: const EdgeInsets.symmetric(vertical: 4),
-                child: Row(
-                  children: [
-                    Expanded(
-                      child: Text(
-                        c.address.toString(),
-                        overflow: TextOverflow.ellipsis,
-                      ),
-                    ),
-                    const SizedBox(width: 8),
-                    SegmentedButton<_Placement>(
-                      showSelectedIcon: false,
-                      segments: const [
-                        ButtonSegment(
-                          value: _Placement.to,
-                          label: Text('To'),
-                        ),
-                        ButtonSegment(
-                          value: _Placement.cc,
-                          label: Text('Cc'),
-                        ),
-                        ButtonSegment(
-                          value: _Placement.skip,
-                          label: Text('Skip'),
-                        ),
-                      ],
-                      selected: {c.placement},
-                      onSelectionChanged: (s) =>
-                          setState(() => c.placement = s.first),
-                    ),
-                  ],
-                ),
-              ),
-          ],
-        ),
-      ),
-      actions: [
-        TextButton(
-          onPressed: () => Navigator.pop(context),
-          child: const Text('Cancel'),
-        ),
-        TextButton(
-          onPressed: () => Navigator.pop(context, _candidates),
-          child: const Text('Reply'),
-        ),
-      ],
-    );
-  }
-}
-
 class _MimeRow {
  const _MimeRow(this.depth, this.label);
  final int depth;
@@ -938,13 +712,10 @@ class _UnsubscribeChip extends StatelessWidget {
  Widget build(BuildContext context) {
    final uri = _parseUnsubscribeUri(header);
    if (uri == null) return const SizedBox.shrink();
-    return Tooltip(
-      message: uri.toString(),
-      child: ActionChip(
-        avatar: const Icon(Icons.unsubscribe_outlined, size: 16),
-        label: const Text('Unsubscribe'),
-        onPressed: () => launchUrl(uri, mode: LaunchMode.externalApplication),
-      ),
+    return ActionChip(
+      avatar: const Icon(Icons.unsubscribe_outlined, size: 16),
+      label: const Text('Unsubscribe'),
+      onPressed: () => launchUrl(uri, mode: LaunchMode.externalApplication),
    );
  }
 }
@@ -8,10 +8,8 @@ import 'package:intl/intl.dart';
 import 'package:sharedinbox/core/models/account.dart';
 import 'package:sharedinbox/core/models/email.dart';
 import 'package:sharedinbox/core/models/undo_action.dart';
-import 'package:sharedinbox/core/models/user_preferences.dart';
 import 'package:sharedinbox/core/repositories/email_repository.dart';
 import 'package:sharedinbox/di.dart';
-import 'package:sharedinbox/ui/screens/email_action_helpers.dart';
 import 'package:sharedinbox/ui/widgets/email_tile.dart';
 import 'package:sharedinbox/ui/widgets/folder_drawer.dart';
 import 'package:sharedinbox/ui/widgets/snooze_picker.dart';
@@ -149,21 +147,16 @@ class _EmailListScreenState extends ConsumerState<EmailListScreen> {
  Widget build(BuildContext context) {
    final repo = ref.watch(emailRepositoryProvider);
    final accountAsync = ref.watch(accountByIdProvider(widget.accountId));
-    final prefs =
-        ref.watch(userPreferencesProvider).value ?? const UserPreferences();
-    final menuAtBottom = prefs.menuPosition == MenuPosition.bottom;

    return Scaffold(
-      appBar: _buildAppBar(repo, accountAsync, menuAtBottom: menuAtBottom),
+      appBar: _buildAppBar(repo, accountAsync),
      drawer: _selecting
          ? null
          : FolderDrawer(
              accountId: widget.accountId,
              currentMailboxPath: widget.mailboxPath,
            ),
-      bottomNavigationBar: _selecting
-          ? _selectionBottomBar()
-          : (menuAtBottom ? _folderNavBottomBar() : null),
+      bottomNavigationBar: _selecting ? _selectionBottomBar() : null,
      body: Column(
        children: [
          _buildSyncErrorBanner(),
@@ -179,14 +172,12 @@ class _EmailListScreenState extends ConsumerState<EmailListScreen> {

  PreferredSizeWidget _buildAppBar(
    EmailRepository emailRepo,
-    AsyncValue<Account?> accountAsync, {
-    required bool menuAtBottom,
-  }) {
+    AsyncValue<Account?> accountAsync,
+  ) {
    final selectionCount =
        _searching ? _selectedSearchIds.length : _selectedThreadIds.length;

    return AppBar(
-      automaticallyImplyLeading: !menuAtBottom,
      leading: _selecting
          ? IconButton(
              icon: const Icon(Icons.close),
@@ -270,9 +261,9 @@ class _EmailListScreenState extends ConsumerState<EmailListScreen> {

  Widget _buildSyncButton(EmailRepository emailRepo) {
    final isSyncing =
-        ref.watch(isSyncingProvider(widget.accountId)).value ?? false;
+        ref.watch(isSyncingProvider(widget.accountId)).valueOrNull ?? false;
    final hasError =
-        ref.watch(syncLastErrorProvider(widget.accountId)).value != null;
+        ref.watch(syncLastErrorProvider(widget.accountId)).valueOrNull != null;
    return IconButton(
      tooltip: isSyncing
          ? 'Syncing…'
@@ -309,22 +300,6 @@ class _EmailListScreenState extends ConsumerState<EmailListScreen> {
    );
  }

-  Widget _folderNavBottomBar() {
-    return BottomAppBar(
-      child: Row(
-        children: [
-          Builder(
-            builder: (context) => IconButton(
-              icon: const Icon(Icons.menu),
-              tooltip: 'Open folders',
-              onPressed: () => Scaffold.of(context).openDrawer(),
-            ),
-          ),
-        ],
-      ),
-    );
-  }
-
  Widget _selectionBottomBar() {
    return BottomAppBar(
      child: Row(
@@ -375,7 +350,7 @@ class _EmailListScreenState extends ConsumerState<EmailListScreen> {

  Widget _buildSyncErrorBanner() {
    final errorAsync = ref.watch(syncLastErrorProvider(widget.accountId));
-    final error = errorAsync.value;
+    final error = errorAsync.valueOrNull;
    if (error == null || error == _dismissedError) {
      return const SizedBox.shrink();
    }
@@ -445,26 +420,24 @@ class _EmailListScreenState extends ConsumerState<EmailListScreen> {
    );
  }

-  Future<void> _batchMoveToRole(
-    String role, {
-    required String dialogTitle,
-    required String createFolderName,
-  }) async {
+  Future<void> _batchMoveToRole(String role, String notFoundMessage) async {
    final ids = _selectedEmailIds;
    _clearSelection();
-
-    final mailbox = await resolveMailboxByRole(
-      context,
-      ref.read(mailboxRepositoryProvider),
-      widget.accountId,
-      widget.mailboxPath,
-      role,
-      dialogTitle: dialogTitle,
-      createFolderName: createFolderName,
-    );
-
-    if (!mounted || mailbox == null) return;
-
+    final mailbox = await ref
+        .read(mailboxRepositoryProvider)
+        .findMailboxByRole(widget.accountId, role);
+    if (!mounted) return;
+    if (mailbox == null) {
+      ScaffoldMessenger.of(
+        context,
+      ).showSnackBar(
+        SnackBar(
+          duration: const Duration(seconds: 5),
+          content: Text(notFoundMessage),
+        ),
+      );
+      return;
+    }
    final repo = ref.read(emailRepositoryProvider);

    // Fetch full email data before moving so we can restore them if user clicks Undo.
@@ -490,11 +463,8 @@ class _EmailListScreenState extends ConsumerState<EmailListScreen> {
    unawaited(ref.read(undoServiceProvider.notifier).pushAction(action));
  }

-  Future<void> _batchArchive() => _batchMoveToRole(
-        'archive',
-        dialogTitle: 'No archive folder found',
-        createFolderName: 'Archive',
-      );
+  Future<void> _batchArchive() =>
+      _batchMoveToRole('archive', 'No archive folder found');

  Future<void> _refreshSearchAndPopIfEmpty() async {
    if (!mounted || !_searching) return;
@@ -573,11 +543,8 @@ class _EmailListScreenState extends ConsumerState<EmailListScreen> {
    }
  }

-  Future<void> _batchMarkSpam() => _batchMoveToRole(
-        'junk',
-        dialogTitle: 'No spam folder found',
-        createFolderName: 'Junk',
-      );
+  Future<void> _batchMarkSpam() =>
+      _batchMoveToRole('junk', 'No spam folder found');

  Future<void> _batchMove() async {
    final ids = _selectedEmailIds;
@@ -4,7 +4,6 @@ import 'package:go_router/go_router.dart';

 import 'package:sharedinbox/core/models/email.dart';
 import 'package:sharedinbox/core/models/mailbox.dart';
-import 'package:sharedinbox/core/models/user_preferences.dart';
 import 'package:sharedinbox/core/repositories/email_repository.dart';
 import 'package:sharedinbox/di.dart';
 import 'package:sharedinbox/ui/widgets/folder_drawer.dart';
@@ -18,12 +17,8 @@ class MailboxListScreen extends ConsumerWidget {
    final mailboxRepo = ref.watch(mailboxRepositoryProvider);
    final emailRepo = ref.watch(emailRepositoryProvider);
    final accountAsync = ref.watch(accountByIdProvider(accountId));
-    final prefs =
-        ref.watch(userPreferencesProvider).value ?? const UserPreferences();
-    final menuAtBottom = prefs.menuPosition == MenuPosition.bottom;
    return Scaffold(
      appBar: AppBar(
-        automaticallyImplyLeading: !menuAtBottom,
        title: const Text('Folders'),
        actions: [
          IconButton(
@@ -47,19 +42,6 @@ class MailboxListScreen extends ConsumerWidget {
        ],
      ),
      drawer: FolderDrawer(accountId: accountId),
-      bottomNavigationBar: menuAtBottom
-          ? BottomAppBar(
-              child: Row(
-                children: [
-                  IconButton(
-                    icon: const Icon(Icons.menu),
-                    tooltip: 'Open folders',
-                    onPressed: () => Scaffold.of(context).openDrawer(),
-                  ),
-                ],
-              ),
-            )
-          : null,
      body: Column(
        children: [
          // ── Failed-mutation banner ───────────────────────────────────────
@@ -1,15 +1,11 @@
 import 'dart:async';

 import 'package:flutter/material.dart';
-import 'package:flutter/services.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:intl/intl.dart';
-import 'package:package_info_plus/package_info_plus.dart';

-import 'package:sharedinbox/core/models/account.dart';
 import 'package:sharedinbox/core/repositories/sync_log_repository.dart';
 import 'package:sharedinbox/di.dart';
-import 'package:sharedinbox/ui/utils/about_markdown.dart';

 final _timeFmt = DateFormat('MMM d, HH:mm:ss');

@@ -25,57 +21,6 @@ String _fmtBytes(int bytes) {
  return '${(bytes / (1024 * 1024)).toStringAsFixed(1)} MB';
 }

-String _buildSyncEntryMarkdown(SyncLogEntry entry) {
-  final buf = StringBuffer();
-  buf.writeln('## Sync Entry');
-  buf.writeln();
-  buf.writeln('| Property | Value |');
-  buf.writeln('|----------|-------|');
-  buf.writeln('| Started | ${_timeFmt.format(entry.startedAt)} |');
-  buf.writeln('| Finished | ${_timeFmt.format(entry.finishedAt)} |');
-  buf.writeln('| Duration | ${_fmtDuration(entry.duration)} |');
-  if (entry.protocol.isNotEmpty) {
-    buf.writeln('| Protocol | ${entry.protocol.toUpperCase()} |');
-  }
-  final statusLabel = entry.isOk
-      ? 'OK'
-      : entry.isPermanent
-          ? 'Error (permanent)'
-          : 'Error';
-  buf.writeln('| Status | $statusLabel |');
-  buf.writeln('| Emails fetched | ${entry.emailsFetched} |');
-  buf.writeln('| Emails up-to-date | ${entry.emailsSkipped} |');
-  buf.writeln('| Mailboxes synced | ${entry.mailboxesSynced} |');
-  buf.writeln('| Pending changes flushed | ${entry.pendingFlushed} |');
-  buf.writeln('| Data transferred | ${_fmtBytes(entry.bytesTransferred)} |');
-  if (entry.mailboxStats.isNotEmpty) {
-    buf.writeln();
-    buf.writeln('### Per mailbox');
-    buf.writeln();
-    buf.writeln('| Mailbox | Fetched | Up-to-date | Duration |');
-    buf.writeln('|---------|---------|------------|----------|');
-    for (final m in entry.mailboxStats) {
-      final dur = m.duration != null ? _fmtDuration(m.duration!) : '-';
-      buf.writeln('| ${m.mailboxPath} | ${m.fetched} | ${m.skipped} | $dur |');
-    }
-  }
-  if (entry.errorMessage != null) {
-    buf.writeln();
-    buf.writeln('**Error:**');
-    buf.writeln();
-    buf.writeln(entry.errorMessage);
-  }
-  if (entry.stackTrace != null) {
-    buf.writeln();
-    buf.writeln('**Stack trace:**');
-    buf.writeln();
-    buf.writeln('```');
-    buf.write(entry.stackTrace);
-    buf.writeln('```');
-  }
-  return buf.toString();
-}
-
 class SyncLogScreen extends ConsumerStatefulWidget {
  const SyncLogScreen({super.key, required this.accountId});

@@ -124,41 +69,6 @@ class _SyncLogScreenState extends ConsumerState<SyncLogScreen> {
    ref.read(syncManagerProvider).syncNow(widget.accountId);
  }

-  Future<void> _copyEntry(SyncLogEntry entry, BuildContext context) async {
-    final accounts =
-        await ref.read(accountRepositoryProvider).observeAccounts().first;
-    final imapCount = accounts.where((a) => a.type == AccountType.imap).length;
-    final jmapCount = accounts.where((a) => a.type == AccountType.jmap).length;
-
-    PackageInfo? pkg;
-    try {
-      pkg = await PackageInfo.fromPlatform();
-    } catch (_) {}
-
-    final deviceModel = await getDeviceModel();
-
-    if (!context.mounted) return;
-
-    final syncMd = _buildSyncEntryMarkdown(entry);
-    final aboutMd = buildAboutMarkdown(
-      context: context,
-      pkg: pkg,
-      imapCount: imapCount,
-      jmapCount: jmapCount,
-      deviceModel: deviceModel,
-    );
-    await Clipboard.setData(ClipboardData(text: '$syncMd\n$aboutMd'));
-
-    if (context.mounted) {
-      ScaffoldMessenger.of(context).showSnackBar(
-        const SnackBar(
-          duration: Duration(seconds: 3),
-          content: Text('Copied to clipboard'),
-        ),
-      );
-    }
-  }
-
  @override
  Widget build(BuildContext context) {
    return Scaffold(
@@ -186,20 +96,16 @@ class _SyncLogScreenState extends ConsumerState<SyncLogScreen> {
          ? const Center(child: Text('No sync entries yet'))
          : ListView.builder(
              itemCount: _entries.length,
-              itemBuilder: (ctx, i) => _SyncLogTile(
-                entry: _entries[i],
-                onCopy: () => _copyEntry(_entries[i], ctx),
-              ),
+              itemBuilder: (ctx, i) => _SyncLogTile(entry: _entries[i]),
            ),
    );
  }
 }

 class _SyncLogTile extends StatelessWidget {
-  const _SyncLogTile({required this.entry, required this.onCopy});
+  const _SyncLogTile({required this.entry});

  final SyncLogEntry entry;
-  final VoidCallback onCopy;

  @override
  Widget build(BuildContext context) {
@@ -209,12 +115,6 @@ class _SyncLogTile extends StatelessWidget {
    final theme = Theme.of(context);
    final errorColor = theme.colorScheme.error;

-    final subtitleText = entry.isOk
-        ? '${entry.emailsFetched} new · ${entry.emailsSkipped} up-to-date · took $durationLabel'
-        : entry.isPermanent
-            ? 'Error (permanent) · took $durationLabel'
-            : 'Error · took $durationLabel';
-
    return ExpansionTile(
      leading: Icon(
        entry.isOk ? Icons.check_circle : Icons.error_outline,
@@ -225,20 +125,11 @@ class _SyncLogTile extends StatelessWidget {
        style: entry.isOk ? null : TextStyle(color: errorColor),
      ),
      subtitle: Text(
-        subtitleText,
+        entry.isOk
+            ? '${entry.emailsFetched} new · ${entry.emailsSkipped} up-to-date · took $durationLabel'
+            : 'Error · took $durationLabel',
        style: TextStyle(fontSize: 12, color: entry.isOk ? null : errorColor),
      ),
-      trailing: Row(
-        mainAxisSize: MainAxisSize.min,
-        children: [
-          IconButton(
-            icon: const Icon(Icons.copy, size: 18),
-            tooltip: 'Copy as markdown',
-            onPressed: onCopy,
-          ),
-          const Icon(Icons.expand_more),
-        ],
-      ),
      children: [
        Padding(
          padding: const EdgeInsets.fromLTRB(72, 0, 16, 12),
@@ -280,31 +171,6 @@ class _SyncLogTile extends StatelessWidget {
                    style: TextStyle(color: errorColor, fontSize: 12),
                  ),
                ),
-              if (entry.stackTrace != null) ...[
-                const Padding(
-                  padding: EdgeInsets.only(top: 6, bottom: 2),
-                  child: Text(
-                    'Stack trace',
-                    style: TextStyle(fontSize: 12, color: Colors.grey),
-                  ),
-                ),
-                Container(
-                  width: double.infinity,
-                  padding: const EdgeInsets.all(8),
-                  decoration: BoxDecoration(
-                    color: Colors.black87,
-                    borderRadius: BorderRadius.circular(4),
-                  ),
-                  child: Text(
-                    entry.stackTrace!,
-                    style: TextStyle(
-                      fontSize: 10,
-                      fontFamily: 'monospace',
-                      color: Colors.red[300],
-                    ),
-                  ),
-                ),
-              ],
              if (entry.protocolLog != null) ...[
                const Padding(
                  padding: EdgeInsets.only(top: 6, bottom: 2),
@@ -1,67 +0,0 @@
-import 'dart:async';
-
-import 'package:flutter/material.dart';
-import 'package:flutter_riverpod/flutter_riverpod.dart';
-
-import 'package:sharedinbox/core/models/user_preferences.dart';
-import 'package:sharedinbox/di.dart';
-
-class UserPreferencesScreen extends ConsumerWidget {
-  const UserPreferencesScreen({super.key});
-
-  @override
-  Widget build(BuildContext context, WidgetRef ref) {
-    final prefsAsync = ref.watch(userPreferencesProvider);
-
-    return Scaffold(
-      appBar: AppBar(title: const Text('Preferences')),
-      body: prefsAsync.when(
-        loading: () => const Center(child: CircularProgressIndicator()),
-        error: (_, __) =>
-            const Center(child: Text('Error loading preferences')),
-        data: (prefs) => ListView(
-          children: [
-            ListTile(
-              title: Text(
-                'Menu bar position',
-                style: Theme.of(context).textTheme.titleSmall,
-              ),
-              subtitle: const Text(
-                'Where the folder navigation menu is shown in the mailbox view.',
-              ),
-            ),
-            RadioGroup<MenuPosition>(
-              groupValue: prefs.menuPosition,
-              onChanged: (value) {
-                if (value == null) return;
-                unawaited(
-                  ref
-                      .read(userPreferencesRepositoryProvider)
-                      .updateMenuPosition(value),
-                );
-              },
-              child: const Column(
-                children: [
-                  RadioListTile<MenuPosition>(
-                    title: Text('Bottom (default)'),
-                    subtitle: Text(
-                      'Open folder navigation from a button at the bottom of the screen.',
-                    ),
-                    value: MenuPosition.bottom,
-                  ),
-                  RadioListTile<MenuPosition>(
-                    title: Text('Top'),
-                    subtitle: Text(
-                      'Open folder navigation from the hamburger icon in the top bar.',
-                    ),
-                    value: MenuPosition.top,
-                  ),
-                ],
-              ),
-            ),
-          ],
-        ),
-      ),
-    );
-  }
-}
@@ -1,75 +0,0 @@
-import 'dart:io';
-
-import 'package:device_info_plus/device_info_plus.dart';
-import 'package:flutter/material.dart';
-import 'package:package_info_plus/package_info_plus.dart';
-import 'package:sharedinbox/core/db_schema_version.dart';
-
-const _gitHash = String.fromEnvironment('GIT_HASH');
-
-/// Builds the About markdown table used in [AboutScreen] and sync log copies.
-String buildAboutMarkdown({
-  required BuildContext context,
-  PackageInfo? pkg,
-  required int imapCount,
-  required int jmapCount,
-  String? deviceModel,
-}) {
-  final size = MediaQuery.of(context).size;
-  final pixelRatio = MediaQuery.of(context).devicePixelRatio;
-  final physW = (size.width * pixelRatio).toInt();
-  final physH = (size.height * pixelRatio).toInt();
-  final version = pkg != null ? '${pkg.version}+${pkg.buildNumber}' : 'unknown';
-  final versionDisplay = _gitHash.isNotEmpty
-      ? '[$version](https://codeberg.org/guettli/sharedinbox/commit/$_gitHash)'
-      : version;
-  final osName = _capitalize(Platform.operatingSystem);
-  final isDark = MediaQuery.of(context).platformBrightness == Brightness.dark;
-  final locale = Localizations.localeOf(context).toString();
-  final textScale =
-      MediaQuery.of(context).textScaler.scale(1.0).toStringAsFixed(1);
-
-  final gitCommitLine = _gitHash.isNotEmpty
-      ? '| Git Commit | [$_gitHash](https://codeberg.org/guettli/sharedinbox/commit/$_gitHash) |\n'
-      : '';
-  final deviceModelLine =
-      deviceModel != null ? '| Device Model | $deviceModel |\n' : '';
-
-  return '## [sharedinbox.de](https://sharedinbox.de)\n\n'
-      '| Property | Value |\n'
-      '|----------|-------|\n'
-      '| App Version | $versionDisplay |\n'
-      '$gitCommitLine'
-      '| Platform | ${Platform.operatingSystem} |\n'
-      '| $osName Version | ${Platform.operatingSystemVersion} |\n'
-      '$deviceModelLine'
-      '| Resolution | ${physW}x$physH px'
-      ' (logical: ${size.width.toInt()}x${size.height.toInt()} pt,'
-      ' ratio: ${pixelRatio.toStringAsFixed(1)}x) |\n'
-      '| Dart Version | ${Platform.version.split(' ').first} |\n'
-      '| Processors | ${Platform.numberOfProcessors} |\n'
-      '| Dark Mode | ${isDark ? 'yes' : 'no'} |\n'
-      '| Locale | $locale |\n'
-      '| Text Scale | $textScale× |\n'
-      '| DB Schema Version | $dbSchemaVersion |\n'
-      '| IMAP Accounts | $imapCount |\n'
-      '| JMAP Accounts | $jmapCount |\n';
-}
-
-/// Fetches device model string, or null when unavailable.
-Future<String?> getDeviceModel() async {
-  try {
-    final info = DeviceInfoPlugin();
-    if (Platform.isAndroid) {
-      final android = await info.androidInfo;
-      return '${android.manufacturer} / ${android.model}';
-    } else if (Platform.isIOS) {
-      final ios = await info.iosInfo;
-      return ios.utsname.machine;
-    }
-  } catch (_) {}
-  return null;
-}
-
-String _capitalize(String s) =>
-    s.isEmpty ? s : '${s[0].toUpperCase()}${s.substring(1)}';
@@ -31,13 +31,10 @@ String buildEmailHtml(String htmlBody, {bool loadRemoteImages = false}) {
 <meta name="color-scheme" content="light">
 <meta http-equiv="Content-Security-Policy" content="$csp">
 <style>
-body { margin: 0; padding: 0; font-family: sans-serif; word-break: break-word; overflow-x: hidden; color-scheme: light; background-color: #ffffff; color: #000000; }
+body { margin: 0; padding: 0; font-family: sans-serif; word-break: break-word; color-scheme: light; background-color: #ffffff; color: #000000; }
 img { max-width: 100%; height: auto; }
 a { color: #1976D2; }
-* { box-sizing: border-box; max-width: 100%; }
-table { width: 100%; border-collapse: collapse; }
-td, th { overflow-wrap: break-word; word-break: break-word; }
-pre { white-space: pre-wrap; word-break: break-word; overflow-x: auto; }
+* { box-sizing: border-box; }
 </style>
 </head>
 <body>
@@ -19,15 +19,15 @@ dependencies:

  # Local persistence (offline-first)
  drift: ^2.20.3
-  sqlite3_flutter_libs: ^0.6.0+eol
+  sqlite3_flutter_libs: ^0.5.28
  path_provider: ^2.1.5
  path: ^1.9.1

  # State management
-  flutter_riverpod: ^3.0.0
+  flutter_riverpod: ^2.6.1

  # Navigation
-  go_router: ^17.2.3
+  go_router: ^14.8.1

  # Secure credential storage (passwords)
  flutter_secure_storage: ^10.0.0
@@ -36,7 +36,7 @@ dependencies:
  intl: any

  # File picking (compose attachments) and opening downloaded attachments
-  file_picker: ^12.0.0-beta.4
+  file_picker: ^8.0.0
  open_filex: ^4.6.0
  mime: ^2.0.0

@@ -47,35 +47,34 @@ dependencies:
  cryptography: ^2.7.0

  # QR code scanning (camera) for secure account import
-  mobile_scanner: ^7.2.0
+  mobile_scanner: ^5.0.0

  # HTML rendering for email bodies
  webview_flutter: ^4.0.0
  url_launcher: ^6.3.2
-  flutter_markdown_plus: ^1.0.7
+  flutter_markdown: ^0.7.7+1

  # Background sync and local notifications
-  flutter_local_notifications: ^21.0.0
+  flutter_local_notifications: ^18.0.1
  workmanager: ^0.9.0

  # App version metadata for crash reports
-  package_info_plus: ^10.1.0
-  share_plus: ^13.1.0
-  device_info_plus: ^13.1.0
+  package_info_plus: ^8.0.0
+  share_plus: ^12.0.2

 dev_dependencies:
  flutter_test:
    sdk: flutter
  integration_test:
    sdk: flutter
-  flutter_lints: ^6.0.0
+  flutter_lints: ^4.0.0
  drift_dev: ^2.20.3
  build_runner: ^2.4.13
  test: ^1.25.0
  mockito: ^5.4.4
  fake_async: ^1.3.1
  path_provider_platform_interface: ^2.1.2
-  sqlite3: ^3.1.5  # used directly in test/unit/db_test_helper.dart; 3.x required for Database.close()
+  sqlite3: any  # used directly in test/unit/db_test_helper.dart
  url_launcher_platform_interface: ^2.3.2
  plugin_platform_interface: ^2.1.8

@@ -85,12 +84,7 @@ flutter:
    - assets/

 dependency_overrides:
-  # path_provider_android 2.2.21 updated to Pigeon 26, which causes a
-  # channel-error on startup on some Android devices. 2.3+ uses package:jni
-  # (SIGSEGV in libdartjni.so FindClassUnchecked). Pin to 2.2.20 which uses
-  # stable Pigeon and is known to work reliably.
-  path_provider_android: ">=2.2.0 <2.2.21"
-  # url_launcher_android 6.3.25 updated to Pigeon 26, which causes a
-  # channel-error on launchUrl on some Android devices (same root cause as
-  # path_provider_android). Pin to <6.3.25 which uses stable Pigeon.
-  url_launcher_android: ">=6.3.0 <6.3.25"
+  # path_provider_android 2.3+ uses package:jni which crashes on startup
+  # (SIGSEGV in libdartjni.so FindClassUnchecked — JNI env not ready when
+  # the Dart VM first calls into it). Pin to 2.2.x which uses Pigeon instead.
+  path_provider_android: ">=2.2.0 <2.3.0"
@@ -1,16 +0,0 @@
-{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "config:recommended"
-  ],
-  "labels": ["dependencies"],
-  "github-actions": {
-    "fileMatch": ["^\\.forgejo/workflows/[^/]+\\.ya?ml$"]
-  },
-  "packageRules": [
-    {
-      "matchUpdateTypes": ["minor", "patch", "pin", "digest", "lockFileMaintenance"],
-      "addLabels": ["automerge"]
-    }
-  ]
-}
@@ -11,7 +11,6 @@ const _minCoveragePercent = 80;

 // Pure-abstract interfaces: no executable code, Dart VM never instruments them.
 const _noCode = {
-  'lib/core/db_schema_version.dart',
  'lib/core/repositories/account_repository.dart',
  'lib/core/repositories/draft_repository.dart',
  'lib/core/repositories/email_repository.dart',
@@ -20,9 +19,7 @@ const _noCode = {
  'lib/core/repositories/sync_log_repository.dart',
  'lib/core/repositories/undo_repository.dart',
  'lib/core/repositories/search_history_repository.dart',
-  'lib/core/repositories/user_preferences_repository.dart',
  'lib/core/models/undo_action.dart',
-  'lib/core/models/user_preferences.dart',
  'lib/core/storage/secure_storage.dart',
 };

@@ -60,8 +57,6 @@ const _excluded = {
  'lib/ui/widgets/try_connection_button.dart',
  'lib/ui/widgets/undo_shell.dart',
  'lib/ui/screens/about_screen.dart',
-  'lib/ui/screens/email_action_helpers.dart',
-  'lib/ui/utils/about_markdown.dart',
  'lib/ui/widgets/email_tile.dart',
  'lib/core/sync/account_sync_manager.dart',
  'lib/core/sync/background_sync.dart',
@@ -75,8 +70,6 @@ const _excluded = {
  'lib/data/repositories/sync_log_repository_impl.dart',
  'lib/data/repositories/undo_repository_impl.dart',
  'lib/data/repositories/search_history_repository_impl.dart',
-  'lib/data/repositories/user_preferences_repository_impl.dart',
-  'lib/ui/screens/user_preferences_screen.dart',
  'lib/core/services/update_service.dart',
 };

@@ -5,14 +5,7 @@ set -euo pipefail
 cd "$(git rev-parse --show-toplevel)"

 echo "check-mocks: regenerating..."
-tmp=$(mktemp)
-trap 'rm -f "$tmp"' EXIT
-if fvm flutter pub run build_runner build --delete-conflicting-outputs >"$tmp" 2>&1; then
-  grep -vE '^\[' "$tmp" || true
-else
-  cat "$tmp"
-  exit 1
-fi
+fvm flutter pub run build_runner build --delete-conflicting-outputs 2>&1

 CHANGED=$(git diff --name-only -- '*.mocks.dart')
 if [ -n "$CHANGED" ]; then
@@ -6,49 +6,71 @@ import os
 import sys
 import time

+import requests
 from google.auth.transport.requests import AuthorizedSession
 from google.oauth2 import service_account

 PACKAGE_NAME = "de.sharedinbox.mua"
 AAB_PATH = "build/app/outputs/bundle/release/app-release.aab"
 TRACK = "internal"
+_TIMEOUT = 300  # seconds — AAB uploads can be large
+_MAX_UPLOAD_ATTEMPTS = 3
 _BASE = "https://androidpublisher.googleapis.com/androidpublisher/v3/applications"
 _UPLOAD_BASE = "https://androidpublisher.googleapis.com/upload/androidpublisher/v3/applications"
-_MAX_UPLOAD_ATTEMPTS = 3


-def _upload_aab_resumable(session, package, edit_id, aab_path):
-    """Upload AAB using the Google resumable upload protocol."""
-    file_size = os.path.getsize(aab_path)
-    init_url = f"{_UPLOAD_BASE}/{package}/edits/{edit_id}/bundles"
+def _make_session(config_json: str) -> AuthorizedSession:
+    creds = service_account.Credentials.from_service_account_info(
+        json.loads(config_json),
+        scopes=["https://www.googleapis.com/auth/androidpublisher"],
+    )
+    return AuthorizedSession(creds)
+
+
+def _upload_aab(session: AuthorizedSession, edit_id: str) -> int:
+    """Resumable upload of the AAB. Returns the version code."""
+    file_size = os.path.getsize(AAB_PATH)

-    # Step 1: initiate the resumable upload session
    init_resp = session.post(
-        init_url,
+        f"{_UPLOAD_BASE}/{PACKAGE_NAME}/edits/{edit_id}/bundles",
        params={"uploadType": "resumable"},
        headers={
            "X-Upload-Content-Type": "application/octet-stream",
            "X-Upload-Content-Length": str(file_size),
-            "Content-Length": "0",
        },
-        timeout=60,
+        json={},
+        timeout=30,
    )
    init_resp.raise_for_status()
    upload_url = init_resp.headers["Location"]

-    # Step 2: upload the file in a single PUT to the session URI
-    with open(aab_path, "rb") as f:
-        upload_resp = session.put(
-            upload_url,
-            data=f,
-            headers={
-                "Content-Type": "application/octet-stream",
-                "Content-Length": str(file_size),
-            },
-            timeout=600,
-        )
-    upload_resp.raise_for_status()
-    return upload_resp.json()
+    with open(AAB_PATH, "rb") as f:
+        data = f.read()
+
+    last_exc = None
+    for attempt in range(_MAX_UPLOAD_ATTEMPTS):
+        try:
+            upload_resp = session.put(
+                upload_url,
+                data=data,
+                headers={
+                    "Content-Type": "application/octet-stream",
+                    "Content-Length": str(file_size),
+                },
+                timeout=_TIMEOUT,
+            )
+            upload_resp.raise_for_status()
+            return upload_resp.json()["versionCode"]
+        except requests.HTTPError as exc:
+            last_exc = exc
+            if attempt < _MAX_UPLOAD_ATTEMPTS - 1:
+                delay = 10 * (2 ** attempt)
+                print(f"Upload attempt {attempt + 1} failed ({exc}), retrying in {delay}s…")
+                time.sleep(delay)
+
+    raise RuntimeError(
+        f"AAB upload failed after {_MAX_UPLOAD_ATTEMPTS} attempts"
+    ) from last_exc


 def main():
@@ -61,45 +83,25 @@ def main():
        print(f"Error: AAB not found at {AAB_PATH}", file=sys.stderr)
        sys.exit(1)

-    creds = service_account.Credentials.from_service_account_info(
-        json.loads(config_json),
-        scopes=["https://www.googleapis.com/auth/androidpublisher"],
-    )
-    session = AuthorizedSession(creds)
+    session = _make_session(config_json)

-    edit_resp = session.post(f"{_BASE}/{PACKAGE_NAME}/edits", json={}, timeout=30)
+    edit_resp = session.post(
+        f"{_BASE}/{PACKAGE_NAME}/edits",
+        json={},
+        timeout=30,
+    )
    edit_resp.raise_for_status()
    edit_id = edit_resp.json()["id"]

-    last_exc = None
-    bundle = None
-    for attempt in range(_MAX_UPLOAD_ATTEMPTS):
-        try:
-            bundle = _upload_aab_resumable(session, PACKAGE_NAME, edit_id, AAB_PATH)
-            break
-        except Exception as exc:
-            last_exc = exc
-            if attempt < _MAX_UPLOAD_ATTEMPTS - 1:
-                delay = 10 * (2 ** attempt)
-                print(
-                    f"Upload attempt {attempt + 1} failed ({type(exc).__name__}: {exc}), "
-                    f"retrying in {delay}s…"
-                )
-                time.sleep(delay)
-    if bundle is None:
-        raise RuntimeError(
-            f"AAB upload failed after {_MAX_UPLOAD_ATTEMPTS} attempts"
-        ) from last_exc
-
-    version_code = bundle["versionCode"]
+    version_code = _upload_aab(session, edit_id)
    print(f"Uploaded AAB, version code: {version_code}")

-    track_resp = session.put(
+    tracks_resp = session.put(
        f"{_BASE}/{PACKAGE_NAME}/edits/{edit_id}/tracks/{TRACK}",
        json={"releases": [{"versionCodes": [version_code], "status": "completed"}]},
        timeout=30,
    )
-    track_resp.raise_for_status()
+    tracks_resp.raise_for_status()

    commit_resp = session.post(
        f"{_BASE}/{PACKAGE_NAME}/edits/{edit_id}:commit",
@@ -33,20 +33,15 @@ def list_remote_files(ssh_user: str, ssh_host: str, pattern: str) -> list[str]:
    result = subprocess.run(
        [
            "ssh",
+            "-o",
+            "StrictHostKeyChecking=no",
            f"{ssh_user}@{ssh_host}",
            f"find {REMOTE_BUILDS_DIR} -name '{pattern}' -type f | sort",
        ],
        capture_output=True,
        text=True,
+        check=True,
    )
-    if result.returncode != 0:
-        print(
-            f"WARNING: ssh exit {result.returncode} listing {pattern} on {ssh_user}@{ssh_host}"
-            " — build history will be empty for this pattern",
-            file=sys.stderr,
-        )
-        print(result.stderr, file=sys.stderr)
-        return []
    return [line.strip() for line in result.stdout.splitlines() if line.strip()]


@@ -1,54 +0,0 @@
-#!/usr/bin/env bash
-# Runs the Firebase Test Lab Dagger pipeline with Gradle/Dagger noise filtered out.
-# Retries up to 3 times on transient Dagger engine connectivity errors.
-set -uo pipefail
-
-OUT=$(mktemp)
-RC_FILE=$(mktemp)
-trap 'rm -f "$OUT" "$RC_FILE"' EXIT
-
-_strip_ansi() {
-    sed 's/\x1b\[[0-9;]*[mGKHFJ]//g'
-}
-
-_filter_noise() {
-    grep -vE \
-        '> Task :.+(UP-TO-DATE|NO-SOURCE|SKIPPED)'\
-'|[0-9]+ files found for path '\''lib/'\
-'|^Inputs:'\
-'|^[[:space:]]+-[[:space:]]/'\
-'|\[Incubating\]'\
-'|Deprecated Gradle features'\
-'|warning-mode all'\
-'|please refer to https://docs\.gradle'\
-'|[0-9]+ actionable tasks'\
-'|^warning: \[options\]'\
-'|^Note: Some input files'\
-'|Starting a Gradle Daemon'\
-'|Have questions, feedback, or issues'\
-'|https://firebase\.google\.com/support'\
-'|^\s*[┆│]\s*$' \
-    || true
-}
-
-_run() {
-    : > "$OUT" ; : > "$RC_FILE"
-    {
-        dagger call --progress=plain -q -m ci --source=. test-android-firebase \
-            --service-account-key env:FIREBASE_TEST_LAB_SERVICE_ACCOUNT_KEY \
-            --project-id "$FIREBASE_PROJECT_ID"
-        echo $? > "$RC_FILE"
-    } 2>&1 | tee "$OUT" | _strip_ansi | _filter_noise
-}
-
-for attempt in 1 2 3; do
-    _run && break
-    RC=$(cat "$RC_FILE" 2>/dev/null || echo 1)
-    if [ "$attempt" -lt 3 ] && grep -qE "connection reset|context canceled|connection refused|No Dagger server responded" "$OUT"; then
-        echo "[firebase] dagger connectivity error on attempt $attempt/3, retrying..." >&2
-    else
-        exit "$RC"
-    fi
-done
-
-exit "$(cat "$RC_FILE" 2>/dev/null || echo 0)"
@@ -1,102 +0,0 @@
-#!/usr/bin/env bash
-# Establishes a secure tunnel to a remote Dagger Engine via stunnel.
-set -euo pipefail
-
-if [ -z "${DAGGER_STUNNEL_URL:-}" ]; then
-    echo "Error: DAGGER_STUNNEL_URL must be set."
-    exit 1
-fi
-
-# Parse host and port (e.g., example.com:8774 or just example.com)
-host=$(echo "$DAGGER_STUNNEL_URL" | cut -d: -f1)
-port=$(echo "$DAGGER_STUNNEL_URL" | cut -d: -f2)
-if [ "$host" == "$port" ]; then
-    port="8774"
-fi
-
-MAX_PROBE_ATTEMPTS=5
-PROBE_DELAY=30
-for attempt in $(seq 1 $MAX_PROBE_ATTEMPTS); do
-    echo "Probing $host:$port (attempt $attempt/$MAX_PROBE_ATTEMPTS)..."
-    if nc -zw 5 "$host" "$port" 2>/dev/null; then
-        echo "Found active server on $host:$port"
-        break
-    fi
-    if [ "$attempt" -eq "$MAX_PROBE_ATTEMPTS" ]; then
-        echo "Warning: No Dagger server responded on $host:$port after $MAX_PROBE_ATTEMPTS attempts"
-        echo "Remote engine unavailable — CI will use the local Dagger engine."
-        exit 0
-    fi
-    echo "Dagger server not responding, waiting ${PROBE_DELAY}s before retry..."
-    sleep $PROBE_DELAY
-done
-
-# 2a. Try plain TCP connection first (works when server is a plain TCP proxy, no TLS)
-echo "Trying plain TCP Dagger connection at tcp://$host:$port..."
-if _DAGGER_RUNNER_HOST="tcp://$host:$port" \
-   _EXPERIMENTAL_DAGGER_RUNNER_HOST="tcp://$host:$port" \
-   timeout 8 dagger version >/dev/null 2>&1; then
-    echo "Plain TCP Dagger connection succeeded — no TLS stunnel needed."
-    if [ -n "${GITHUB_ENV:-}" ]; then
-        echo "_EXPERIMENTAL_DAGGER_RUNNER_HOST=tcp://$host:$port" >> "$GITHUB_ENV"
-        echo "_DAGGER_RUNNER_HOST=tcp://$host:$port" >> "$GITHUB_ENV"
-    else
-        export _EXPERIMENTAL_DAGGER_RUNNER_HOST="tcp://$host:$port"
-        export _DAGGER_RUNNER_HOST="tcp://$host:$port"
-        echo "Dagger configured at tcp://$host:$port (plain TCP)"
-    fi
-    exit 0
-fi
-echo "Plain TCP connection not available; trying TLS stunnel..."
-
-# 2b. Setup TLS credentials (passed as env vars from secrets)
-mkdir -p /tmp/dagger-tls
-echo "$DAGGER_CA_CERT" > /tmp/dagger-tls/ca.crt
-echo "$DAGGER_CLIENT_CERT" > /tmp/dagger-tls/client.crt
-echo "$DAGGER_CLIENT_KEY" > /tmp/dagger-tls/client.key
-chmod 600 /tmp/dagger-tls/client.key
-
-# 3. Configure and start stunnel
-STUNNEL_CONF="/tmp/stunnel-dagger.conf"
-cat << EOF > "$STUNNEL_CONF"
-client = yes
-foreground = yes
-pid = /tmp/stunnel.pid
-debug = warning
-; TCP keepalive on the remote side to prevent NAT/firewall from resetting the connection
-socket = r:SO_KEEPALIVE=1
-socket = r:TCP_KEEPIDLE=10
-socket = r:TCP_KEEPINTVL=5
-socket = r:TCP_KEEPCNT=3
-
-[dagger]
-accept = 127.0.0.1:1774
-connect = $host:$port
-CAfile = /tmp/dagger-tls/ca.crt
-cert = /tmp/dagger-tls/client.crt
-key = /tmp/dagger-tls/client.key
-verifyChain = yes
-EOF
-
-# Start stunnel in the background
-stunnel "$STUNNEL_CONF" &
-TUNNEL_PID=$!
-
-# Give it a moment to establish
-sleep 2
-
-if ! kill -0 "$TUNNEL_PID" 2>/dev/null; then
-    echo "Error: stunnel failed to start"
-    exit 1
-fi
-
-# 4. Export environment for subsequent CI steps
-if [ -n "${GITHUB_ENV:-}" ]; then
-    echo "_EXPERIMENTAL_DAGGER_RUNNER_HOST=tcp://127.0.0.1:1774" >> "$GITHUB_ENV"
-    echo "_DAGGER_RUNNER_HOST=tcp://127.0.0.1:1774" >> "$GITHUB_ENV"
-    echo "Tunnel established. Dagger is configured to use the remote engine."
-else
-    export _EXPERIMENTAL_DAGGER_RUNNER_HOST=tcp://127.0.0.1:1774
-    export _DAGGER_RUNNER_HOST=tcp://127.0.0.1:1774
-    echo "Tunnel established. Run: export _DAGGER_RUNNER_HOST=tcp://127.0.0.1:1774"
-fi
@@ -1,12 +1,10 @@
 #!/usr/bin/env python3
 """Tests for agent_loop.py."""
-import contextlib
 import io
 import json
 import os
 import tempfile
 import unittest
-from datetime import datetime, timedelta, timezone
 from pathlib import Path
 from unittest.mock import MagicMock, patch

@@ -16,16 +14,6 @@ sys.path.insert(0, str(Path(__file__).parent))
 import agent_loop


-class TestUrlHelpers(unittest.TestCase):
-    def test_issue_url(self):
-        url = agent_loop._issue_url(128)
-        self.assertEqual(url, "https://codeberg.org/guettli/sharedinbox/issues/128")
-
-    def test_ci_run_url(self):
-        url = agent_loop._ci_run_url(4145144)
-        self.assertEqual(url, "https://codeberg.org/guettli/sharedinbox/actions/runs/4145144")
-
-
 class TestStateFile(unittest.TestCase):
    def setUp(self):
        self._tmp = tempfile.NamedTemporaryFile(delete=False, suffix=".json")
@@ -66,16 +54,6 @@ class TestStateFile(unittest.TestCase):
        agent_loop._clear_state()
        self.assertIsNone(agent_loop._read_state())

-    def test_write_state_stores_issue_title(self):
-        agent_loop._write_state(42, 10, "issue", "My Test Issue")
-        data = json.loads(Path(self._tmp.name).read_text())
-        self.assertEqual(data["issue_title"], "My Test Issue")
-
-    def test_write_state_omits_issue_title_when_none(self):
-        agent_loop._write_state(42, None, "ci-fix")
-        data = json.loads(Path(self._tmp.name).read_text())
-        self.assertNotIn("issue_title", data)
-

 class TestAgentAlive(unittest.TestCase):
    def test_own_pid_is_alive(self):
@@ -89,47 +67,21 @@ class TestAgentAlive(unittest.TestCase):
        self.assertFalse(agent_loop._agent_alive({"pid": None}))


-class TestIsClaudeProcess(unittest.TestCase):
-    def test_returns_true_for_claude_comm(self):
-        with patch.object(agent_loop.Path, "read_text", return_value="claude\n"):
-            self.assertTrue(agent_loop._is_claude_process(1234))
-
-    def test_returns_true_for_node_comm(self):
-        with patch.object(agent_loop.Path, "read_text", return_value="node\n"):
-            self.assertTrue(agent_loop._is_claude_process(1234))
-
-    def test_returns_false_for_other_process(self):
-        with patch.object(agent_loop.Path, "read_text", return_value="bash\n"):
-            self.assertFalse(agent_loop._is_claude_process(1234))
-
-    def test_returns_false_when_proc_missing(self):
-        with patch.object(agent_loop.Path, "read_text", side_effect=OSError):
-            self.assertFalse(agent_loop._is_claude_process(1234))
-
-
 class TestKillAgent(unittest.TestCase):
    def test_kill_sends_sigkill(self):
-        with patch("agent_loop._is_claude_process", return_value=True):
-            with patch("agent_loop.os.kill") as mock_kill:
-                agent_loop._kill_agent({"pid": 1234})
-                mock_kill.assert_called_once_with(1234, 9)
+        with patch("agent_loop.os.kill") as mock_kill:
+            agent_loop._kill_agent({"pid": 1234})
+            mock_kill.assert_called_once_with(1234, 9)

    def test_kill_ignores_missing_process(self):
-        with patch("agent_loop._is_claude_process", return_value=True):
-            with patch("agent_loop.os.kill", side_effect=ProcessLookupError):
-                agent_loop._kill_agent({"pid": 1234})  # Should not raise.
+        with patch("agent_loop.os.kill", side_effect=ProcessLookupError):
+            agent_loop._kill_agent({"pid": 1234})  # Should not raise.

    def test_kill_noop_when_no_pid(self):
        with patch("agent_loop.os.kill") as mock_kill:
            agent_loop._kill_agent({})
            mock_kill.assert_not_called()

-    def test_kill_skips_recycled_pid(self):
-        with patch("agent_loop._is_claude_process", return_value=False):
-            with patch("agent_loop.os.kill") as mock_kill:
-                agent_loop._kill_agent({"pid": 1234})
-                mock_kill.assert_not_called()
-

 class TestStartAgent(unittest.TestCase):
    def _make_mock_proc(self, pid=42):
@@ -201,13 +153,12 @@ class TestMain(unittest.TestCase):
            return 55

        with patch("agent_loop._read_state", return_value=None), \
-             patch("agent_loop._open_issue_prs", return_value=[]), \
-             patch("agent_loop._latest_main_ci_run", return_value=None), \
+             patch("agent_loop._latest_ci_run", return_value=None), \
             patch("agent_loop._ready_issues", return_value=[self._make_issue(10)]), \
             patch("agent_loop._set_labels", side_effect=fake_set_labels), \
             patch("agent_loop._start_agent", side_effect=fake_start_agent), \
             patch("agent_loop._write_state"):
-            result = agent_loop._run_loop()
+            result = agent_loop.main()

        self.assertEqual(result, 0)
        labels_idx = next(
@@ -228,13 +179,12 @@ class TestMain(unittest.TestCase):
            captured["remove"] = remove

        with patch("agent_loop._read_state", return_value=None), \
-             patch("agent_loop._open_issue_prs", return_value=[]), \
-             patch("agent_loop._latest_main_ci_run", return_value=None), \
+             patch("agent_loop._latest_ci_run", return_value=None), \
             patch("agent_loop._ready_issues", return_value=[self._make_issue(7)]), \
             patch("agent_loop._set_labels", side_effect=fake_set_labels), \
             patch("agent_loop._start_agent", return_value=99), \
             patch("agent_loop._write_state"):
-            agent_loop._run_loop()
+            agent_loop.main()

        self.assertIn(agent_loop.LABEL_IN_PROGRESS, captured.get("add", []))
        self.assertIn(agent_loop.LABEL_READY, captured.get("remove", []))
@@ -242,697 +192,16 @@ class TestMain(unittest.TestCase):
    def test_no_ready_issues_does_nothing(self):
        """main() exits cleanly with 0 when there are no ready issues."""
        with patch("agent_loop._read_state", return_value=None), \
-             patch("agent_loop._open_issue_prs", return_value=[]), \
-             patch("agent_loop._latest_main_ci_run", return_value=None), \
+             patch("agent_loop._latest_ci_run", return_value=None), \
             patch("agent_loop._ready_issues", return_value=[]), \
             patch("agent_loop._set_labels") as mock_labels, \
             patch("agent_loop._start_agent") as mock_start:
-            result = agent_loop._run_loop()
+            result = agent_loop.main()

        self.assertEqual(result, 0)
        mock_labels.assert_not_called()
        mock_start.assert_not_called()

-    def test_prompt_does_not_tell_agent_to_close_issue(self):
-        """Agents must not close issues; the loop handles closing after CI passes."""
-        captured_prompt = {}
-
-        def fake_start_agent(prompt, session_name):
-            captured_prompt["prompt"] = prompt
-            return 77
-
-        with patch("agent_loop._read_state", return_value=None), \
-             patch("agent_loop._open_issue_prs", return_value=[]), \
-             patch("agent_loop._latest_main_ci_run", return_value=None), \
-             patch("agent_loop._ready_issues", return_value=[self._make_issue(42)]), \
-             patch("agent_loop._set_labels"), \
-             patch("agent_loop._start_agent", side_effect=fake_start_agent), \
-             patch("agent_loop._write_state"):
-            agent_loop._run_loop()
-
-        prompt = captured_prompt.get("prompt", "")
-        # "do NOT close the issue" (blocker instruction) is fine; what must be
-        # absent is any affirmative instruction to close on completion.
-        self.assertNotIn("close the issue and stop", prompt.lower())
-
-
-class TestPendingCi(unittest.TestCase):
-    """Tests for the pending-CI state: issue closed only after CI passes."""
-
-    def _dead_state(self, issue: int, kind: str = "issue") -> dict:
-        return {
-            "pid": 999999999,  # non-existent PID
-            "issue": issue,
-            "started_at": "2026-01-01T00:00:00+00:00",
-            "type": kind,
-        }
-
-    def _open_pr(self, branch: str = "issue-10-fix") -> dict:
-        return {"number": 5, "head": {"ref": branch}, "created_at": "2026-01-01T00:00:00+00:00"}
-
-    def _find_pr_open(self, branch, state="open"):
-        if state == "open":
-            return self._open_pr(branch)
-        return None
-
-    def test_closes_issue_when_ci_passes_after_agent_finishes(self):
-        """After issue agent finishes, loop merges the PR and closes the issue once CI is green."""
-        # First call: PR found open. Second call (post-merge verification): PR closed.
-        with patch("agent_loop._read_state", return_value=self._dead_state(10)), \
-             patch("agent_loop._find_pr_for_branch", side_effect=[self._open_pr(), None]), \
-             patch("agent_loop._latest_ci_run_for_branch", return_value={"id": 1, "status": "success"}), \
-             patch("agent_loop._merge_pr") as mock_merge, \
-             patch("agent_loop._close_issue") as mock_close, \
-             patch("agent_loop._clear_state"):
-            result = agent_loop._run_loop()
-
-        self.assertEqual(result, 0)
-        mock_merge.assert_called_once_with(5)
-        mock_close.assert_called_once_with(10)
-
-    def test_ci_passed_output_includes_ci_run_url(self):
-        """'CI passed' line includes the CI run URL when a run is available."""
-        buf = io.StringIO()
-        with patch("agent_loop._read_state", return_value=self._dead_state(10)), \
-             patch("agent_loop._find_pr_for_branch", side_effect=[self._open_pr(), None]), \
-             patch("agent_loop._latest_ci_run_for_branch", return_value={"id": 4145144, "status": "success"}), \
-             patch("agent_loop._merge_pr"), \
-             patch("agent_loop._close_issue"), \
-             patch("agent_loop._clear_state"), \
-             contextlib.redirect_stdout(buf):
-            agent_loop._run_loop()
-        output = buf.getvalue()
-        self.assertIn("https://codeberg.org/guettli/sharedinbox/actions/runs/4145144", output)
-        self.assertIn("https://codeberg.org/guettli/sharedinbox/issues/10", output)
-
-    def test_already_merged_pr_closes_issue_without_ci_url(self):
-        """When the PR was already merged, the issue is closed and no CI run URL appears."""
-        def find_pr(branch, state="open"):
-            if state == "closed":
-                return {"number": 5, "merged": True}
-            return None
-
-        buf = io.StringIO()
-        with patch("agent_loop._read_state", return_value=self._dead_state(10)), \
-             patch("agent_loop._find_pr_for_branch", side_effect=find_pr), \
-             patch("agent_loop._close_issue") as mock_close, \
-             patch("agent_loop._clear_state"), \
-             contextlib.redirect_stdout(buf):
-            result = agent_loop._run_loop()
-        output = buf.getvalue()
-        self.assertEqual(result, 0)
-        mock_close.assert_called_once_with(10)
-        self.assertIn("already merged", output)
-        self.assertNotIn("/actions/runs/", output)
-
-    def test_no_pr_found_sets_question_label(self):
-        """When no open or merged PR exists for the pending branch, set State/Question."""
-        with patch("agent_loop._read_state", return_value=self._dead_state(10)), \
-             patch("agent_loop._find_pr_for_branch", return_value=None), \
-             patch("agent_loop._set_labels") as mock_labels, \
-             patch("agent_loop._comment_issue") as mock_comment, \
-             patch("agent_loop._close_issue") as mock_close, \
-             patch("agent_loop._clear_state"):
-            result = agent_loop._run_loop()
-
-        self.assertEqual(result, 0)
-        mock_close.assert_not_called()
-        mock_labels.assert_called_once_with(
-            10,
-            add=[agent_loop.LABEL_QUESTION],
-            remove=[agent_loop.LABEL_IN_PROGRESS],
-        )
-        mock_comment.assert_called_once()
-        self.assertIn("issue-10-fix", mock_comment.call_args[0][1])
-
-    def test_does_not_close_issue_when_ci_fails(self):
-        """After issue agent finishes, loop must NOT close the issue if CI failed on PR branch."""
-        with patch("agent_loop._read_state", return_value=self._dead_state(10)), \
-             patch("agent_loop._find_pr_for_branch", side_effect=self._find_pr_open), \
-             patch("agent_loop._latest_ci_run_for_branch", return_value={"id": 1, "status": "failure"}), \
-             patch("agent_loop._close_issue") as mock_close, \
-             patch("agent_loop._start_agent", return_value=55), \
-             patch("agent_loop._write_state"), \
-             patch("agent_loop._clear_state"):
-            result = agent_loop._run_loop()
-
-        self.assertEqual(result, 0)
-        mock_close.assert_not_called()
-
-    def test_saves_pending_ci_state_while_ci_running(self):
-        """When CI is still running on PR branch after agent finishes, pending issue is preserved."""
-        written = {}
-
-        def fake_write_state(pid, issue, kind, issue_title=None, session_name=None, ci_run_id=None):
-            written["pid"] = pid
-            written["issue"] = issue
-            written["kind"] = kind
-
-        with patch("agent_loop._read_state", return_value=self._dead_state(10)), \
-             patch("agent_loop._find_pr_for_branch", side_effect=self._find_pr_open), \
-             patch("agent_loop._latest_ci_run_for_branch", return_value={"id": 1, "status": "running"}), \
-             patch("agent_loop._write_state", side_effect=fake_write_state), \
-             patch("agent_loop._clear_state"):
-            result = agent_loop._run_loop()
-
-        self.assertEqual(result, 0)
-        self.assertEqual(written.get("issue"), 10)
-        self.assertEqual(written.get("kind"), "pending-ci")
-        self.assertIsNone(written.get("pid"))
-
-    def test_ci_fix_preserves_pending_issue_in_state(self):
-        """When CI fails on PR branch after agent finishes, ci-fix state includes the pending issue."""
-        written = {}
-
-        def fake_write_state(pid, issue, kind, issue_title=None, session_name=None, ci_run_id=None):
-            written["pid"] = pid
-            written["issue"] = issue
-            written["kind"] = kind
-
-        with patch("agent_loop._read_state", return_value=self._dead_state(10)), \
-             patch("agent_loop._find_pr_for_branch", side_effect=self._find_pr_open), \
-             patch("agent_loop._latest_ci_run_for_branch", return_value={"id": 1, "status": "failure"}), \
-             patch("agent_loop._start_agent", return_value=55), \
-             patch("agent_loop._write_state", side_effect=fake_write_state), \
-             patch("agent_loop._clear_state"):
-            result = agent_loop._run_loop()
-
-        self.assertEqual(result, 0)
-        self.assertEqual(written.get("issue"), 10)
-        self.assertEqual(written.get("kind"), "ci-fix")
-
-    def test_closes_issue_after_ci_fix_and_ci_passes(self):
-        """After ci-fix agent finishes and CI passes on PR branch, the pending issue is closed."""
-        with patch("agent_loop._read_state", return_value=self._dead_state(10, "ci-fix")), \
-             patch("agent_loop._find_pr_for_branch", side_effect=[self._open_pr(), None]), \
-             patch("agent_loop._latest_ci_run_for_branch", return_value={"id": 1, "status": "success"}), \
-             patch("agent_loop._merge_pr") as mock_merge, \
-             patch("agent_loop._close_issue") as mock_close, \
-             patch("agent_loop._clear_state"):
-            result = agent_loop._run_loop()
-
-        self.assertEqual(result, 0)
-        mock_merge.assert_called_once_with(5)
-        mock_close.assert_called_once_with(10)
-
-    def test_no_pending_issue_ci_fix_without_issue(self):
-        """ci-fix for a manual push (no pending issue) does not try to close anything."""
-        with patch("agent_loop._read_state", return_value={
-            "pid": 999999999, "issue": None, "started_at": "2026-01-01T00:00:00+00:00",
-            "type": "ci-fix",
-        }), \
-             patch("agent_loop._open_issue_prs", return_value=[]), \
-             patch("agent_loop._latest_main_ci_run", return_value={"id": 1, "status": "success"}), \
-             patch("agent_loop._close_issue") as mock_close, \
-             patch("agent_loop._ready_issues", return_value=[]), \
-             patch("agent_loop._clear_state"):
-            result = agent_loop._run_loop()
-
-        self.assertEqual(result, 0)
-        mock_close.assert_not_called()
-
-
-class TestOutputFormat(unittest.TestCase):
-    """Verify output format: no [agent_loop] prefix, URLs in output."""
-
-    def test_output_starts_with_header(self):
-        buf = io.StringIO()
-        with patch("agent_loop._read_state", return_value=None), \
-             patch("agent_loop._open_issue_prs", return_value=[]), \
-             patch("agent_loop._latest_main_ci_run", return_value=None), \
-             patch("agent_loop._ready_issues", return_value=[]), \
-             contextlib.redirect_stdout(buf):
-            agent_loop._run_loop()
-        first_line = buf.getvalue().splitlines()[0]
-        self.assertTrue(first_line.startswith("---------------------- Starting "),
-                        f"Unexpected first line: {first_line!r}")
-
-    def test_no_agent_loop_prefix_in_output(self):
-        buf = io.StringIO()
-        with patch("agent_loop._read_state", return_value=None), \
-             patch("agent_loop._open_issue_prs", return_value=[]), \
-             patch("agent_loop._latest_main_ci_run", return_value=None), \
-             patch("agent_loop._ready_issues", return_value=[]), \
-             contextlib.redirect_stdout(buf):
-            agent_loop._run_loop()
-        self.assertNotIn("[agent_loop]", buf.getvalue())
-
-    def test_ci_run_output_contains_url(self):
-        run = {"id": 4145144, "status": "running"}
-        buf = io.StringIO()
-        with patch("agent_loop._read_state", return_value=None), \
-             patch("agent_loop._open_issue_prs", return_value=[]), \
-             patch("agent_loop._latest_main_ci_run", return_value=run), \
-             contextlib.redirect_stdout(buf):
-            agent_loop._run_loop()
-        self.assertIn("https://codeberg.org/guettli/sharedinbox/actions/runs/4145144",
-                      buf.getvalue())
-
-    def test_issue_output_contains_url_and_title(self):
-        issue = {"number": 128, "title": "Fix something", "body": "", "labels": []}
-        buf = io.StringIO()
-        with patch("agent_loop._read_state", return_value=None), \
-             patch("agent_loop._open_issue_prs", return_value=[]), \
-             patch("agent_loop._latest_main_ci_run", return_value=None), \
-             patch("agent_loop._ready_issues", return_value=[issue]), \
-             patch("agent_loop._set_labels"), \
-             patch("agent_loop._start_agent", return_value=99), \
-             patch("agent_loop._write_state"), \
-             contextlib.redirect_stdout(buf):
-            agent_loop._run_loop()
-        output = buf.getvalue()
-        self.assertIn("https://codeberg.org/guettli/sharedinbox/issues/128", output)
-        self.assertIn("Fix something", output)
-
-
-class TestLatestMainCiRun(unittest.TestCase):
-    """_latest_main_ci_run() must return only ci.yml push-to-main runs."""
-
-    def _ci_run(self, run_id, status="success"):
-        return {"event": "push", "prettyref": "main", "workflow_id": "ci.yml",
-                "status": status, "id": run_id}
-
-    def _deploy_run(self, run_id, status="success"):
-        return {"event": "push", "prettyref": "main", "workflow_id": "deploy.yml",
-                "status": status, "id": run_id}
-
-    def test_skips_deploy_run_returns_ci_run(self):
-        # Forgejo reports deploy.yml schedule runs as event=push/prettyref=main;
-        # must be excluded by workflow_id filter.
-        runs = [self._deploy_run(1), self._ci_run(2)]
-        with patch("agent_loop._tea_get", return_value={"workflow_runs": runs}):
-            result = agent_loop._latest_main_ci_run()
-        self.assertIsNotNone(result)
-        self.assertEqual(result["id"], 2)
-
-    def test_returns_none_when_only_deploy_runs_exist(self):
-        runs = [self._deploy_run(1)]
-        with patch("agent_loop._tea_get", return_value={"workflow_runs": runs}):
-            result = agent_loop._latest_main_ci_run()
-        self.assertIsNone(result)
-
-    def test_returns_none_when_only_schedule_runs_exist(self):
-        runs = [{"event": "schedule", "prettyref": "main", "workflow_id": "deploy.yml",
-                 "status": "success", "id": 1}]
-        with patch("agent_loop._tea_get", return_value={"workflow_runs": runs}):
-            result = agent_loop._latest_main_ci_run()
-        self.assertIsNone(result)
-
-    def test_returns_ci_push_to_main_run(self):
-        runs = [self._ci_run(42, status="running")]
-        with patch("agent_loop._tea_get", return_value={"workflow_runs": runs}):
-            result = agent_loop._latest_main_ci_run()
-        self.assertIsNotNone(result)
-        self.assertEqual(result["id"], 42)
-
-
-class TestLatestCiRunForBranch(unittest.TestCase):
-    """Tests for _latest_ci_run_for_branch — Forgejo API field mapping."""
-
-    def _make_pr_run(self, branch: str, status: str = "success") -> dict:
-        payload = json.dumps({"pull_request": {"head": {"ref": branch}}})
-        return {"event": "pull_request", "event_payload": payload, "status": status, "id": 1}
-
-    def _make_push_run(self, prettyref: str, status: str = "success") -> dict:
-        return {"event": "push", "prettyref": prettyref, "status": status, "id": 2}
-
-    def _mock_tea_runs(self, runs):
-        with patch("agent_loop._tea_get", return_value={"workflow_runs": runs}) as m:
-            yield m
-
-    def test_pr_event_matches_via_event_payload(self):
-        run = self._make_pr_run("issue-166-fix")
-        with patch("agent_loop._tea_get", return_value={"workflow_runs": [run]}):
-            result = agent_loop._latest_ci_run_for_branch("issue-166-fix")
-        self.assertIsNotNone(result)
-        self.assertEqual(result["id"], 1)
-
-    def test_pr_event_does_not_match_wrong_branch(self):
-        run = self._make_pr_run("issue-99-fix")
-        with patch("agent_loop._tea_get", return_value={"workflow_runs": [run]}):
-            result = agent_loop._latest_ci_run_for_branch("issue-166-fix")
-        self.assertIsNone(result)
-
-    def test_push_event_matches_via_prettyref(self):
-        run = self._make_push_run("issue-166-fix")
-        with patch("agent_loop._tea_get", return_value={"workflow_runs": [run]}):
-            result = agent_loop._latest_ci_run_for_branch("issue-166-fix")
-        self.assertIsNotNone(result)
-        self.assertEqual(result["id"], 2)
-
-    def test_push_event_prettyref_pr_number_does_not_match_branch(self):
-        # Forgejo sets prettyref="#169" for PR runs — must not match branch name.
-        run = {"event": "push", "prettyref": "#169", "status": "success", "id": 3}
-        with patch("agent_loop._tea_get", return_value={"workflow_runs": [run]}):
-            result = agent_loop._latest_ci_run_for_branch("issue-166-fix")
-        self.assertIsNone(result)
-
-    def test_head_branch_field_absent_still_works(self):
-        # Regression: the old code used run.get("head_branch") which is absent in Forgejo.
-        run = self._make_pr_run("issue-166-fix")
-        self.assertNotIn("head_branch", run)
-        with patch("agent_loop._tea_get", return_value={"workflow_runs": [run]}):
-            result = agent_loop._latest_ci_run_for_branch("issue-166-fix")
-        self.assertIsNotNone(result)
-
-    def test_returns_none_when_no_runs(self):
-        with patch("agent_loop._tea_get", return_value={"workflow_runs": []}):
-            result = agent_loop._latest_ci_run_for_branch("issue-166-fix")
-        self.assertIsNone(result)
-
-    def test_returns_first_matching_run(self):
-        runs = [
-            self._make_pr_run("issue-166-fix", status="success"),
-            self._make_pr_run("issue-166-fix", status="failure"),
-        ]
-        runs[0]["id"] = 10
-        runs[1]["id"] = 11
-        with patch("agent_loop._tea_get", return_value={"workflow_runs": runs}):
-            result = agent_loop._latest_ci_run_for_branch("issue-166-fix")
-        self.assertEqual(result["id"], 10)
-
-
-class TestFindSessionUuid(unittest.TestCase):
-    """Tests for _find_session_uuid()."""
-
-    def _write_jsonl(self, directory: Path, filename: str, entries: list) -> Path:
-        path = directory / filename
-        with path.open("w") as fh:
-            for entry in entries:
-                fh.write(json.dumps(entry) + "\n")
-        return path
-
-    def test_returns_uuid_for_matching_session_name(self):
-        with tempfile.TemporaryDirectory() as tmpdir:
-            projects_dir = Path(tmpdir)
-            self._write_jsonl(projects_dir, "abc123.jsonl", [
-                {"type": "agent-name", "agentName": "issue-91", "sessionId": "uuid-abc-123"},
-            ])
-            orig = agent_loop.CLAUDE_PROJECTS_DIR
-            agent_loop.CLAUDE_PROJECTS_DIR = projects_dir
-            try:
-                result = agent_loop._find_session_uuid("issue-91")
-            finally:
-                agent_loop.CLAUDE_PROJECTS_DIR = orig
-        self.assertEqual(result, "uuid-abc-123")
-
-    def test_returns_none_when_name_does_not_match(self):
-        with tempfile.TemporaryDirectory() as tmpdir:
-            projects_dir = Path(tmpdir)
-            self._write_jsonl(projects_dir, "abc123.jsonl", [
-                {"type": "agent-name", "agentName": "issue-99", "sessionId": "uuid-abc-123"},
-            ])
-            orig = agent_loop.CLAUDE_PROJECTS_DIR
-            agent_loop.CLAUDE_PROJECTS_DIR = projects_dir
-            try:
-                result = agent_loop._find_session_uuid("issue-91")
-            finally:
-                agent_loop.CLAUDE_PROJECTS_DIR = orig
-        self.assertIsNone(result)
-
-    def test_returns_none_when_directory_missing(self):
-        orig = agent_loop.CLAUDE_PROJECTS_DIR
-        agent_loop.CLAUDE_PROJECTS_DIR = Path("/nonexistent/path/that/does/not/exist")
-        try:
-            result = agent_loop._find_session_uuid("issue-91")
-        finally:
-            agent_loop.CLAUDE_PROJECTS_DIR = orig
-        self.assertIsNone(result)
-
-    def test_returns_none_when_no_agent_name_entry(self):
-        with tempfile.TemporaryDirectory() as tmpdir:
-            projects_dir = Path(tmpdir)
-            self._write_jsonl(projects_dir, "abc123.jsonl", [
-                {"type": "message", "content": "hello"},
-            ])
-            orig = agent_loop.CLAUDE_PROJECTS_DIR
-            agent_loop.CLAUDE_PROJECTS_DIR = projects_dir
-            try:
-                result = agent_loop._find_session_uuid("issue-91")
-            finally:
-                agent_loop.CLAUDE_PROJECTS_DIR = orig
-        self.assertIsNone(result)
-
-    def test_scans_multiple_files_to_find_match(self):
-        with tempfile.TemporaryDirectory() as tmpdir:
-            projects_dir = Path(tmpdir)
-            self._write_jsonl(projects_dir, "aaa.jsonl", [
-                {"type": "agent-name", "agentName": "issue-10", "sessionId": "uuid-10"},
-            ])
-            self._write_jsonl(projects_dir, "bbb.jsonl", [
-                {"type": "agent-name", "agentName": "issue-91", "sessionId": "uuid-91"},
-            ])
-            orig = agent_loop.CLAUDE_PROJECTS_DIR
-            agent_loop.CLAUDE_PROJECTS_DIR = projects_dir
-            try:
-                result = agent_loop._find_session_uuid("issue-91")
-            finally:
-                agent_loop.CLAUDE_PROJECTS_DIR = orig
-        self.assertEqual(result, "uuid-91")
-
-
-class TestRunLoopResumeCommand(unittest.TestCase):
-    """Tests that _run_loop() shows a UUID-based resume command when agent is running."""
-
-    def _alive_state(self, session_name="issue-91"):
-        return {
-            "pid": os.getpid(),  # own PID is always alive
-            "issue": 91,
-            "started_at": "2026-05-23T12:00:00+00:00",
-            "type": "issue",
-            "session_name": session_name,
-        }
-
-    def test_resume_shows_uuid_when_found(self):
-        buf = io.StringIO()
-        fake_uuid = "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"
-        with patch("agent_loop._read_state", return_value=self._alive_state()), \
-             patch("agent_loop._agent_alive", return_value=True), \
-             patch("agent_loop._agent_age_seconds", return_value=600), \
-             patch("agent_loop._find_session_uuid", return_value=fake_uuid), \
-             patch("agent_loop._git_summary", return_value=""), \
-             contextlib.redirect_stdout(buf):
-            agent_loop._run_loop()
-        output = buf.getvalue()
-        self.assertIn(f"claude --resume {fake_uuid}", output)
-
-    def test_resume_shows_list_hint_when_uuid_not_found(self):
-        buf = io.StringIO()
-        with patch("agent_loop._read_state", return_value=self._alive_state()), \
-             patch("agent_loop._agent_alive", return_value=True), \
-             patch("agent_loop._agent_age_seconds", return_value=600), \
-             patch("agent_loop._find_session_uuid", return_value=None), \
-             patch("agent_loop._git_summary", return_value=""), \
-             contextlib.redirect_stdout(buf):
-            agent_loop._run_loop()
-        output = buf.getvalue()
-        self.assertIn("scripts/agent_loop.py list", output)
-        # Must NOT show the session name as a valid resume argument.
-        self.assertNotIn("claude --resume issue-91", output)
-
-    def test_resume_not_shown_when_no_session_name(self):
-        state = self._alive_state()
-        del state["session_name"]
-        buf = io.StringIO()
-        with patch("agent_loop._read_state", return_value=state), \
-             patch("agent_loop._agent_alive", return_value=True), \
-             patch("agent_loop._agent_age_seconds", return_value=600), \
-             patch("agent_loop._find_session_uuid", return_value=None), \
-             patch("agent_loop._git_summary", return_value=""), \
-             contextlib.redirect_stdout(buf):
-            agent_loop._run_loop()
-        output = buf.getvalue()
-        self.assertNotIn("Resume:", output)
-
-
-
-class TestCatchupSkipsQuestionIssues(unittest.TestCase):
-    """Catch-up must not retry merging a PR whose issue is already State/Question."""
-
-    def _make_pr(self, pr_number=50, branch="issue-10-fix"):
-        return {"number": pr_number, "head": {"ref": branch}}
-
-    def test_skips_merge_when_issue_has_question_label(self):
-        pr = self._make_pr()
-        ci_run = {"id": 999, "status": "success"}
-        with patch("agent_loop._read_state", return_value=None), \
-             patch("agent_loop._open_issue_prs", return_value=[pr]), \
-             patch("agent_loop._latest_ci_run_for_pr", return_value=ci_run), \
-             patch("agent_loop._get_issue_labels", return_value=[agent_loop.LABEL_QUESTION]), \
-             patch("agent_loop._merge_pr") as mock_merge, \
-             patch("agent_loop._comment_issue") as mock_comment, \
-             patch("agent_loop._set_labels") as mock_labels, \
-             patch("agent_loop._latest_main_ci_run", return_value=None), \
-             patch("agent_loop._ready_issues", return_value=[]):
-            result = agent_loop._run_loop()
-        self.assertEqual(result, 0)
-        mock_merge.assert_not_called()
-        mock_comment.assert_not_called()
-        mock_labels.assert_not_called()
-
-    def test_proceeds_with_merge_when_issue_lacks_question_label(self):
-        pr = self._make_pr()
-        ci_run = {"id": 999, "status": "success"}
-        with patch("agent_loop._read_state", return_value=None), \
-             patch("agent_loop._open_issue_prs", return_value=[pr]), \
-             patch("agent_loop._latest_ci_run_for_pr", return_value=ci_run), \
-             patch("agent_loop._get_issue_labels", return_value=[agent_loop.LABEL_IN_PROGRESS]), \
-             patch("agent_loop._merge_pr") as mock_merge, \
-             patch("agent_loop._find_pr_for_branch", return_value=None), \
-             patch("agent_loop._close_issue"):
-            result = agent_loop._run_loop()
-        self.assertEqual(result, 0)
-        mock_merge.assert_called_once_with(50)
-
-
-class TestMergeFailsOpen(unittest.TestCase):
-    """Tests for auto-resolution when a PR is still open after the merge command."""
-
-    def _dead_state(self, issue: int, kind: str = "issue") -> dict:
-        return {
-            "pid": 999999999,
-            "issue": issue,
-            "started_at": "2026-01-01T00:00:00+00:00",
-            "type": kind,
-        }
-
-    def _open_pr(self, branch: str = "issue-10-fix") -> dict:
-        return {"number": 5, "head": {"ref": branch}, "created_at": "2026-01-01T00:00:00+00:00"}
-
-    def test_merge_fails_open_with_conflicts_spawns_rebase_agent(self):
-        """mergeable=false → rebase agent spawned, state written as pending-ci."""
-        written_state = {}
-
-        def fake_write_state(pid, issue, kind, issue_title=None, session_name=None, ci_run_id=None):
-            written_state["pid"] = pid
-            written_state["issue"] = issue
-            written_state["kind"] = kind
-            written_state["session_name"] = session_name
-
-        with patch("agent_loop._read_state", return_value=self._dead_state(10)), \
-             patch("agent_loop._find_pr_for_branch", side_effect=[self._open_pr(), self._open_pr()]), \
-             patch("agent_loop._latest_ci_run_for_branch", return_value={"id": 1, "status": "success"}), \
-             patch("agent_loop._merge_pr"), \
-             patch("agent_loop._tea_get", return_value={"mergeable": False}), \
-             patch("agent_loop._start_agent", return_value=77) as mock_start, \
-             patch("agent_loop._write_state", side_effect=fake_write_state), \
-             patch("agent_loop._clear_state"):
-            result = agent_loop._run_loop()
-
-        self.assertEqual(result, 0)
-        mock_start.assert_called_once()
-        prompt = mock_start.call_args[0][0]
-        self.assertIn("Rebase branch", prompt)
-        self.assertIn("issue-10-fix", prompt)
-        self.assertEqual(written_state.get("kind"), "pending-ci")
-        self.assertEqual(written_state.get("issue"), 10)
-
-    def test_merge_fails_open_no_conflicts_retries_and_succeeds(self):
-        """mergeable=true, second attempt succeeds → issue closed."""
-        with patch("agent_loop._read_state", return_value=self._dead_state(10)), \
-             patch("agent_loop._find_pr_for_branch",
-                   side_effect=[self._open_pr(), self._open_pr(), None]), \
-             patch("agent_loop._latest_ci_run_for_branch", return_value={"id": 1, "status": "success"}), \
-             patch("agent_loop._merge_pr"), \
-             patch("agent_loop._tea_get", return_value={"mergeable": True}), \
-             patch("agent_loop.time.sleep"), \
-             patch("agent_loop._close_issue") as mock_close, \
-             patch("agent_loop._clear_state"):
-            result = agent_loop._run_loop()
-
-        self.assertEqual(result, 0)
-        mock_close.assert_called_once_with(10)
-
-    def test_merge_fails_open_no_conflicts_all_retries_exhausted(self):
-        """All retries exhausted with PR still open → falls through to State/Question."""
-        with patch("agent_loop._read_state", return_value=self._dead_state(10)), \
-             patch("agent_loop._find_pr_for_branch",
-                   side_effect=[self._open_pr(), self._open_pr(),
-                                 self._open_pr(), self._open_pr()]), \
-             patch("agent_loop._latest_ci_run_for_branch", return_value={"id": 1, "status": "success"}), \
-             patch("agent_loop._merge_pr"), \
-             patch("agent_loop._tea_get", return_value={"mergeable": True}), \
-             patch("agent_loop.time.sleep"), \
-             patch("agent_loop._set_labels") as mock_labels, \
-             patch("agent_loop._comment_issue") as mock_comment, \
-             patch("agent_loop._close_issue") as mock_close, \
-             patch("agent_loop._clear_state"):
-            result = agent_loop._run_loop()
-
-        self.assertEqual(result, 0)
-        mock_close.assert_not_called()
-        mock_labels.assert_called_once_with(
-            10,
-            add=[agent_loop.LABEL_QUESTION],
-            remove=[agent_loop.LABEL_IN_PROGRESS],
-        )
-        mock_comment.assert_called_once()
-
-
-class TestHeartbeat(unittest.TestCase):
-    """Tests for _update_heartbeat() and cmd_monitor()."""
-
-    def setUp(self):
-        self._tmp = tempfile.NamedTemporaryFile(delete=False, suffix=".heartbeat")
-        self._tmp.close()
-        self._orig = agent_loop.HEARTBEAT_FILE
-        agent_loop.HEARTBEAT_FILE = Path(self._tmp.name)
-        Path(self._tmp.name).unlink()  # Start with no heartbeat file.
-
-    def tearDown(self):
-        agent_loop.HEARTBEAT_FILE = self._orig
-        Path(self._tmp.name).unlink(missing_ok=True)
-
-    def test_update_heartbeat_writes_timestamp(self):
-        agent_loop._update_heartbeat()
-        content = Path(self._tmp.name).read_text().strip()
-        dt = datetime.fromisoformat(content)
-        age = (datetime.now(timezone.utc) - dt).total_seconds()
-        self.assertLess(age, 5)
-
-    def test_update_heartbeat_creates_file(self):
-        self.assertFalse(Path(self._tmp.name).exists())
-        agent_loop._update_heartbeat()
-        self.assertTrue(Path(self._tmp.name).exists())
-
-    def test_monitor_healthy_when_recent(self):
-        agent_loop._update_heartbeat()
-        result = agent_loop.cmd_monitor()
-        self.assertEqual(result, 0)
-
-    def test_monitor_warns_when_heartbeat_missing(self):
-        buf = io.StringIO()
-        with contextlib.redirect_stdout(buf):
-            result = agent_loop.cmd_monitor()
-        self.assertEqual(result, 1)
-        self.assertIn("WARNING", buf.getvalue())
-
-    def test_monitor_warns_when_stale(self):
-        stale = (datetime.now(timezone.utc) - timedelta(hours=3)).isoformat()
-        Path(self._tmp.name).write_text(stale)
-        buf = io.StringIO()
-        with contextlib.redirect_stdout(buf):
-            result = agent_loop.cmd_monitor()
-        self.assertEqual(result, 1)
-        self.assertIn("WARNING", buf.getvalue())
-
-    def test_monitor_warns_when_corrupted(self):
-        Path(self._tmp.name).write_text("not-a-timestamp")
-        buf = io.StringIO()
-        with contextlib.redirect_stdout(buf):
-            result = agent_loop.cmd_monitor()
-        self.assertEqual(result, 1)
-        self.assertIn("WARNING", buf.getvalue())
-
-    def test_run_loop_updates_heartbeat(self):
-        self.assertFalse(Path(self._tmp.name).exists())
-        with patch("agent_loop._read_state", return_value=None), \
-             patch("agent_loop._open_issue_prs", return_value=[]), \
-             patch("agent_loop._latest_main_ci_run", return_value=None), \
-             patch("agent_loop._ready_issues", return_value=[]):
-            agent_loop._run_loop()
-        self.assertTrue(Path(self._tmp.name).exists())
-

 if __name__ == "__main__":
    unittest.main()
@@ -1,200 +0,0 @@
-#!/usr/bin/env python3
-"""Tests for deploy_playstore.py."""
-import os
-import sys
-import unittest
-from pathlib import Path
-from unittest.mock import MagicMock, call, patch
-
-sys.path.insert(0, str(Path(__file__).parent))
-
-import deploy_playstore
-
-
-def _make_session(
-    edit_id="edit-42",
-    version_code=7,
-    upload_side_effects=None,
-):
-    """Return a mock AuthorizedSession with sensible defaults."""
-    session = MagicMock()
-
-    # POST /edits → create edit
-    edit_resp = MagicMock()
-    edit_resp.json.return_value = {"id": edit_id}
-    session.post.return_value = edit_resp
-
-    # POST resumable-init → Location header
-    init_resp = MagicMock()
-    init_resp.headers = {"Location": "https://upload.example.com/session"}
-
-    # PUT upload → bundle JSON
-    upload_resp = MagicMock()
-    upload_resp.json.return_value = {"versionCode": version_code}
-
-    if upload_side_effects is not None:
-        # Use side_effect list: first call is edit create, rest are upload inits
-        # We override the PUT side effects via _upload_aab_resumable mock instead
-        pass
-
-    return session, init_resp, upload_resp
-
-
-class TestMainEnvChecks(unittest.TestCase):
-    def test_missing_env_exits(self):
-        with patch.dict(os.environ, {}, clear=True):
-            with self.assertRaises(SystemExit) as ctx:
-                deploy_playstore.main()
-        self.assertEqual(ctx.exception.code, 1)
-
-    def test_missing_aab_exits(self):
-        fake_config = '{"type": "service_account"}'
-        with patch.dict(os.environ, {"PLAY_STORE_CONFIG_JSON": fake_config}):
-            with patch("deploy_playstore.os.path.exists", return_value=False):
-                with self.assertRaises(SystemExit) as ctx:
-                    deploy_playstore.main()
-        self.assertEqual(ctx.exception.code, 1)
-
-
-class TestMainHappyPath(unittest.TestCase):
-    def _run_main(self, fake_config='{"type":"service_account"}'):
-        mock_session = MagicMock()
-        # POST for edit create and commit
-        post_responses = [
-            MagicMock(**{"json.return_value": {"id": "edit-42"}}),  # create edit
-            MagicMock(),  # commit
-        ]
-        mock_session.post.side_effect = post_responses
-        # PUT for track update
-        mock_session.put.return_value = MagicMock()
-
-        with patch.dict(os.environ, {"PLAY_STORE_CONFIG_JSON": fake_config}):
-            with patch("deploy_playstore.os.path.exists", return_value=True):
-                with patch("deploy_playstore.service_account.Credentials.from_service_account_info"):
-                    with patch("deploy_playstore.AuthorizedSession", return_value=mock_session):
-                        with patch(
-                            "deploy_playstore._upload_aab_resumable",
-                            return_value={"versionCode": 7},
-                        ):
-                            deploy_playstore.main()
-
-        return mock_session
-
-    def test_creates_edit(self):
-        session = self._run_main()
-        create_call = session.post.call_args_list[0]
-        self.assertIn("/edits", create_call[0][0])
-
-    def test_commits_edit(self):
-        session = self._run_main()
-        commit_call = session.post.call_args_list[1]
-        self.assertIn(":commit", commit_call[0][0])
-
-    def test_updates_track(self):
-        session = self._run_main()
-        track_call = session.put.call_args_list[0]
-        self.assertIn("/tracks/", track_call[0][0])
-
-
-class TestUploadRetry(unittest.TestCase):
-    def _run_main(self, upload_side_effects, sleep_mock=None):
-        mock_session = MagicMock()
-        post_responses = [
-            MagicMock(**{"json.return_value": {"id": "edit-1"}}),
-            MagicMock(),
-        ]
-        mock_session.post.side_effect = post_responses
-        mock_session.put.return_value = MagicMock()
-
-        patches = [
-            patch.dict(os.environ, {"PLAY_STORE_CONFIG_JSON": '{"type":"service_account"}'}),
-            patch("deploy_playstore.os.path.exists", return_value=True),
-            patch("deploy_playstore.service_account.Credentials.from_service_account_info"),
-            patch("deploy_playstore.AuthorizedSession", return_value=mock_session),
-            patch("deploy_playstore._upload_aab_resumable", side_effect=upload_side_effects),
-            patch("deploy_playstore.time.sleep"),
-        ]
-        for p in patches:
-            p.start()
-        try:
-            deploy_playstore.main()
-        finally:
-            for p in patches:
-                p.stop()
-
-    def test_succeeds_on_first_attempt(self):
-        with patch("deploy_playstore._upload_aab_resumable", return_value={"versionCode": 5}) as mock_upload:
-            with patch.dict(os.environ, {"PLAY_STORE_CONFIG_JSON": '{"type":"service_account"}'}):
-                with patch("deploy_playstore.os.path.exists", return_value=True):
-                    with patch("deploy_playstore.service_account.Credentials.from_service_account_info"):
-                        mock_session = MagicMock()
-                        mock_session.post.side_effect = [
-                            MagicMock(**{"json.return_value": {"id": "e1"}}),
-                            MagicMock(),
-                        ]
-                        mock_session.put.return_value = MagicMock()
-                        with patch("deploy_playstore.AuthorizedSession", return_value=mock_session):
-                            deploy_playstore.main()
-            mock_upload.assert_called_once()
-
-    def test_retries_once_on_error_then_succeeds(self):
-        self._run_main([ValueError("transient"), {"versionCode": 9}])
-
-    def test_raises_after_all_attempts_exhausted(self):
-        with self.assertRaises(RuntimeError) as ctx:
-            self._run_main([ValueError("err"), ValueError("err"), ValueError("err")])
-        self.assertIn(str(deploy_playstore._MAX_UPLOAD_ATTEMPTS), str(ctx.exception))
-
-    def test_backoff_delays_are_10s_then_20s(self):
-        mock_session = MagicMock()
-        mock_session.post.side_effect = [
-            MagicMock(**{"json.return_value": {"id": "e1"}}),
-            MagicMock(),
-        ]
-        mock_session.put.return_value = MagicMock()
-
-        with patch.dict(os.environ, {"PLAY_STORE_CONFIG_JSON": '{"type":"service_account"}'}):
-            with patch("deploy_playstore.os.path.exists", return_value=True):
-                with patch("deploy_playstore.service_account.Credentials.from_service_account_info"):
-                    with patch("deploy_playstore.AuthorizedSession", return_value=mock_session):
-                        with patch(
-                            "deploy_playstore._upload_aab_resumable",
-                            side_effect=[ValueError("e"), ValueError("e"), {"versionCode": 3}],
-                        ):
-                            with patch("deploy_playstore.time.sleep") as mock_sleep:
-                                deploy_playstore.main()
-
-        mock_sleep.assert_has_calls([call(10), call(20)])
-
-
-class TestUploadAabResumable(unittest.TestCase):
-    def test_initiates_and_uploads(self):
-        mock_session = MagicMock()
-        init_resp = MagicMock()
-        init_resp.headers = {"Location": "https://upload.example.com/sess"}
-        upload_resp = MagicMock()
-        upload_resp.json.return_value = {"versionCode": 42}
-        mock_session.post.return_value = init_resp
-        mock_session.put.return_value = upload_resp
-
-        import tempfile
-        with tempfile.NamedTemporaryFile(delete=False) as f:
-            f.write(b"fake-aab-content")
-            aab_path = f.name
-
-        try:
-            result = deploy_playstore._upload_aab_resumable(
-                mock_session, "com.example.app", "edit-1", aab_path
-            )
-        finally:
-            os.unlink(aab_path)
-
-        self.assertEqual(result["versionCode"], 42)
-        mock_session.post.assert_called_once()
-        mock_session.put.assert_called_once()
-        put_call = mock_session.put.call_args
-        self.assertEqual(put_call[0][0], "https://upload.example.com/sess")
-
-
-if __name__ == "__main__":
-    unittest.main()
@@ -1,89 +0,0 @@
-#!/usr/bin/env bash
-# Tests for Firebase CI check patterns used in ci/main.go.
-# Run directly: bash scripts/test_firebase_check.sh
-
-PASS=0
-FAIL=0
-
-_assert() {
-    local name="$1" expected="$2" actual="$3"
-    if [ "$actual" = "$expected" ]; then
-        PASS=$((PASS + 1))
-    else
-        echo "FAIL: $name"
-        echo "  expected: '$expected'"
-        echo "  actual:   '$actual'"
-        FAIL=$((FAIL + 1))
-    fi
-}
-
-# --- auth stderr filter ---
-# Lines ignored: "Activated service account credentials for: [...]"
-#                "Updated property [core/project]."
-_filter_auth() {
-    grep -vF "Activated service account credentials for:" \
-    | grep -vF "Updated property [core/project]." \
-    | grep -v "^$" \
-    || true
-}
-
-_assert "auth: both known messages produce empty output" "" \
-    "$(printf 'Activated service account credentials for: [ci@sa.iam.gserviceaccount.com]\nUpdated property [core/project].\n' | _filter_auth)"
-
-_assert "auth: only credentials line produces empty output" "" \
-    "$(printf 'Activated service account credentials for: [ci@sa.iam.gserviceaccount.com]\n' | _filter_auth)"
-
-_assert "auth: only property line produces empty output" "" \
-    "$(printf 'Updated property [core/project].\n' | _filter_auth)"
-
-_assert "auth: empty input produces empty output" "" \
-    "$(printf '' | _filter_auth)"
-
-_assert "auth: unexpected line passes through" "some unexpected error" \
-    "$(printf 'some unexpected error\n' | _filter_auth)"
-
-_assert "auth: unknown line kept alongside known messages" "unexpected line" \
-    "$(printf 'Activated service account credentials for: [x]\nunexpected line\nUpdated property [core/project].\n' | _filter_auth)"
-
-# --- "error" word detection: grep -qwi 'error' ---
-# Matches "error" as a whole word (case-insensitive).
-# Must NOT match "error" as part of another word (e.g. "stderr", "AssertionError").
-_has_err() { printf '%s\n' "$1" | grep -qwi 'error' && echo yes || echo no; }
-
-_assert "error: non-retryable error line matched"  yes "$(_has_err 'A non-retryable error occurred.')"
-_assert "error: uppercase ERROR matched"           yes "$(_has_err 'ERROR: infrastructure_failure')"
-_assert "error: mixed-case Error matched"          yes "$(_has_err 'Error: something went wrong')"
-_assert "error: normal pending line not matched"   no  "$(_has_err 'Test is Pending')"
-_assert "error: timing line not matched"           no  "$(_has_err 'Done. Test time = 183 (secs)')"
-_assert "error: completion line not matched"       no  "$(_has_err 'Instrumentation testing complete.')"
-_assert "error: 'stderr' word not matched"         no  "$(_has_err 'some stderr: gcloud output')"
-_assert "error: 'AssertionError' not matched"      no  "$(_has_err 'java.lang.AssertionError: expected true')"
-
-# --- device count from result table ---
-# Counts data rows by looking for lines with "│" that contain an outcome word.
-TABLE_PASS="┌─────────┬───────────────────────┬──────────────┐
-│ OUTCOME │    TEST_AXIS_VALUE    │ TEST_DETAILS │
-├─────────┼───────────────────────┼──────────────┤
-│ Passed  │ oriole-33-en-portrait │ --           │
-└─────────┴───────────────────────┴──────────────┘"
-
-TABLE_FAIL="┌─────────┬───────────────────────┬──────────────┐
-│ OUTCOME │    TEST_AXIS_VALUE    │ TEST_DETAILS │
-├─────────┼───────────────────────┼──────────────┤
-│ Failed  │ oriole-33-en-portrait │ --           │
-└─────────┴───────────────────────┴──────────────┘"
-
-_count() {
-    local n
-    n=$(printf '%s' "$1" | grep "│" | grep -cE "(Passed|Failed|Inconclusive|Skipped)") || n=0
-    printf '%s' "$n"
-}
-
-_assert "count: one passing device gives 1"  1 "$(_count "$TABLE_PASS")"
-_assert "count: one failing device gives 1"  1 "$(_count "$TABLE_FAIL")"
-_assert "count: no table gives 0"            0 "$(_count 'Test is Pending\nDone.')"
-_assert "count: plain output gives 0"        0 "$(_count 'Instrumentation testing complete.')"
-
-echo ""
-echo "Results: $PASS passed, $FAIL failed"
-[ "$FAIL" -eq 0 ] || exit 1
@@ -1,5 +1,10 @@
 # Minimal Stalwart Mail configuration for local development and integration tests.
 #
+# Do not start directly — use stalwart-dev/start, which substitutes $STALWART_PORT
+# and writes a per-clone config into /tmp/stalwart-dev-PORT/ before starting.
+#
+# Check:  curl http://localhost:$STALWART_PORT/.well-known/jmap
+#
 # HTTP only — localhost testing, no TLS.
 # Two test accounts (alice, bob) for multi-account sync tests.

@@ -8,27 +13,27 @@ hostname = "localhost"

 [[server.listener]]
 id       = "jmap"
-bind     = ["0.0.0.0:8080"]
+bind     = ["127.0.0.1:8080"]
 protocol = "http"

 [[server.listener]]
 id       = "imap"
-bind     = ["0.0.0.0:1430"]
+bind     = ["127.0.0.1:1430"]
 protocol = "imap"

 [[server.listener]]
 id       = "smtp"
-bind     = ["0.0.0.0:1025"]
+bind     = ["127.0.0.1:1025"]
 protocol = "smtp"

 [[server.listener]]
 id       = "managesieve"
-bind     = ["0.0.0.0:4190"]
+bind     = ["127.0.0.1:4190"]
 protocol = "managesieve"

 [store."db"]
 type = "sqlite"
-path = "/tmp/stalwart/data.sqlite"
+path = "/tmp/stalwart-dev/data.sqlite"

 [storage]
 data      = "db"
@@ -6,6 +6,16 @@
 # STALWART_TMPDIR/ports.env for other scripts to source.
 set -euo pipefail

+command -v stalwart >/dev/null || {
+    echo "stalwart not in PATH — run inside nix develop"
+    exit 1
+}
+
+command -v ss >/dev/null || {
+    echo "ss not in PATH — cannot verify Stalwart ports"
+    exit 1
+}
+
 if [ "${STALWART_RANDOM_PORTS:-0}" = "1" ] || [ "${STALWART_PORT:-0}" = "0" ]; then
    command -v python3 >/dev/null || {
        echo "python3 not in PATH — cannot choose random Stalwart ports"
@@ -51,30 +61,17 @@ export STALWART_SIEVE_PORT=${STALWART_SIEVE_PORT}
 export STALWART_URL=${STALWART_URL}
 EOF

-# Find a container runtime
-if command -v podman >/dev/null 2>&1; then
-    RUNTIME="podman"
-elif command -v docker >/dev/null 2>&1; then
-    RUNTIME="docker"
-else
-    echo "No container runtime (podman or docker) found" >&2
-    exit 1
-fi
-
 echo "Stalwart ports: JMAP=${STALWART_PORT} IMAP=${STALWART_IMAP_PORT} SMTP=${STALWART_SMTP_PORT} SIEVE=${STALWART_SIEVE_PORT}" >&2
-echo "Stalwart is running in a container (${RUNTIME}). Press Ctrl+C to stop." >&2
+echo "Stalwart is running in the foreground. Press Ctrl+C to stop." >&2
 echo "Connection info written to ${TMPDIR}/ports.env" >&2

 REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"

-# Run Stalwart in container, mapping the random host ports to the fixed container ports.
-# We mount the config.toml and use /tmp/stalwart for data (mapped to our local TMPDIR).
-exec "${RUNTIME}" run --rm -i \
-    -p "${STALWART_PORT}:8080" \
-    -p "${STALWART_IMAP_PORT}:1430" \
-    -p "${STALWART_SMTP_PORT}:1025" \
-    -p "${STALWART_SIEVE_PORT}:4190" \
-    -v "${REPO_ROOT}/stalwart-dev/config.toml:/etc/stalwart/config.toml:ro" \
-    -v "${TMPDIR}:/tmp/stalwart:rw" \
-    docker.io/stalwartlabs/stalwart:v0.14.1 \
-    stalwart --config /etc/stalwart/config.toml
+sed -e "s|127.0.0.1:8080|127.0.0.1:${STALWART_PORT}|" \
+    -e "s|127.0.0.1:1430|127.0.0.1:${STALWART_IMAP_PORT}|" \
+    -e "s|127.0.0.1:1025|127.0.0.1:${STALWART_SMTP_PORT}|" \
+    -e "s|127.0.0.1:4190|127.0.0.1:${STALWART_SIEVE_PORT}|" \
+    -e "s|/tmp/stalwart-dev|${TMPDIR}|" \
+    "${REPO_ROOT}/stalwart-dev/config.toml" >"${TMPDIR}/config.toml"
+
+exec stalwart --config "${TMPDIR}/config.toml"
@@ -12,7 +12,13 @@ export STALWART_RANDOM_PORTS=1
 STALWART_TMPDIR="$(mktemp -d /tmp/stalwart-dev-XXXXXX)"
 export STALWART_TMPDIR

-# Kill any stalwart left over from a previous run.
+command -v stalwart >/dev/null || {
+    echo "stalwart not in PATH — run inside nix develop"
+    exit 1
+}
+
+# Kill any stalwart left over from a previous run (the CI self-hosted runner
+# keeps processes alive across jobs when a run is killed externally).
 pkill -x stalwart 2>/dev/null && sleep 0.5 || true

 # Pre-seed spam-filter version so Stalwart does not fetch it on first boot.
@@ -29,8 +35,8 @@ tmp=$(mktemp)
 STALWART_PID=$!
 trap 'kill "$STALWART_PID" 2>/dev/null || true; wait "$STALWART_PID" 2>/dev/null || true; rm -f "$tmp"' EXIT

-# Wait until Stalwart is accepting connections (up to 60 s).
-for _i in $(seq 1 120); do
+# Wait until Stalwart is accepting connections (up to 10 s).
+for _i in $(seq 1 20); do
    # shellcheck source=/dev/null
    [ -f "${STALWART_TMPDIR}/ports.env" ] && . "${STALWART_TMPDIR}/ports.env"
    grep -E "already in use" "$LOGFILE" >/dev/null 2>&1 && {
@@ -149,22 +149,6 @@ class _FakeMailboxes implements MailboxRepository {

  @override
  Future<void> clearForResync(String accountId) async {}
-
-  @override
-  Future<Mailbox> createMailboxWithRole(
-    String accountId,
-    String name,
-    String role,
-  ) async =>
-      Mailbox(
-        id: '$accountId:$name',
-        accountId: accountId,
-        path: name,
-        name: name,
-        role: role,
-        unreadCount: 0,
-        totalCount: 0,
-      );
 }

 class _FakeEmails implements EmailRepository {
@@ -304,8 +288,6 @@ class _FakeLogs implements SyncLogRepository {
    required String accountId,
    required bool success,
    String? errorMessage,
-    String? stackTrace,
-    bool isPermanent = false,
    required String protocol,
    required int emailsFetched,
    required int emailsSkipped,
@@ -1,8 +1,6 @@
 import 'dart:async';

-import 'package:flutter/services.dart' show MissingPluginException;
 import 'package:mockito/annotations.dart';
-import 'package:sharedinbox/core/models/account.dart';
 import 'package:sharedinbox/core/models/email.dart';
 import 'package:sharedinbox/core/models/mailbox.dart';
 import 'package:sharedinbox/core/repositories/account_repository.dart';
@@ -32,40 +30,6 @@ void main() {
    // This is hard to test without real loops, but we can verify it doesn't crash.
    manager.syncNow('unknown');
  });
-
-  // Regression test for issue #200: when flutter_secure_storage throws
-  // MissingPluginException (channel unavailable on the device), the IMAP sync
-  // loop must stop permanently instead of retrying indefinitely with backoff.
-  test(
-      'MissingPluginException from secure storage stops IMAP sync loop permanently',
-      () async {
-    final syncLog = FakeSyncLogRepository();
-
-    final m = AccountSyncManager(
-      _AccountRepositoryWithMissingPlugin(),
-      FakeMailboxRepositoryWithInbox(),
-      FakeEmailRepository(),
-      syncLog: syncLog,
-    );
-
-    m.start();
-
-    // Allow the first sync cycle to run and fail.
-    await Future<void>.delayed(const Duration(milliseconds: 100));
-
-    expect(syncLog.logs, hasLength(1));
-    expect(syncLog.logs.first.success, isFalse);
-
-    // Kicking the loop should have no effect once it has stopped permanently.
-    m.syncNow('1');
-    await Future<void>.delayed(const Duration(milliseconds: 100));
-
-    // Before the fix: kick triggers a retry → 2 log entries.
-    // After the fix: loop is permanently stopped → still exactly 1 entry.
-    expect(syncLog.logs, hasLength(1));
-
-    m.dispose();
-  });
 }

 class FakeEmailRepository implements EmailRepository {
@@ -181,8 +145,6 @@ class FakeSyncLogRepository implements SyncLogRepository {
    required String accountId,
    required bool success,
    String? errorMessage,
-    String? stackTrace,
-    bool isPermanent = false,
    required String protocol,
    required int emailsFetched,
    required int emailsSkipped,
@@ -224,50 +186,4 @@ class FakeMailboxRepositoryWithInbox implements MailboxRepository {
  Future<Mailbox?> findMailboxByRole(String id, String role) async => null;
  @override
  Future<void> clearForResync(String accountId) async {}
-  @override
-  Future<Mailbox> createMailboxWithRole(
-    String accountId,
-    String name,
-    String role,
-  ) async =>
-      Mailbox(
-        id: '$accountId:$name',
-        accountId: accountId,
-        path: name,
-        name: name,
-        role: role,
-        unreadCount: 0,
-        totalCount: 0,
-      );
-}
-
-class _AccountRepositoryWithMissingPlugin implements AccountRepository {
-  static const _account = Account(
-    id: '1',
-    displayName: 'Test',
-    email: 'test@example.com',
-  );
-
-  @override
-  Stream<List<Account>> observeAccounts() => Stream.value([_account]);
-
-  @override
-  Future<Account?> getAccount(String id) async => _account;
-
-  @override
-  Future<String> getPassword(String accountId) => Future.error(
-        MissingPluginException(
-          'No implementation found for method read on channel '
-          'plugins.it.nomads.com/flutter_secure_storage',
-        ),
-      );
-
-  @override
-  Future<void> addAccount(Account account, String password) async {}
-
-  @override
-  Future<void> updateAccount(Account account, {String? password}) async {}
-
-  @override
-  Future<void> removeAccount(String id) async {}
 }
@@ -3,16 +3,16 @@
 // Do not manually edit this file.

 // ignore_for_file: no_leading_underscores_for_library_prefixes
-import 'dart:async' as _i5;
+import 'dart:async' as _i4;

 import 'package:mockito/mockito.dart' as _i1;
-import 'package:mockito/src/dummies.dart' as _i7;
-import 'package:sharedinbox/core/models/account.dart' as _i6;
-import 'package:sharedinbox/core/models/email.dart' as _i3;
-import 'package:sharedinbox/core/models/mailbox.dart' as _i2;
-import 'package:sharedinbox/core/repositories/account_repository.dart' as _i4;
+import 'package:mockito/src/dummies.dart' as _i6;
+import 'package:sharedinbox/core/models/account.dart' as _i5;
+import 'package:sharedinbox/core/models/email.dart' as _i2;
+import 'package:sharedinbox/core/models/mailbox.dart' as _i8;
+import 'package:sharedinbox/core/repositories/account_repository.dart' as _i3;
 import 'package:sharedinbox/core/repositories/email_repository.dart' as _i9;
-import 'package:sharedinbox/core/repositories/mailbox_repository.dart' as _i8;
+import 'package:sharedinbox/core/repositories/mailbox_repository.dart' as _i7;

 // ignore_for_file: type=lint
 // ignore_for_file: avoid_redundant_argument_values
@@ -29,8 +29,8 @@ import 'package:sharedinbox/core/repositories/mailbox_repository.dart' as _i8;
 // ignore_for_file: subtype_of_sealed_class
 // ignore_for_file: invalid_use_of_internal_member

-class _FakeMailbox_0 extends _i1.SmartFake implements _i2.Mailbox {
-  _FakeMailbox_0(
+class _FakeEmailBody_0 extends _i1.SmartFake implements _i2.EmailBody {
+  _FakeEmailBody_0(
    Object parent,
    Invocation parentInvocation,
  ) : super(
@@ -39,8 +39,9 @@ class _FakeMailbox_0 extends _i1.SmartFake implements _i2.Mailbox {
        );
 }

-class _FakeEmailBody_1 extends _i1.SmartFake implements _i3.EmailBody {
-  _FakeEmailBody_1(
+class _FakeSyncEmailsResult_1 extends _i1.SmartFake
+    implements _i2.SyncEmailsResult {
+  _FakeSyncEmailsResult_1(
    Object parent,
    Invocation parentInvocation,
  ) : super(
@@ -49,20 +50,9 @@ class _FakeEmailBody_1 extends _i1.SmartFake implements _i3.EmailBody {
        );
 }

-class _FakeSyncEmailsResult_2 extends _i1.SmartFake
-    implements _i3.SyncEmailsResult {
-  _FakeSyncEmailsResult_2(
-    Object parent,
-    Invocation parentInvocation,
-  ) : super(
-          parent,
-          parentInvocation,
-        );
-}
-
-class _FakeReliabilityResult_3 extends _i1.SmartFake
-    implements _i3.ReliabilityResult {
-  _FakeReliabilityResult_3(
+class _FakeReliabilityResult_2 extends _i1.SmartFake
+    implements _i2.ReliabilityResult {
+  _FakeReliabilityResult_2(
    Object parent,
    Invocation parentInvocation,
  ) : super(
@@ -74,32 +64,32 @@ class _FakeReliabilityResult_3 extends _i1.SmartFake
 /// A class which mocks [AccountRepository].
 ///
 /// See the documentation for Mockito's code generation for more information.
-class MockAccountRepository extends _i1.Mock implements _i4.AccountRepository {
+class MockAccountRepository extends _i1.Mock implements _i3.AccountRepository {
  MockAccountRepository() {
    _i1.throwOnMissingStub(this);
  }

  @override
-  _i5.Stream<List<_i6.Account>> observeAccounts() => (super.noSuchMethod(
+  _i4.Stream<List<_i5.Account>> observeAccounts() => (super.noSuchMethod(
        Invocation.method(
          #observeAccounts,
          [],
        ),
-        returnValue: _i5.Stream<List<_i6.Account>>.empty(),
-      ) as _i5.Stream<List<_i6.Account>>);
+        returnValue: _i4.Stream<List<_i5.Account>>.empty(),
+      ) as _i4.Stream<List<_i5.Account>>);

  @override
-  _i5.Future<_i6.Account?> getAccount(String? id) => (super.noSuchMethod(
+  _i4.Future<_i5.Account?> getAccount(String? id) => (super.noSuchMethod(
        Invocation.method(
          #getAccount,
          [id],
        ),
-        returnValue: _i5.Future<_i6.Account?>.value(),
-      ) as _i5.Future<_i6.Account?>);
+        returnValue: _i4.Future<_i5.Account?>.value(),
+      ) as _i4.Future<_i5.Account?>);

  @override
-  _i5.Future<void> addAccount(
-    _i6.Account? account,
+  _i4.Future<void> addAccount(
+    _i5.Account? account,
    String? password,
  ) =>
      (super.noSuchMethod(
@@ -110,13 +100,13 @@ class MockAccountRepository extends _i1.Mock implements _i4.AccountRepository {
            password,
          ],
        ),
-        returnValue: _i5.Future<void>.value(),
-        returnValueForMissingStub: _i5.Future<void>.value(),
-      ) as _i5.Future<void>);
+        returnValue: _i4.Future<void>.value(),
+        returnValueForMissingStub: _i4.Future<void>.value(),
+      ) as _i4.Future<void>);

  @override
-  _i5.Future<void> updateAccount(
-    _i6.Account? account, {
+  _i4.Future<void> updateAccount(
+    _i5.Account? account, {
    String? password,
  }) =>
      (super.noSuchMethod(
@@ -125,65 +115,65 @@ class MockAccountRepository extends _i1.Mock implements _i4.AccountRepository {
          [account],
          {#password: password},
        ),
-        returnValue: _i5.Future<void>.value(),
-        returnValueForMissingStub: _i5.Future<void>.value(),
-      ) as _i5.Future<void>);
+        returnValue: _i4.Future<void>.value(),
+        returnValueForMissingStub: _i4.Future<void>.value(),
+      ) as _i4.Future<void>);

  @override
-  _i5.Future<void> removeAccount(String? id) => (super.noSuchMethod(
+  _i4.Future<void> removeAccount(String? id) => (super.noSuchMethod(
        Invocation.method(
          #removeAccount,
          [id],
        ),
-        returnValue: _i5.Future<void>.value(),
-        returnValueForMissingStub: _i5.Future<void>.value(),
-      ) as _i5.Future<void>);
+        returnValue: _i4.Future<void>.value(),
+        returnValueForMissingStub: _i4.Future<void>.value(),
+      ) as _i4.Future<void>);

  @override
-  _i5.Future<String> getPassword(String? accountId) => (super.noSuchMethod(
+  _i4.Future<String> getPassword(String? accountId) => (super.noSuchMethod(
        Invocation.method(
          #getPassword,
          [accountId],
        ),
-        returnValue: _i5.Future<String>.value(_i7.dummyValue<String>(
+        returnValue: _i4.Future<String>.value(_i6.dummyValue<String>(
          this,
          Invocation.method(
            #getPassword,
            [accountId],
          ),
        )),
-      ) as _i5.Future<String>);
+      ) as _i4.Future<String>);
 }

 /// A class which mocks [MailboxRepository].
 ///
 /// See the documentation for Mockito's code generation for more information.
-class MockMailboxRepository extends _i1.Mock implements _i8.MailboxRepository {
+class MockMailboxRepository extends _i1.Mock implements _i7.MailboxRepository {
  MockMailboxRepository() {
    _i1.throwOnMissingStub(this);
  }

  @override
-  _i5.Stream<List<_i2.Mailbox>> observeMailboxes(String? accountId) =>
+  _i4.Stream<List<_i8.Mailbox>> observeMailboxes(String? accountId) =>
      (super.noSuchMethod(
        Invocation.method(
          #observeMailboxes,
          [accountId],
        ),
-        returnValue: _i5.Stream<List<_i2.Mailbox>>.empty(),
-      ) as _i5.Stream<List<_i2.Mailbox>>);
+        returnValue: _i4.Stream<List<_i8.Mailbox>>.empty(),
+      ) as _i4.Stream<List<_i8.Mailbox>>);

  @override
-  _i5.Future<int> syncMailboxes(String? accountId) => (super.noSuchMethod(
+  _i4.Future<int> syncMailboxes(String? accountId) => (super.noSuchMethod(
        Invocation.method(
          #syncMailboxes,
          [accountId],
        ),
-        returnValue: _i5.Future<int>.value(0),
-      ) as _i5.Future<int>);
+        returnValue: _i4.Future<int>.value(0),
+      ) as _i4.Future<int>);

  @override
-  _i5.Future<_i2.Mailbox?> findMailboxByRole(
+  _i4.Future<_i8.Mailbox?> findMailboxByRole(
    String? accountId,
    String? role,
  ) =>
@@ -195,46 +185,18 @@ class MockMailboxRepository extends _i1.Mock implements _i8.MailboxRepository {
            role,
          ],
        ),
-        returnValue: _i5.Future<_i2.Mailbox?>.value(),
-      ) as _i5.Future<_i2.Mailbox?>);
+        returnValue: _i4.Future<_i8.Mailbox?>.value(),
+      ) as _i4.Future<_i8.Mailbox?>);

  @override
-  _i5.Future<void> clearForResync(String? accountId) => (super.noSuchMethod(
+  _i4.Future<void> clearForResync(String? accountId) => (super.noSuchMethod(
        Invocation.method(
          #clearForResync,
          [accountId],
        ),
-        returnValue: _i5.Future<void>.value(),
-        returnValueForMissingStub: _i5.Future<void>.value(),
-      ) as _i5.Future<void>);
-
-  @override
-  _i5.Future<_i2.Mailbox> createMailboxWithRole(
-    String? accountId,
-    String? name,
-    String? role,
-  ) =>
-      (super.noSuchMethod(
-        Invocation.method(
-          #createMailboxWithRole,
-          [
-            accountId,
-            name,
-            role,
-          ],
-        ),
-        returnValue: _i5.Future<_i2.Mailbox>.value(_FakeMailbox_0(
-          this,
-          Invocation.method(
-            #createMailboxWithRole,
-            [
-              accountId,
-              name,
-              role,
-            ],
-          ),
-        )),
-      ) as _i5.Future<_i2.Mailbox>);
+        returnValue: _i4.Future<void>.value(),
+        returnValueForMissingStub: _i4.Future<void>.value(),
+      ) as _i4.Future<void>);
 }

 /// A class which mocks [EmailRepository].
@@ -246,13 +208,13 @@ class MockEmailRepository extends _i1.Mock implements _i9.EmailRepository {
  }

  @override
-  _i5.Stream<String> get onChangesQueued => (super.noSuchMethod(
+  _i4.Stream<String> get onChangesQueued => (super.noSuchMethod(
        Invocation.getter(#onChangesQueued),
-        returnValue: _i5.Stream<String>.empty(),
-      ) as _i5.Stream<String>);
+        returnValue: _i4.Stream<String>.empty(),
+      ) as _i4.Stream<String>);

  @override
-  _i5.Stream<List<_i3.Email>> observeEmails(
+  _i4.Stream<List<_i2.Email>> observeEmails(
    String? accountId,
    String? mailboxPath, {
    int? limit = 50,
@@ -266,11 +228,11 @@ class MockEmailRepository extends _i1.Mock implements _i9.EmailRepository {
          ],
          {#limit: limit},
        ),
-        returnValue: _i5.Stream<List<_i3.Email>>.empty(),
-      ) as _i5.Stream<List<_i3.Email>>);
+        returnValue: _i4.Stream<List<_i2.Email>>.empty(),
+      ) as _i4.Stream<List<_i2.Email>>);

  @override
-  _i5.Stream<List<_i3.EmailThread>> observeThreads(
+  _i4.Stream<List<_i2.EmailThread>> observeThreads(
    String? accountId,
    String? mailboxPath, {
    int? limit = 50,
@@ -284,11 +246,11 @@ class MockEmailRepository extends _i1.Mock implements _i9.EmailRepository {
          ],
          {#limit: limit},
        ),
-        returnValue: _i5.Stream<List<_i3.EmailThread>>.empty(),
-      ) as _i5.Stream<List<_i3.EmailThread>>);
+        returnValue: _i4.Stream<List<_i2.EmailThread>>.empty(),
+      ) as _i4.Stream<List<_i2.EmailThread>>);

  @override
-  _i5.Stream<List<_i3.Email>> observeEmailsInThread(
+  _i4.Stream<List<_i2.Email>> observeEmailsInThread(
    String? accountId,
    String? mailboxPath,
    String? threadId,
@@ -302,36 +264,36 @@ class MockEmailRepository extends _i1.Mock implements _i9.EmailRepository {
            threadId,
          ],
        ),
-        returnValue: _i5.Stream<List<_i3.Email>>.empty(),
-      ) as _i5.Stream<List<_i3.Email>>);
+        returnValue: _i4.Stream<List<_i2.Email>>.empty(),
+      ) as _i4.Stream<List<_i2.Email>>);

  @override
-  _i5.Future<_i3.Email?> getEmail(String? emailId) => (super.noSuchMethod(
+  _i4.Future<_i2.Email?> getEmail(String? emailId) => (super.noSuchMethod(
        Invocation.method(
          #getEmail,
          [emailId],
        ),
-        returnValue: _i5.Future<_i3.Email?>.value(),
-      ) as _i5.Future<_i3.Email?>);
+        returnValue: _i4.Future<_i2.Email?>.value(),
+      ) as _i4.Future<_i2.Email?>);

  @override
-  _i5.Future<_i3.EmailBody> getEmailBody(String? emailId) =>
+  _i4.Future<_i2.EmailBody> getEmailBody(String? emailId) =>
      (super.noSuchMethod(
        Invocation.method(
          #getEmailBody,
          [emailId],
        ),
-        returnValue: _i5.Future<_i3.EmailBody>.value(_FakeEmailBody_1(
+        returnValue: _i4.Future<_i2.EmailBody>.value(_FakeEmailBody_0(
          this,
          Invocation.method(
            #getEmailBody,
            [emailId],
          ),
        )),
-      ) as _i5.Future<_i3.EmailBody>);
+      ) as _i4.Future<_i2.EmailBody>);

  @override
-  _i5.Future<_i3.SyncEmailsResult> syncEmails(
+  _i4.Future<_i2.SyncEmailsResult> syncEmails(
    String? accountId,
    String? mailboxPath,
  ) =>
@@ -344,7 +306,7 @@ class MockEmailRepository extends _i1.Mock implements _i9.EmailRepository {
          ],
        ),
        returnValue:
-            _i5.Future<_i3.SyncEmailsResult>.value(_FakeSyncEmailsResult_2(
+            _i4.Future<_i2.SyncEmailsResult>.value(_FakeSyncEmailsResult_1(
          this,
          Invocation.method(
            #syncEmails,
@@ -354,10 +316,10 @@ class MockEmailRepository extends _i1.Mock implements _i9.EmailRepository {
            ],
          ),
        )),
-      ) as _i5.Future<_i3.SyncEmailsResult>);
+      ) as _i4.Future<_i2.SyncEmailsResult>);

  @override
-  _i5.Future<void> setFlag(
+  _i4.Future<void> setFlag(
    String? emailId, {
    bool? seen,
    bool? flagged,
@@ -371,12 +333,12 @@ class MockEmailRepository extends _i1.Mock implements _i9.EmailRepository {
            #flagged: flagged,
          },
        ),
-        returnValue: _i5.Future<void>.value(),
-        returnValueForMissingStub: _i5.Future<void>.value(),
-      ) as _i5.Future<void>);
+        returnValue: _i4.Future<void>.value(),
+        returnValueForMissingStub: _i4.Future<void>.value(),
+      ) as _i4.Future<void>);

  @override
-  _i5.Future<void> markAllAsRead(
+  _i4.Future<void> markAllAsRead(
    String? accountId,
    String? mailboxPath,
  ) =>
@@ -388,12 +350,12 @@ class MockEmailRepository extends _i1.Mock implements _i9.EmailRepository {
            mailboxPath,
          ],
        ),
-        returnValue: _i5.Future<void>.value(),
-        returnValueForMissingStub: _i5.Future<void>.value(),
-      ) as _i5.Future<void>);
+        returnValue: _i4.Future<void>.value(),
+        returnValueForMissingStub: _i4.Future<void>.value(),
+      ) as _i4.Future<void>);

  @override
-  _i5.Future<void> moveEmail(
+  _i4.Future<void> moveEmail(
    String? emailId,
    String? destMailboxPath,
  ) =>
@@ -405,23 +367,23 @@ class MockEmailRepository extends _i1.Mock implements _i9.EmailRepository {
            destMailboxPath,
          ],
        ),
-        returnValue: _i5.Future<void>.value(),
-        returnValueForMissingStub: _i5.Future<void>.value(),
-      ) as _i5.Future<void>);
+        returnValue: _i4.Future<void>.value(),
+        returnValueForMissingStub: _i4.Future<void>.value(),
+      ) as _i4.Future<void>);

  @override
-  _i5.Future<String?> deleteEmail(String? emailId) => (super.noSuchMethod(
+  _i4.Future<String?> deleteEmail(String? emailId) => (super.noSuchMethod(
        Invocation.method(
          #deleteEmail,
          [emailId],
        ),
-        returnValue: _i5.Future<String?>.value(),
-      ) as _i5.Future<String?>);
+        returnValue: _i4.Future<String?>.value(),
+      ) as _i4.Future<String?>);

  @override
-  _i5.Future<void> sendEmail(
+  _i4.Future<void> sendEmail(
    String? accountId,
-    _i3.EmailDraft? draft,
+    _i2.EmailDraft? draft,
  ) =>
      (super.noSuchMethod(
        Invocation.method(
@@ -431,14 +393,14 @@ class MockEmailRepository extends _i1.Mock implements _i9.EmailRepository {
            draft,
          ],
        ),
-        returnValue: _i5.Future<void>.value(),
-        returnValueForMissingStub: _i5.Future<void>.value(),
-      ) as _i5.Future<void>);
+        returnValue: _i4.Future<void>.value(),
+        returnValueForMissingStub: _i4.Future<void>.value(),
+      ) as _i4.Future<void>);

  @override
-  _i5.Future<String> downloadAttachment(
+  _i4.Future<String> downloadAttachment(
    String? emailId,
-    _i3.EmailAttachment? attachment,
+    _i2.EmailAttachment? attachment,
  ) =>
      (super.noSuchMethod(
        Invocation.method(
@@ -448,7 +410,7 @@ class MockEmailRepository extends _i1.Mock implements _i9.EmailRepository {
            attachment,
          ],
        ),
-        returnValue: _i5.Future<String>.value(_i7.dummyValue<String>(
+        returnValue: _i4.Future<String>.value(_i6.dummyValue<String>(
          this,
          Invocation.method(
            #downloadAttachment,
@@ -458,25 +420,25 @@ class MockEmailRepository extends _i1.Mock implements _i9.EmailRepository {
            ],
          ),
        )),
-      ) as _i5.Future<String>);
+      ) as _i4.Future<String>);

  @override
-  _i5.Future<String> fetchRawRfc822(String? emailId) => (super.noSuchMethod(
+  _i4.Future<String> fetchRawRfc822(String? emailId) => (super.noSuchMethod(
        Invocation.method(
          #fetchRawRfc822,
          [emailId],
        ),
-        returnValue: _i5.Future<String>.value(_i7.dummyValue<String>(
+        returnValue: _i4.Future<String>.value(_i6.dummyValue<String>(
          this,
          Invocation.method(
            #fetchRawRfc822,
            [emailId],
          ),
        )),
-      ) as _i5.Future<String>);
+      ) as _i4.Future<String>);

  @override
-  _i5.Future<List<_i3.Email>> searchEmails(
+  _i4.Future<List<_i2.Email>> searchEmails(
    String? accountId,
    String? mailboxPath,
    String? query,
@@ -490,11 +452,11 @@ class MockEmailRepository extends _i1.Mock implements _i9.EmailRepository {
            query,
          ],
        ),
-        returnValue: _i5.Future<List<_i3.Email>>.value(<_i3.Email>[]),
-      ) as _i5.Future<List<_i3.Email>>);
+        returnValue: _i4.Future<List<_i2.Email>>.value(<_i2.Email>[]),
+      ) as _i4.Future<List<_i2.Email>>);

  @override
-  _i5.Future<List<_i3.Email>> searchEmailsGlobal(
+  _i4.Future<List<_i2.Email>> searchEmailsGlobal(
    String? accountId,
    String? query,
  ) =>
@@ -506,11 +468,11 @@ class MockEmailRepository extends _i1.Mock implements _i9.EmailRepository {
            query,
          ],
        ),
-        returnValue: _i5.Future<List<_i3.Email>>.value(<_i3.Email>[]),
-      ) as _i5.Future<List<_i3.Email>>);
+        returnValue: _i4.Future<List<_i2.Email>>.value(<_i2.Email>[]),
+      ) as _i4.Future<List<_i2.Email>>);

  @override
-  _i5.Future<List<_i3.Email>> getEmailsByAddress(
+  _i4.Future<List<_i2.Email>> getEmailsByAddress(
    String? accountId,
    String? address,
  ) =>
@@ -522,11 +484,11 @@ class MockEmailRepository extends _i1.Mock implements _i9.EmailRepository {
            address,
          ],
        ),
-        returnValue: _i5.Future<List<_i3.Email>>.value(<_i3.Email>[]),
-      ) as _i5.Future<List<_i3.Email>>);
+        returnValue: _i4.Future<List<_i2.Email>>.value(<_i2.Email>[]),
+      ) as _i4.Future<List<_i2.Email>>);

  @override
-  _i5.Future<List<_i3.EmailAddress>> searchAddresses(
+  _i4.Future<List<_i2.EmailAddress>> searchAddresses(
    String? accountId,
    String? query, {
    int? limit = 10,
@@ -541,11 +503,11 @@ class MockEmailRepository extends _i1.Mock implements _i9.EmailRepository {
          {#limit: limit},
        ),
        returnValue:
-            _i5.Future<List<_i3.EmailAddress>>.value(<_i3.EmailAddress>[]),
-      ) as _i5.Future<List<_i3.EmailAddress>>);
+            _i4.Future<List<_i2.EmailAddress>>.value(<_i2.EmailAddress>[]),
+      ) as _i4.Future<List<_i2.EmailAddress>>);

  @override
-  _i5.Future<int> flushPendingChanges(
+  _i4.Future<int> flushPendingChanges(
    String? accountId,
    String? password,
  ) =>
@@ -557,42 +519,42 @@ class MockEmailRepository extends _i1.Mock implements _i9.EmailRepository {
            password,
          ],
        ),
-        returnValue: _i5.Future<int>.value(0),
-      ) as _i5.Future<int>);
+        returnValue: _i4.Future<int>.value(0),
+      ) as _i4.Future<int>);

  @override
-  _i5.Stream<List<_i3.FailedMutation>> observeFailedMutations(
+  _i4.Stream<List<_i2.FailedMutation>> observeFailedMutations(
          String? accountId) =>
      (super.noSuchMethod(
        Invocation.method(
          #observeFailedMutations,
          [accountId],
        ),
-        returnValue: _i5.Stream<List<_i3.FailedMutation>>.empty(),
-      ) as _i5.Stream<List<_i3.FailedMutation>>);
+        returnValue: _i4.Stream<List<_i2.FailedMutation>>.empty(),
+      ) as _i4.Stream<List<_i2.FailedMutation>>);

  @override
-  _i5.Future<void> discardMutation(int? id) => (super.noSuchMethod(
+  _i4.Future<void> discardMutation(int? id) => (super.noSuchMethod(
        Invocation.method(
          #discardMutation,
          [id],
        ),
-        returnValue: _i5.Future<void>.value(),
-        returnValueForMissingStub: _i5.Future<void>.value(),
-      ) as _i5.Future<void>);
+        returnValue: _i4.Future<void>.value(),
+        returnValueForMissingStub: _i4.Future<void>.value(),
+      ) as _i4.Future<void>);

  @override
-  _i5.Future<void> retryMutation(int? id) => (super.noSuchMethod(
+  _i4.Future<void> retryMutation(int? id) => (super.noSuchMethod(
        Invocation.method(
          #retryMutation,
          [id],
        ),
-        returnValue: _i5.Future<void>.value(),
-        returnValueForMissingStub: _i5.Future<void>.value(),
-      ) as _i5.Future<void>);
+        returnValue: _i4.Future<void>.value(),
+        returnValueForMissingStub: _i4.Future<void>.value(),
+      ) as _i4.Future<void>);

  @override
-  _i5.Future<bool> cancelPendingChange(
+  _i4.Future<bool> cancelPendingChange(
    String? emailId,
    String? changeType,
  ) =>
@@ -604,11 +566,11 @@ class MockEmailRepository extends _i1.Mock implements _i9.EmailRepository {
            changeType,
          ],
        ),
-        returnValue: _i5.Future<bool>.value(false),
-      ) as _i5.Future<bool>);
+        returnValue: _i4.Future<bool>.value(false),
+      ) as _i4.Future<bool>);

  @override
-  _i5.Future<void> snoozeEmail(
+  _i4.Future<void> snoozeEmail(
    String? emailId,
    DateTime? until,
  ) =>
@@ -620,32 +582,32 @@ class MockEmailRepository extends _i1.Mock implements _i9.EmailRepository {
            until,
          ],
        ),
-        returnValue: _i5.Future<void>.value(),
-        returnValueForMissingStub: _i5.Future<void>.value(),
-      ) as _i5.Future<void>);
+        returnValue: _i4.Future<void>.value(),
+        returnValueForMissingStub: _i4.Future<void>.value(),
+      ) as _i4.Future<void>);

  @override
-  _i5.Future<int> wakeUpEmails(String? accountId) => (super.noSuchMethod(
+  _i4.Future<int> wakeUpEmails(String? accountId) => (super.noSuchMethod(
        Invocation.method(
          #wakeUpEmails,
          [accountId],
        ),
-        returnValue: _i5.Future<int>.value(0),
-      ) as _i5.Future<int>);
+        returnValue: _i4.Future<int>.value(0),
+      ) as _i4.Future<int>);

  @override
-  _i5.Future<void> restoreEmails(List<_i3.Email>? emails) =>
+  _i4.Future<void> restoreEmails(List<_i2.Email>? emails) =>
      (super.noSuchMethod(
        Invocation.method(
          #restoreEmails,
          [emails],
        ),
-        returnValue: _i5.Future<void>.value(),
-        returnValueForMissingStub: _i5.Future<void>.value(),
-      ) as _i5.Future<void>);
+        returnValue: _i4.Future<void>.value(),
+        returnValueForMissingStub: _i4.Future<void>.value(),
+      ) as _i4.Future<void>);

  @override
-  _i5.Future<_i3.Email?> findEmailByMessageId(
+  _i4.Future<_i2.Email?> findEmailByMessageId(
    String? accountId,
    String? messageId,
  ) =>
@@ -657,20 +619,20 @@ class MockEmailRepository extends _i1.Mock implements _i9.EmailRepository {
            messageId,
          ],
        ),
-        returnValue: _i5.Future<_i3.Email?>.value(),
-      ) as _i5.Future<_i3.Email?>);
+        returnValue: _i4.Future<_i2.Email?>.value(),
+      ) as _i4.Future<_i2.Email?>);

  @override
-  _i5.Future<int> applySieveRules(String? accountId) => (super.noSuchMethod(
+  _i4.Future<int> applySieveRules(String? accountId) => (super.noSuchMethod(
        Invocation.method(
          #applySieveRules,
          [accountId],
        ),
-        returnValue: _i5.Future<int>.value(0),
-      ) as _i5.Future<int>);
+        returnValue: _i4.Future<int>.value(0),
+      ) as _i4.Future<int>);

  @override
-  _i5.Stream<void> watchJmapPush(
+  _i4.Stream<void> watchJmapPush(
    String? accountId,
    String? password,
  ) =>
@@ -682,11 +644,11 @@ class MockEmailRepository extends _i1.Mock implements _i9.EmailRepository {
            password,
          ],
        ),
-        returnValue: _i5.Stream<void>.empty(),
-      ) as _i5.Stream<void>);
+        returnValue: _i4.Stream<void>.empty(),
+      ) as _i4.Stream<void>);

  @override
-  _i5.Future<_i3.ReliabilityResult> verifySyncReliability(
+  _i4.Future<_i2.ReliabilityResult> verifySyncReliability(
    String? accountId,
    String? mailboxPath,
  ) =>
@@ -699,7 +661,7 @@ class MockEmailRepository extends _i1.Mock implements _i9.EmailRepository {
          ],
        ),
        returnValue:
-            _i5.Future<_i3.ReliabilityResult>.value(_FakeReliabilityResult_3(
+            _i4.Future<_i2.ReliabilityResult>.value(_FakeReliabilityResult_2(
          this,
          Invocation.method(
            #verifySyncReliability,
@@ -709,15 +671,15 @@ class MockEmailRepository extends _i1.Mock implements _i9.EmailRepository {
            ],
          ),
        )),
-      ) as _i5.Future<_i3.ReliabilityResult>);
+      ) as _i4.Future<_i2.ReliabilityResult>);

  @override
-  _i5.Future<void> clearForResync(String? accountId) => (super.noSuchMethod(
+  _i4.Future<void> clearForResync(String? accountId) => (super.noSuchMethod(
        Invocation.method(
          #clearForResync,
          [accountId],
        ),
-        returnValue: _i5.Future<void>.value(),
-        returnValueForMissingStub: _i5.Future<void>.value(),
-      ) as _i5.Future<void>);
+        returnValue: _i4.Future<void>.value(),
+        returnValueForMissingStub: _i4.Future<void>.value(),
+      ) as _i4.Future<void>);
 }
@@ -1,20 +0,0 @@
-import 'package:flutter_test/flutter_test.dart';
-import 'package:sharedinbox/core/sync/background_sync.dart';
-
-void main() {
-  TestWidgetsFlutterBinding.ensureInitialized();
-
-  // Regression test for https://codeberg.org/guettli/sharedinbox/issues/149:
-  // On some Android devices the WorkManager platform channel is absent at
-  // startup, throwing PlatformException(channel-error, ...).
-  // registerBackgroundSync() must absorb the failure and let the app continue.
-  test(
-      'registerBackgroundSync completes without throwing when plugin is unavailable',
-      () async {
-    // In the unit-test environment the native WorkManager plugin is not
-    // registered, so Workmanager().initialize() throws a PlatformException or
-    // MissingPluginException.  The fix catches it.  This test fails before the
-    // fix (exception propagates) and passes after it (exception is swallowed).
-    await expectLater(registerBackgroundSync(), completes);
-  });
-}
@@ -1,156 +0,0 @@
-import 'dart:async';
-import 'dart:io';
-
-import 'package:fake_async/fake_async.dart';
-import 'package:flutter/services.dart';
-import 'package:flutter_test/flutter_test.dart';
-import 'package:path_provider_platform_interface/path_provider_platform_interface.dart';
-import 'package:plugin_platform_interface/plugin_platform_interface.dart';
-
-import 'package:sharedinbox/data/db/database.dart';
-
-// Fake PathProviderPlatform that always throws PlatformException(channel-error)
-// to simulate the Pigeon channel not being ready at startup (issue #166).
-class _UnavailablePathProvider extends Fake
-    with MockPlatformInterfaceMixin
-    implements PathProviderPlatform {
-  @override
-  Future<String?> getApplicationSupportPath() async {
-    throw PlatformException(
-      code: 'channel-error',
-      message: 'Simulated: path_provider channel not ready',
-    );
-  }
-}
-
-// Fake PathProviderPlatform that fails the first [failCount] calls, then
-// returns a fixed path.  Used to exercise the retry loop in
-// _resolveDatabasePath() without waiting for real timers.
-class _SucceedAfterNPathProvider extends Fake
-    with MockPlatformInterfaceMixin
-    implements PathProviderPlatform {
-  _SucceedAfterNPathProvider({required this.failCount});
-
-  final int failCount;
-  int _callCount = 0;
-
-  @override
-  Future<String?> getApplicationSupportPath() async {
-    _callCount++;
-    if (_callCount <= failCount) {
-      throw PlatformException(
-        code: 'channel-error',
-        message: 'Simulated: path_provider channel not ready',
-      );
-    }
-    return '/tmp/test_app_support';
-  }
-}
-
-void main() {
-  TestWidgetsFlutterBinding.ensureInitialized();
-
-  // Regression test for https://codeberg.org/guettli/sharedinbox/issues/166:
-  // On some slow Android devices the path_provider Pigeon channel is not ready
-  // when initDatabasePath() runs before runApp(). initDatabasePath() must
-  // absorb the PlatformException and let the app start; _resolveDatabasePath()
-  // then retries with back-off on first DB access.
-  test(
-    'initDatabasePath completes without throwing when path_provider is unavailable',
-    () async {
-      final prev = PathProviderPlatform.instance;
-      PathProviderPlatform.instance = _UnavailablePathProvider();
-      addTearDown(() => PathProviderPlatform.instance = prev);
-
-      // Must not throw — the exception is swallowed so the app can continue.
-      await expectLater(initDatabasePath(), completes);
-    },
-  );
-
-  // Tests for _resolveDatabasePath() — the lazy retry path called on first DB
-  // access when initDatabasePath() already failed.  fake_async lets us advance
-  // the back-off timers without waiting real-world milliseconds.
-
-  test(
-    '_resolveDatabasePath retries and eventually succeeds after transient failures',
-    () {
-      resetDatabasePathForTesting();
-      final prev = PathProviderPlatform.instance;
-      // Fail 3 times, succeed on the 4th call.  The delays in
-      // _resolveDatabasePath are [200, 500, 1000, 2000, 4000] ms, so three
-      // failures cost 200+500+1000 = 1700 ms before the fourth attempt.
-      PathProviderPlatform.instance = _SucceedAfterNPathProvider(failCount: 3);
-      addTearDown(() {
-        PathProviderPlatform.instance = prev;
-        resetDatabasePathForTesting();
-      });
-
-      fakeAsync((fake) {
-        String? result;
-        unawaited(resolveDatabasePathForTesting().then((r) => result = r));
-
-        // Advance fake time through the three back-off delays.
-        fake.elapse(const Duration(milliseconds: 200 + 500 + 1000 + 1));
-
-        expect(result, isNotNull);
-        expect(result, endsWith('sharedinbox.db'));
-      });
-    },
-  );
-
-  test(
-    '_resolveDatabasePath throws PlatformException after exhausting all retries',
-    () {
-      resetDatabasePathForTesting();
-      final prev = PathProviderPlatform.instance;
-      PathProviderPlatform.instance = _UnavailablePathProvider();
-      addTearDown(() {
-        PathProviderPlatform.instance = prev;
-        resetDatabasePathForTesting();
-      });
-
-      fakeAsync((fake) {
-        Object? caughtError;
-        unawaited(
-          resolveDatabasePathForTesting().catchError((Object e) {
-            caughtError = e;
-            return ''; // ignored; satisfies the Future<String> return type
-          }),
-        );
-
-        // Advance past all five back-off delays: 200+500+1000+2000+4000 ms.
-        fake.elapse(
-          const Duration(milliseconds: 200 + 500 + 1000 + 2000 + 4000 + 1),
-        );
-
-        expect(caughtError, isA<PlatformException>());
-        expect(
-          (caughtError! as PlatformException).message,
-          contains('cannot open database'),
-        );
-      });
-    },
-    // The Android fallback runs only on Android, so on the host machine the
-    // exception is still thrown after all retries.  Skip on Android to avoid
-    // depending on /data/user/0/... being absent in the test environment.
-    skip: Platform.isAndroid,
-  );
-
-  // Regression test for issue #192: _androidFallbackPath must return null when
-  // the process cmdline does not look like an Android package name (e.g. on
-  // the host test machine where the process is the Dart executable).
-  test(
-    '_androidFallbackPath returns null when process name is not a package name',
-    () async {
-      // On non-Android platforms the host process cmdline is a file-system path
-      // (starts with '/'), which the fallback correctly rejects.  On Android
-      // the process IS named after the package — the fallback is free to
-      // succeed or return null depending on the device state; we do not assert
-      // here so as not to constrain Android behaviour.
-      if (!Platform.isAndroid) {
-        final result = await androidFallbackPathForTesting();
-        expect(result, isNull);
-      }
-    },
-  );
-}
@@ -14,7 +14,6 @@ import 'package:sharedinbox/data/repositories/mailbox_repository_impl.dart';

 import 'account_repository_impl_test.dart' show MapSecureStorage;
 import 'db_test_helper.dart';
-import 'fake_imap.dart' show SnoozeSpyImapClient;
 // ── Helpers ───────────────────────────────────────────────────────────────────

 const _account = Account(
@@ -433,177 +432,5 @@ void main() {
      expect(result, isNotNull);
      expect(result!.role, 'inbox');
    });
-
-    group('createMailboxWithRole', () {
-      test('IMAP: creates mailbox on server and persists with role', () async {
-        final spy = SnoozeSpyImapClient();
-        final db = openTestDatabase();
-        final accounts = AccountRepositoryImpl(db, MapSecureStorage());
-        final mailboxes = MailboxRepositoryImpl(
-          db,
-          accounts,
-          imapConnect: (_, __, ___) async => spy,
-        );
-        await accounts.addAccount(_account, 'pw');
-
-        final result = await mailboxes.createMailboxWithRole(
-          'acc-1',
-          'Archive',
-          'archive',
-        );
-
-        expect(spy.createdMailbox, 'Archive');
-        expect(result.name, 'Archive');
-        expect(result.role, 'archive');
-        expect(result.path, 'Archive');
-
-        final found = await mailboxes.findMailboxByRole('acc-1', 'archive');
-        expect(found, isNotNull);
-        expect(found!.name, 'Archive');
-      });
-
-      test('JMAP: creates mailbox on server and persists with role', () async {
-        final r = _makeRepos(
-          httpClient: _mockJmap(
-            apiResponses: [
-              {
-                'sessionState': 'sess1',
-                'methodResponses': [
-                  [
-                    'Mailbox/set',
-                    {
-                      'accountId': 'acct1',
-                      'created': {
-                        'new-mailbox': {'id': 'mbx-archive'},
-                      },
-                    },
-                    '0',
-                  ],
-                ],
-              },
-            ],
-          ),
-        );
-        await r.accounts.addAccount(_jmapAccount, 'pw');
-
-        final result = await r.mailboxes
-            .createMailboxWithRole('jmap-1', 'Archive', 'archive');
-
-        expect(result.name, 'Archive');
-        expect(result.role, 'archive');
-        expect(result.path, 'mbx-archive');
-
-        final found = await r.mailboxes.findMailboxByRole('jmap-1', 'archive');
-        expect(found, isNotNull);
-        expect(found!.name, 'Archive');
-      });
-
-      test(
-        'JMAP: throws when server returns no created ID',
-        () async {
-          final r = _makeRepos(
-            httpClient: _mockJmap(
-              apiResponses: [
-                {
-                  'sessionState': 'sess1',
-                  'methodResponses': [
-                    [
-                      'Mailbox/set',
-                      {
-                        'accountId': 'acct1',
-                        'created': null,
-                        'notCreated': {
-                          'new-mailbox': {'type': 'serverFail'},
-                        },
-                      },
-                      '0',
-                    ],
-                  ],
-                },
-              ],
-            ),
-          );
-          await r.accounts.addAccount(_jmapAccount, 'pw');
-
-          await expectLater(
-            r.mailboxes.createMailboxWithRole('jmap-1', 'Archive', 'archive'),
-            throwsA(isA<Exception>()),
-          );
-        },
-      );
-    });
-
-    group('syncMailboxes IMAP preserves manually-set role', () {
-      test('existing role is kept when server returns no special-use flag',
-          () async {
-        final spy = SnoozeSpyImapClient();
-        // Make listMailboxes return a plain folder without \Archive.
-        final db = openTestDatabase();
-        final accounts = AccountRepositoryImpl(db, MapSecureStorage());
-
-        // Override listMailboxes to return one plain folder.
-        final fakeClient = _PlainArchiveImapClient();
-        final mailboxes = MailboxRepositoryImpl(
-          db,
-          accounts,
-          imapConnect: (_, __, ___) async => fakeClient,
-        );
-        await accounts.addAccount(_account, 'pw');
-
-        // Pre-seed the DB with role='archive' (as if user created the folder).
-        await db.into(db.mailboxes).insert(
-              MailboxesCompanion.insert(
-                id: 'acc-1:Archive',
-                accountId: 'acc-1',
-                path: 'Archive',
-                name: 'Archive',
-                role: const Value('archive'),
-              ),
-            );
-
-        await mailboxes.syncMailboxes('acc-1');
-
-        final found = await mailboxes.findMailboxByRole('acc-1', 'archive');
-        expect(
-          found,
-          isNotNull,
-          reason: 'Manually-set role should be preserved after sync',
-        );
-        expect(found!.path, 'Archive');
-        // Suppress unused warning on spy.
-        expect(spy, isNotNull);
-      });
-    });
  });
 }
-
-/// Fake IMAP client that lists one mailbox named 'Archive' without any
-/// special-use flags, and logs out cleanly.
-class _PlainArchiveImapClient extends SnoozeSpyImapClient {
-  @override
-  Future<List<imap.Mailbox>> listMailboxes({
-    String path = '""',
-    bool recursive = false,
-    List<String>? mailboxPatterns,
-    List<String>? selectionOptions,
-    List<imap.ReturnOption>? returnOptions,
-  }) async =>
-      [
-        imap.Mailbox(
-          encodedName: 'Archive',
-          encodedPath: 'Archive',
-          pathSeparator: '/',
-          flags: [], // No \Archive special-use flag
-        ),
-      ];
-
-  @override
-  Future<imap.Mailbox> statusMailbox(
-    imap.Mailbox mailbox,
-    List<imap.StatusFlags> flags,
-  ) async =>
-      mailbox;
-
-  @override
-  Future<dynamic> logout() async {}
-}
@@ -14,7 +14,7 @@ void main() {
  group('Migration', () {
    test('schemaVersion matches expected value', () async {
      final db = AppDatabase(NativeDatabase.memory());
-      expect(db.schemaVersion, 34);
+      expect(db.schemaVersion, 32);
      await db.close();
    });

@@ -194,14 +194,6 @@ void main() {
      // v32: local_sieve_applied table.
      await db.customSelect('SELECT count(*) FROM local_sieve_applied').get();

-      // v33: error_stack_trace and is_permanent columns on sync_logs.
-      final syncLogColumns = await _tableColumns(db, 'sync_logs');
-      expect(syncLogColumns, contains('error_stack_trace'));
-      expect(syncLogColumns, contains('is_permanent'));
-
-      // v34: user_preferences table.
-      await db.customSelect('SELECT count(*) FROM user_preferences').get();
-
      await db.close();
      if (dbFile.existsSync()) dbFile.deleteSync();
    });
@@ -389,19 +381,11 @@ void main() {
          await _tableColumns(db, 'sync_log_mailboxes');
      expect(syncLogMailboxColumns, contains('duration_ms'));

-      // v33: error_stack_trace and is_permanent columns on sync_logs.
-      final syncLogColumns = await _tableColumns(db, 'sync_logs');
-      expect(syncLogColumns, contains('error_stack_trace'));
-      expect(syncLogColumns, contains('is_permanent'));
-
-      // v34: user_preferences table.
-      await db.customSelect('SELECT count(*) FROM user_preferences').get();
-
      await db.close();
      if (dbFile.existsSync()) dbFile.deleteSync();
    });

-    test('fresh install creates all tables at schemaVersion 34', () async {
+    test('fresh install creates all tables at schemaVersion 32', () async {
      final db = AppDatabase(NativeDatabase.memory());
      await db.select(db.accounts).get();

@@ -428,7 +412,6 @@ void main() {
          'local_sieve_scripts', // v29
          'share_keys', // v31
          'local_sieve_applied', // v32
-          'user_preferences', // v34
        ]),
      );

@@ -443,11 +426,6 @@ void main() {
          await _tableColumns(db, 'sync_log_mailboxes');
      expect(syncLogMailboxColumns, contains('duration_ms'));

-      // v33: error_stack_trace and is_permanent columns on sync_logs.
-      final syncLogColumns = await _tableColumns(db, 'sync_logs');
-      expect(syncLogColumns, contains('error_stack_trace'));
-      expect(syncLogColumns, contains('is_permanent'));
-
      await db.close();
    });
  });
@@ -1,26 +0,0 @@
-import 'package:flutter_test/flutter_test.dart';
-import 'package:sharedinbox/core/services/notification_service.dart';
-
-void main() {
-  TestWidgetsFlutterBinding.ensureInitialized();
-
-  // Regression test for https://codeberg.org/guettli/sharedinbox/issues/146:
-  // On some Android devices the flutter_local_notifications plugin channel is
-  // absent at startup, throwing MissingPluginException (or a similar error).
-  // initNotifications() must absorb the failure and let the app continue.
-  test(
-      'initNotifications completes without throwing when plugin is unavailable',
-      () async {
-    // In the unit-test environment the native plugin is not registered, so
-    // _plugin.initialize() throws. The fix catches it and keeps _initialized
-    // false.  This test fails before the fix (exception propagates) and passes
-    // after it (exception is swallowed).
-    await expectLater(initNotifications(), completes);
-  });
-
-  test('showNewMailNotification completes without throwing', () async {
-    // Platform.isAndroid is false in tests, so this returns early without
-    // touching the plugin.  Ensures the guard path is exercised.
-    await expectLater(showNewMailNotification('test@example.com'), completes);
-  });
-}
@@ -62,21 +62,6 @@ class _FakeMailboxes implements MailboxRepository {
      null;
  @override
  Future<void> clearForResync(String accountId) async {}
-  @override
-  Future<Mailbox> createMailboxWithRole(
-    String accountId,
-    String name,
-    String role,
-  ) async =>
-      Mailbox(
-        id: '$accountId:$name',
-        accountId: accountId,
-        path: name,
-        name: name,
-        role: role,
-        unreadCount: 0,
-        totalCount: 0,
-      );
 }

 class _FakeEmails implements EmailRepository {
@@ -54,21 +54,6 @@ class _FakeMailboxes implements MailboxRepository {
      null;
  @override
  Future<void> clearForResync(String accountId) async {}
-  @override
-  Future<Mailbox> createMailboxWithRole(
-    String accountId,
-    String name,
-    String role,
-  ) async =>
-      Mailbox(
-        id: '$accountId:$name',
-        accountId: accountId,
-        path: name,
-        name: name,
-        role: role,
-        unreadCount: 0,
-        totalCount: 0,
-      );
 }

 class _CountingEmails implements EmailRepository {
@@ -185,8 +170,6 @@ class _FakeSyncLog implements SyncLogRepository {
    required String accountId,
    required bool success,
    String? errorMessage,
-    String? stackTrace,
-    bool isPermanent = false,
    required String protocol,
    required int emailsFetched,
    required int emailsSkipped,
@@ -126,34 +126,4 @@ void main() {
    expect(rows.first.result, 'error');
    expect(rows.first.errorMessage, 'Connection refused');
  });
-
-  test('stores and retrieves stackTrace and isPermanent on error entries',
-      () async {
-    final repo = SyncLogRepositoryImpl(db);
-    final start = DateTime(2024, 3, 1, 9);
-    final end = DateTime(2024, 3, 1, 9, 0, 1);
-    const fakeTrace = '#0 main (file:///app/lib/main.dart:10:5)';
-
-    await repo.log(
-      accountId: 'acc1',
-      success: false,
-      errorMessage: 'MissingPluginException',
-      stackTrace: fakeTrace,
-      isPermanent: true,
-      protocol: 'imap',
-      emailsFetched: 0,
-      emailsSkipped: 0,
-      mailboxesSynced: 0,
-      pendingFlushed: 0,
-      bytesTransferred: 0,
-      startedAt: start,
-      finishedAt: end,
-    );
-
-    final entries = await repo.observeSyncLogs('acc1').first;
-    final entry = entries.firstWhere((e) => e.startedAt == start);
-    expect(entry.stackTrace, fakeTrace);
-    expect(entry.isPermanent, true);
-    expect(entry.errorMessage, 'MissingPluginException');
-  });
 }
@@ -27,22 +27,6 @@ class MockUrlLauncher extends Mock
  }
 }

-class ThrowingUrlLauncher extends Mock
-    with MockPlatformInterfaceMixin
-    implements UrlLauncherPlatform {
-  @override
-  Future<bool> canLaunch(String? url) async => true;
-
-  @override
-  Future<bool> launchUrl(String? url, LaunchOptions? options) async {
-    throw PlatformException(
-      code: 'channel-error',
-      message: 'Unable to establish connection on channel: '
-          '"dev.flutter.pigeon.url_launcher_android.UrlLauncherApi.launchUrl".',
-    );
-  }
-}
-
 Widget _buildScreen({List<Account> accounts = const []}) {
  return ProviderScope(
    overrides: [
@@ -80,9 +64,6 @@ void main() {
    expect(find.textContaining('Dark Mode'), findsWidgets);
    expect(find.textContaining('IMAP Accounts'), findsWidgets);
    expect(find.textContaining('JMAP Accounts'), findsWidgets);
-    expect(find.textContaining('Locale'), findsWidgets);
-    expect(find.textContaining('Text Scale'), findsWidgets);
-    expect(find.textContaining('DB Schema Version'), findsWidgets);
    // Buttons are in the body, not in the AppBar actions
    expect(find.byIcon(Icons.copy), findsOneWidget);
    expect(find.byIcon(Icons.bug_report), findsOneWidget);
@@ -170,13 +151,6 @@ void main() {
    expect(clipboardText, contains('Dark Mode'));
    expect(clipboardText, contains('IMAP Accounts'));
    expect(clipboardText, contains('JMAP Accounts'));
-    expect(clipboardText, contains('Locale'));
-    expect(clipboardText, contains('Text Scale'));
-    expect(clipboardText, contains('DB Schema Version'));
-    expect(
-      clipboardText,
-      contains('[sharedinbox.de](https://sharedinbox.de)'),
-    );
  });

  testWidgets('AboutScreen create-issue button opens Codeberg URL', (
@@ -202,24 +176,4 @@ void main() {
    );
    expect(mock.launchedUrl, contains('1.2.3%2B99'));
  });
-
-  testWidgets(
-    'AboutScreen link tap with failed url_launcher shows error snackbar',
-    (tester) async {
-      tester.view.physicalSize = const Size(800, 1200);
-      tester.view.devicePixelRatio = 1.0;
-      addTearDown(tester.view.resetPhysicalSize);
-      addTearDown(tester.view.resetDevicePixelRatio);
-
-      UrlLauncherPlatform.instance = ThrowingUrlLauncher();
-
-      await tester.pumpWidget(_buildScreen());
-      await tester.pumpAndSettle();
-
-      await tester.tap(find.textContaining('sharedinbox.de').first);
-      await tester.pumpAndSettle();
-
-      expect(find.textContaining('Error:'), findsOneWidget);
-    },
-  );
 }
@@ -23,7 +23,7 @@ void main() {
      expect(find.byKey(const Key('scanEncryptedButton')), findsOneWidget);
    });

-    testWidgets('shows expiry countdown hint', (tester) async {
+    testWidgets('shows 20-minute expiry hint', (tester) async {
      await tester.pumpWidget(
        buildApp(
          initialLocation: '/accounts/receive',
@@ -32,106 +32,8 @@ void main() {
      );
      await tester.pumpAndSettle();

-      expect(find.textContaining('expires in'), findsOneWidget);
+      expect(find.textContaining('20 minutes'), findsOneWidget);
    });
-
-    testWidgets(
-      'step 2 button shows text-input fallback on platforms without camera',
-      (tester) async {
-        await tester.pumpWidget(
-          buildApp(
-            initialLocation: '/accounts/receive',
-            overrides: baseOverrides(),
-          ),
-        );
-        await tester.pumpAndSettle();
-
-        await tester.tap(find.byKey(const Key('scanEncryptedButton')));
-        await tester.pumpAndSettle();
-
-        // On Linux (desktop, no camera) the text fallback field must appear.
-        expect(find.byKey(const Key('encryptedCodeField')), findsOneWidget);
-      },
-    );
-
-    testWidgets(
-      'step 2 — valid encrypted QR imports account via text fallback',
-      (tester) async {
-        // Pre-generate a key pair so we can encrypt a QR code with the same
-        // material the screen will use for decryption.
-        final material = await ShareEncryptionService.generateKeyPair();
-        final repo = FakeShareKeyRepository(material: material);
-
-        const account = Account(
-          id: 'src-1',
-          displayName: 'Alice',
-          email: 'alice@example.com',
-          imapHost: 'imap.example.com',
-          smtpHost: 'smtp.example.com',
-        );
-
-        final encryptedQr = await ShareEncryptionService.encryptAccounts(
-          recipientKeyId: material.keyId,
-          recipientPublicKeyBytes: material.publicKeyBytes,
-          accounts: [
-            AccountPayload(
-              accountJson: account.toJson(),
-              password: 'secret',
-            ),
-          ],
-        );
-
-        await tester.pumpWidget(
-          buildApp(
-            initialLocation: '/accounts/receive',
-            overrides: baseOverrides(shareKeyRepository: repo),
-          ),
-        );
-        await tester.pumpAndSettle(); // key generation completes
-
-        await tester.tap(find.byKey(const Key('scanEncryptedButton')));
-        await tester.pumpAndSettle();
-
-        await tester.enterText(
-          find.byKey(const Key('encryptedCodeField')),
-          encryptedQr,
-        );
-        await tester.tap(find.text('Import'));
-        await tester.pumpAndSettle();
-
-        expect(
-          find.text('Imported 1 account successfully.'),
-          findsOneWidget,
-        );
-      },
-    );
-
-    testWidgets(
-      'step 2 — invalid encrypted QR shows error and returns to pub-key step',
-      (tester) async {
-        await tester.pumpWidget(
-          buildApp(
-            initialLocation: '/accounts/receive',
-            overrides: baseOverrides(),
-          ),
-        );
-        await tester.pumpAndSettle();
-
-        await tester.tap(find.byKey(const Key('scanEncryptedButton')));
-        await tester.pumpAndSettle();
-
-        await tester.enterText(
-          find.byKey(const Key('encryptedCodeField')),
-          'not-a-valid-qr-code',
-        );
-        await tester.tap(find.text('Import'));
-        await tester.pumpAndSettle();
-
-        // Screen returns to the pub-key step with an error message visible.
-        expect(find.byKey(const Key('pubKeyQrCode')), findsOneWidget);
-        expect(find.textContaining('Import failed:'), findsWidgets);
-      },
-    );
  });

  group('AccountSendScreen', () {
@@ -1,6 +1,5 @@
 import 'package:flutter/material.dart';
 import 'package:flutter_test/flutter_test.dart';
-import 'package:sharedinbox/data/db/database.dart' show SyncHealthRow;

 import 'helpers.dart';

@@ -207,50 +206,5 @@ void main() {
      expect(tester.takeException(), isNull);
      expect(find.text('sharedinbox.de'), findsOneWidget);
    });
-
-    testWidgets('shows Healthy when sync health is healthy', (tester) async {
-      await tester.pumpWidget(
-        buildApp(
-          initialLocation: '/accounts',
-          overrides: baseOverrides(
-            accounts: [kTestAccount],
-            syncHealth: SyncHealthRow(
-              accountId: kTestAccount.id,
-              lastVerifiedAt: DateTime(2024, 6),
-              isHealthy: true,
-            ),
-          ),
-        ),
-      );
-      await tester.pumpAndSettle();
-
-      expect(find.textContaining('Healthy'), findsOneWidget);
-    });
-
-    testWidgets(
-      'shows discrepancy details when sync health has discrepancies',
-      (tester) async {
-        const summary =
-            '{"INBOX":{"missingLocally":3,"missingOnServer":0,"flagMismatches":1}}';
-        await tester.pumpWidget(
-          buildApp(
-            initialLocation: '/accounts',
-            overrides: baseOverrides(
-              accounts: [kTestAccount],
-              syncHealth: SyncHealthRow(
-                accountId: kTestAccount.id,
-                lastVerifiedAt: DateTime(2024, 6),
-                isHealthy: false,
-                discrepancySummary: summary,
-              ),
-            ),
-          ),
-        );
-        await tester.pumpAndSettle();
-
-        expect(find.textContaining('missing locally: 3'), findsOneWidget);
-        expect(find.textContaining('flag mismatches: 1'), findsOneWidget);
-      },
-    );
  });
 }
@@ -1,54 +0,0 @@
-import 'dart:convert';
-
-import 'package:flutter/material.dart';
-import 'package:flutter/services.dart';
-import 'package:flutter_test/flutter_test.dart';
-import 'package:sharedinbox/ui/screens/changelog_screen.dart';
-
-class _FakeAssetBundle extends CachingAssetBundle {
-  final Map<String, String> _assets;
-  _FakeAssetBundle(this._assets);
-
-  @override
-  Future<ByteData> load(String key) async {
-    if (_assets.containsKey(key)) {
-      final encoded = utf8.encode(_assets[key]!);
-      return ByteData.view(Uint8List.fromList(encoded).buffer);
-    }
-    throw FlutterError('Asset not found: "$key"');
-  }
-}
-
-const _fakeChangelog =
-    '* 2024-01-01 feat: initial release\n* 2024-01-02 fix: resolve crash\n';
-
-void main() {
-  testWidgets('ChangeLogScreen shows changelog content', (tester) async {
-    await tester.pumpWidget(
-      DefaultAssetBundle(
-        bundle: _FakeAssetBundle({'assets/changelog.txt': _fakeChangelog}),
-        child: const MaterialApp(home: ChangeLogScreen()),
-      ),
-    );
-    await tester.pumpAndSettle();
-
-    expect(find.text('ChangeLog'), findsOneWidget);
-    expect(find.textContaining('initial release'), findsOneWidget);
-    expect(find.textContaining('resolve crash'), findsOneWidget);
-    expect(find.textContaining('Error loading changelog'), findsNothing);
-  });
-
-  testWidgets('ChangeLogScreen shows error when asset is missing', (
-    tester,
-  ) async {
-    await tester.pumpWidget(
-      DefaultAssetBundle(
-        bundle: _FakeAssetBundle({}),
-        child: const MaterialApp(home: ChangeLogScreen()),
-      ),
-    );
-    await tester.pumpAndSettle();
-
-    expect(find.textContaining('Error loading changelog'), findsOneWidget);
-  });
-}
@@ -1,6 +1,5 @@
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
-import 'package:flutter_riverpod/misc.dart' show Override;
 import 'package:flutter_test/flutter_test.dart';
 import 'package:go_router/go_router.dart';

@@ -1,5 +1,4 @@
 import 'package:flutter/material.dart';
-import 'package:flutter/services.dart';
 import 'package:flutter_test/flutter_test.dart';
 import 'package:mockito/mockito.dart';
 import 'package:package_info_plus/package_info_plus.dart';
@@ -60,10 +59,6 @@ void main() {
    await tester.tap(find.text('Report Issue on Codeberg'));
    await tester.pumpAndSettle();

-    // Regression for #146: URL must contain only the title, NOT the full
-    // report body.  Long stack traces caused "create issue failed" by
-    // exceeding browser URL-length limits.  The report is copied to clipboard
-    // so the user can paste it into the issue body.
    expect(
      mock.launchedUrl,
      contains('https://codeberg.org/guettli/sharedinbox/issues/new'),
@@ -72,269 +67,7 @@ void main() {
      mock.launchedUrl,
      contains('title=Crash%3A%20TestException%3A%20something%20broke'),
    );
-    expect(mock.launchedUrl, isNot(contains('&body=')));
-    expect(mock.launchedUrl, isNot(contains('App%20Version')));
-    expect(mock.launchedUrl, isNot(contains('Stack%20Trace')));
+    expect(mock.launchedUrl, contains('App%20Version%3A%201.0.0%2B42'));
+    expect(mock.launchedUrl, contains('TestException%3A%20something%20broke'));
  });
-
-  testWidgets(
-    'CrashScreen copy-to-clipboard includes version and platform info',
-    (tester) async {
-      tester.view.physicalSize = const Size(800, 1200);
-      tester.view.devicePixelRatio = 1.0;
-      addTearDown(() => tester.view.resetPhysicalSize());
-
-      String? clipboardText;
-      tester.binding.defaultBinaryMessenger.setMockMethodCallHandler(
-        SystemChannels.platform,
-        (MethodCall call) async {
-          if (call.method == 'Clipboard.setData') {
-            clipboardText =
-                (call.arguments as Map<dynamic, dynamic>)['text'] as String?;
-          }
-          return null;
-        },
-      );
-      addTearDown(
-        () => tester.binding.defaultBinaryMessenger
-            .setMockMethodCallHandler(SystemChannels.platform, null),
-      );
-
-      const exception = 'TestException: clipboard test';
-      final stackTrace = StackTrace.current;
-
-      await tester.pumpWidget(
-        MaterialApp(
-          home: CrashScreen(exception: exception, stackTrace: stackTrace),
-        ),
-      );
-
-      await tester.tap(find.text('Copy to Clipboard'));
-      await tester.pump();
-      await tester.pump();
-      await tester.pumpAndSettle();
-
-      expect(clipboardText, isNotNull);
-      expect(clipboardText, contains('App Version: 1.0.0+42'));
-      expect(clipboardText, contains('Build Mode:'));
-      expect(clipboardText, contains('Platform:'));
-      expect(clipboardText, contains('Dart:'));
-      expect(clipboardText, contains('Timestamp:'));
-      expect(clipboardText, contains('TestException: clipboard test'));
-      // GIT_HASH is empty in test builds — no Git Commit line expected
-      expect(clipboardText, isNot(contains('Git Commit:')));
-    },
-  );
-
-  testWidgets(
-    'CrashScreen shows git hash as clickable link above stacktrace',
-    (tester) async {
-      tester.view.physicalSize = const Size(800, 1200);
-      tester.view.devicePixelRatio = 1.0;
-      addTearDown(() => tester.view.resetPhysicalSize());
-
-      final mock = MockUrlLauncher();
-      UrlLauncherPlatform.instance = mock;
-
-      const exception = 'TestException: git hash test';
-      final stackTrace = StackTrace.current;
-      const testHash = 'abc1234';
-
-      await tester.pumpWidget(
-        CrashScreen(
-          exception: exception,
-          stackTrace: stackTrace,
-          gitHash: testHash,
-        ),
-      );
-      await tester.pumpAndSettle();
-
-      // Git hash link should be present
-      final gitLinkFinder = find.textContaining('Git Commit: abc1234');
-      expect(gitLinkFinder, findsOneWidget);
-
-      // Link must appear above the stack trace
-      final stackTraceFinder = find.text('Stack Trace:');
-      expect(
-        tester.getTopLeft(gitLinkFinder).dy,
-        lessThan(tester.getTopLeft(stackTraceFinder).dy),
-      );
-
-      // Tapping the link should open the Codeberg commit URL
-      await tester.tap(gitLinkFinder);
-      await tester.pumpAndSettle();
-
-      expect(
-        mock.launchedUrl,
-        equals('https://codeberg.org/guettli/sharedinbox/commit/abc1234'),
-      );
-    },
-  );
-
-  testWidgets(
-    'CrashScreen shows version, build mode, and platform in the UI',
-    (tester) async {
-      tester.view.physicalSize = const Size(800, 1200);
-      tester.view.devicePixelRatio = 1.0;
-      addTearDown(() => tester.view.resetPhysicalSize());
-
-      const exception = 'TestException: info row test';
-      final stackTrace = StackTrace.current;
-
-      await tester.pumpWidget(
-        MaterialApp(
-          home: CrashScreen(exception: exception, stackTrace: stackTrace),
-        ),
-      );
-      await tester.pumpAndSettle();
-
-      // Info row shows app version (from mock), build mode, and platform OS.
-      expect(find.textContaining('1.0.0+42'), findsWidgets);
-      // In test builds kDebugMode is true.
-      expect(find.textContaining('debug'), findsOneWidget);
-      // Platform OS is always present (linux in CI, android/ios on device).
-      expect(
-        find.textContaining(RegExp(r'linux|android|ios|windows|macos')),
-        findsWidgets,
-      );
-    },
-  );
-
-  testWidgets(
-    'CrashScreen shows app version as clickable link when git hash is set',
-    (tester) async {
-      tester.view.physicalSize = const Size(800, 1200);
-      tester.view.devicePixelRatio = 1.0;
-      addTearDown(() => tester.view.resetPhysicalSize());
-
-      final mock = MockUrlLauncher();
-      UrlLauncherPlatform.instance = mock;
-
-      const exception = 'TestException: version link test';
-      final stackTrace = StackTrace.current;
-      const testHash = 'abc1234';
-
-      await tester.pumpWidget(
-        CrashScreen(
-          exception: exception,
-          stackTrace: stackTrace,
-          gitHash: testHash,
-        ),
-      );
-      await tester.pumpAndSettle();
-
-      // App version link should be present (mocked as 1.0.0+42)
-      final versionLinkFinder = find.textContaining('App Version: 1.0.0+42');
-      expect(versionLinkFinder, findsOneWidget);
-
-      // It must appear above the git hash link
-      final gitLinkFinder = find.textContaining('Git Commit: abc1234');
-      expect(
-        tester.getTopLeft(versionLinkFinder).dy,
-        lessThan(tester.getTopLeft(gitLinkFinder).dy),
-      );
-
-      // Tapping it should open the Codeberg commit URL
-      await tester.tap(versionLinkFinder);
-      await tester.pumpAndSettle();
-
-      expect(
-        mock.launchedUrl,
-        equals('https://codeberg.org/guettli/sharedinbox/commit/abc1234'),
-      );
-    },
-  );
-
-  testWidgets(
-    'CrashScreen copy-to-clipboard includes app version as markdown link when git hash is set',
-    (tester) async {
-      tester.view.physicalSize = const Size(800, 1200);
-      tester.view.devicePixelRatio = 1.0;
-      addTearDown(() => tester.view.resetPhysicalSize());
-
-      String? clipboardText;
-      tester.binding.defaultBinaryMessenger.setMockMethodCallHandler(
-        SystemChannels.platform,
-        (MethodCall call) async {
-          if (call.method == 'Clipboard.setData') {
-            clipboardText =
-                (call.arguments as Map<dynamic, dynamic>)['text'] as String?;
-          }
-          return null;
-        },
-      );
-      addTearDown(
-        () => tester.binding.defaultBinaryMessenger
-            .setMockMethodCallHandler(SystemChannels.platform, null),
-      );
-
-      const exception = 'TestException: version link clipboard test';
-      final stackTrace = StackTrace.current;
-      const testHash = 'abc1234';
-
-      await tester.pumpWidget(
-        CrashScreen(
-          exception: exception,
-          stackTrace: stackTrace,
-          gitHash: testHash,
-        ),
-      );
-      await tester.pumpAndSettle();
-
-      await tester.tap(find.text('Copy to Clipboard'));
-      await tester.pump();
-      await tester.pump();
-      await tester.pumpAndSettle();
-
-      expect(clipboardText, isNotNull);
-      // App Version must be a markdown link pointing to the commit
-      expect(
-        clipboardText,
-        contains(
-          'App Version: [1.0.0+42](https://codeberg.org/guettli/sharedinbox/commit/abc1234)',
-        ),
-      );
-      expect(
-        clipboardText,
-        contains(
-          'Git Commit: [abc1234](https://codeberg.org/guettli/sharedinbox/commit/abc1234)',
-        ),
-      );
-    },
-  );
-
-  testWidgets(
-    'CrashScreen used as root widget — buttons work without ScaffoldMessenger crash',
-    (tester) async {
-      // Regression test for: ScaffoldMessenger.of(context) null-crash when
-      // CrashScreen is the root widget (runApp path after startup crash).
-      tester.view.physicalSize = const Size(800, 1200);
-      tester.view.devicePixelRatio = 1.0;
-      addTearDown(() => tester.view.resetPhysicalSize());
-
-      final mock = MockUrlLauncher();
-      UrlLauncherPlatform.instance = mock;
-
-      const exception = 'TestException: startup crash';
-      final stackTrace = StackTrace.current;
-
-      // Pump CrashScreen directly as the root — no parent MaterialApp.
-      await tester.pumpWidget(
-        CrashScreen(exception: exception, stackTrace: stackTrace),
-      );
-
-      expect(find.textContaining('TestException'), findsOneWidget);
-
-      // Tapping 'Report Issue on Codeberg' must not crash. Previously
-      // ScaffoldMessenger.of(context) threw because context was above the
-      // MaterialApp that CrashScreen itself creates.
-      await tester.tap(find.text('Report Issue on Codeberg'));
-      await tester.pumpAndSettle();
-
-      expect(
-        mock.launchedUrl,
-        contains('https://codeberg.org/guettli/sharedinbox/issues/new'),
-      );
-    },
-  );
 }
@@ -105,88 +105,6 @@ void main() {
      expect(find.text('Edit account'), findsNothing);
    });

-    testWidgets(
-        'try connection button is disabled when no password stored or entered',
-        (
-      tester,
-    ) async {
-      tester.view.physicalSize = const Size(800, 1400);
-      tester.view.devicePixelRatio = 1.0;
-      addTearDown(tester.view.resetPhysicalSize);
-      addTearDown(tester.view.resetDevicePixelRatio);
-
-      await tester.pumpWidget(
-        buildApp(
-          initialLocation: '/accounts/acc-1/edit',
-          overrides: baseOverrides(
-            accounts: [kTestAccount],
-            hasStoredPassword: false,
-          ),
-        ),
-      );
-      await tester.pumpAndSettle();
-
-      final button = tester.widget<OutlinedButton>(
-        find.byKey(const Key('editTryConnectionButton')),
-      );
-      expect(button.onPressed, isNull);
-    });
-
-    testWidgets(
-        'try connection button is enabled after typing password with no stored password',
-        (tester) async {
-      tester.view.physicalSize = const Size(800, 1400);
-      tester.view.devicePixelRatio = 1.0;
-      addTearDown(tester.view.resetPhysicalSize);
-      addTearDown(tester.view.resetDevicePixelRatio);
-
-      await tester.pumpWidget(
-        buildApp(
-          initialLocation: '/accounts/acc-1/edit',
-          overrides: baseOverrides(
-            accounts: [kTestAccount],
-            hasStoredPassword: false,
-          ),
-        ),
-      );
-      await tester.pumpAndSettle();
-
-      await tester.enterText(
-        find.byKey(const Key('editPasswordField')),
-        'mypassword',
-      );
-      await tester.pump();
-
-      final button = tester.widget<OutlinedButton>(
-        find.byKey(const Key('editTryConnectionButton')),
-      );
-      expect(button.onPressed, isNotNull);
-    });
-
-    testWidgets('save button is disabled when no password stored or entered', (
-      tester,
-    ) async {
-      tester.view.physicalSize = const Size(800, 1400);
-      tester.view.devicePixelRatio = 1.0;
-      addTearDown(tester.view.resetPhysicalSize);
-      addTearDown(tester.view.resetDevicePixelRatio);
-
-      await tester.pumpWidget(
-        buildApp(
-          initialLocation: '/accounts/acc-1/edit',
-          overrides: baseOverrides(
-            accounts: [kTestAccount],
-            hasStoredPassword: false,
-          ),
-        ),
-      );
-      await tester.pumpAndSettle();
-
-      final button = tester
-          .widget<FilledButton>(find.widgetWithText(FilledButton, 'Save'));
-      expect(button.onPressed, isNull);
-    });
-
    testWidgets('connection error shows error message', (tester) async {
      tester.view.physicalSize = const Size(800, 1400);
      tester.view.devicePixelRatio = 1.0;
@@ -3,7 +3,7 @@ import 'dart:convert';
 import 'dart:io';

 import 'package:flutter/material.dart';
-import 'package:flutter_riverpod/misc.dart' show Override;
+import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:flutter_test/flutter_test.dart';
 import 'package:path_provider_platform_interface/path_provider_platform_interface.dart';

@@ -179,210 +179,6 @@ void main() {
      expect(find.text('report.pdf'), findsOneWidget);
    });

-    testWidgets('Reply All button is not present in app bar', (tester) async {
-      await tester.pumpWidget(
-        buildApp(
-          initialLocation: '/accounts/acc-1/mailboxes/INBOX/emails/acc-1%3A42',
-          overrides: _overrides(
-            body: const EmailBody(emailId: 'acc-1:42', attachments: []),
-          ),
-        ),
-      );
-      await tester.pumpAndSettle();
-
-      expect(
-        find.byWidgetPredicate(
-          (w) => w is Tooltip && w.message == 'Reply all',
-        ),
-        findsNothing,
-      );
-    });
-
-    testWidgets('Reply on single-recipient email navigates directly to compose',
-        (tester) async {
-      // testEmail has from=[bob], to=[alice]. After removing alice (own),
-      // only bob remains → no dialog, navigate straight to compose.
-      final email = testEmail();
-      await tester.pumpWidget(
-        buildApp(
-          initialLocation: '/accounts/acc-1/mailboxes/INBOX/emails/acc-1%3A42',
-          overrides: [
-            ..._overrides(
-              body: const EmailBody(emailId: 'acc-1:42', attachments: []),
-              email: email,
-            ),
-            draftRepositoryProvider.overrideWithValue(FakeDraftRepository()),
-          ],
-        ),
-      );
-      await tester.pumpAndSettle();
-
-      await tester.tap(
-        find.byWidgetPredicate(
-          (w) => w is Tooltip && w.message == 'Reply',
-        ),
-      );
-      await tester.pumpAndSettle();
-
-      // No dialog shown — straight navigation to compose.
-      expect(find.text('Reply All'), findsNothing);
-    });
-
-    testWidgets('Reply on multi-recipient email shows Reply All dialog',
-        (tester) async {
-      // Email with an extra Cc recipient so the dialog is triggered.
-      final email = Email(
-        id: 'acc-1:42',
-        accountId: 'acc-1',
-        mailboxPath: 'INBOX',
-        uid: 42,
-        subject: 'Hello world',
-        receivedAt: DateTime(2024, 6),
-        sentAt: DateTime(2024, 6),
-        from: const [EmailAddress(name: 'Bob', email: 'bob@example.com')],
-        to: const [EmailAddress(email: 'alice@example.com')],
-        cc: const [EmailAddress(name: 'Carol', email: 'carol@example.com')],
-        isSeen: false,
-        isFlagged: false,
-        hasAttachment: false,
-      );
-      await tester.pumpWidget(
-        buildApp(
-          initialLocation: '/accounts/acc-1/mailboxes/INBOX/emails/acc-1%3A42',
-          overrides: _overrides(
-            body: const EmailBody(emailId: 'acc-1:42', attachments: []),
-            email: email,
-          ),
-        ),
-      );
-      await tester.pumpAndSettle();
-
-      await tester.tap(
-        find.byWidgetPredicate(
-          (w) => w is Tooltip && w.message == 'Reply',
-        ),
-      );
-      await tester.pumpAndSettle();
-
-      // Dialog must appear with title 'Reply All'.
-      expect(find.text('Reply All'), findsOneWidget);
-      // Both non-own addresses should be listed in the dialog.
-      expect(find.textContaining('bob@example.com'), findsAtLeastNWidgets(1));
-      expect(find.textContaining('carol@example.com'), findsAtLeastNWidgets(1));
-    });
-
-    testWidgets('Mark as spam button is present in app bar', (tester) async {
-      await tester.pumpWidget(
-        buildApp(
-          initialLocation: '/accounts/acc-1/mailboxes/INBOX/emails/acc-1%3A42',
-          overrides: _overrides(
-            body: const EmailBody(emailId: 'acc-1:42', attachments: []),
-          ),
-        ),
-      );
-      await tester.pumpAndSettle();
-
-      expect(
-        find.byWidgetPredicate(
-          (w) => w is Tooltip && w.message == 'Mark as spam',
-        ),
-        findsOneWidget,
-      );
-    });
-
-    testWidgets('Mark as spam shows dialog when no junk folder',
-        (tester) async {
-      // FakeMailboxRepository has no mailboxes by default → findMailboxByRole
-      // returns null → dialog shown.
-      await tester.pumpWidget(
-        buildApp(
-          initialLocation: '/accounts/acc-1/mailboxes/INBOX/emails/acc-1%3A42',
-          overrides: _overrides(
-            body: const EmailBody(emailId: 'acc-1:42', attachments: []),
-          ),
-        ),
-      );
-      await tester.pumpAndSettle();
-
-      await tester.tap(
-        find.byWidgetPredicate(
-          (w) => w is Tooltip && w.message == 'Mark as spam',
-        ),
-      );
-      await tester.pumpAndSettle();
-
-      expect(find.text('No spam folder found'), findsOneWidget);
-    });
-
-    testWidgets('Archive button is present in app bar', (tester) async {
-      await tester.pumpWidget(
-        buildApp(
-          initialLocation: '/accounts/acc-1/mailboxes/INBOX/emails/acc-1%3A42',
-          overrides: _overrides(
-            body: const EmailBody(emailId: 'acc-1:42', attachments: []),
-          ),
-        ),
-      );
-      await tester.pumpAndSettle();
-
-      expect(
-        find.byWidgetPredicate(
-          (w) => w is Tooltip && w.message == 'Archive',
-        ),
-        findsOneWidget,
-      );
-    });
-
-    testWidgets('Archive shows dialog when no archive folder', (tester) async {
-      // FakeMailboxRepository has no mailboxes by default → findMailboxByRole
-      // returns null → dialog shown.
-      await tester.pumpWidget(
-        buildApp(
-          initialLocation: '/accounts/acc-1/mailboxes/INBOX/emails/acc-1%3A42',
-          overrides: _overrides(
-            body: const EmailBody(emailId: 'acc-1:42', attachments: []),
-          ),
-        ),
-      );
-      await tester.pumpAndSettle();
-
-      await tester.tap(
-        find.byWidgetPredicate(
-          (w) => w is Tooltip && w.message == 'Archive',
-        ),
-      );
-      await tester.pumpAndSettle();
-
-      expect(find.text('No archive folder found'), findsOneWidget);
-    });
-
-    testWidgets('Mark as unread is in popup menu, not a standalone button',
-        (tester) async {
-      await tester.pumpWidget(
-        buildApp(
-          initialLocation: '/accounts/acc-1/mailboxes/INBOX/emails/acc-1%3A42',
-          overrides: _overrides(
-            body: const EmailBody(emailId: 'acc-1:42', attachments: []),
-          ),
-        ),
-      );
-      await tester.pumpAndSettle();
-
-      // No standalone icon button for mark as unread.
-      expect(
-        find.byWidgetPredicate(
-          (w) => w is Tooltip && w.message == 'Mark as unread',
-        ),
-        findsNothing,
-      );
-
-      // It appears in the popup menu.
-      await tester.tap(find.byType(PopupMenuButton<String>));
-      await tester.pumpAndSettle();
-
-      expect(find.text('Mark as unread'), findsOneWidget);
-    });
-
    testWidgets('Show Raw Email dialog shows size of email', (tester) async {
      // 'A' * 2048 → fmtSize(2048) == '2.0 KB'
      final rawContent = 'A' * 2048;
@@ -475,44 +271,6 @@ void main() {
      expect(find.text('Share'), findsOneWidget);
    });

-    testWidgets(
-      'long-press on unsubscribe chip shows URL tooltip',
-      (tester) async {
-        final email = testEmail(
-          listUnsubscribeHeader: '<https://example.com/unsubscribe>',
-        );
-        await tester.pumpWidget(
-          buildApp(
-            initialLocation:
-                '/accounts/acc-1/mailboxes/INBOX/emails/acc-1%3A42',
-            overrides: _overrides(
-              body: const EmailBody(emailId: 'acc-1:42', attachments: []),
-              email: email,
-            ),
-          ),
-        );
-        await tester.pumpAndSettle();
-
-        expect(find.text('Unsubscribe'), findsOneWidget);
-
-        expect(
-          find.byWidgetPredicate(
-            (w) =>
-                w is Tooltip && w.message == 'https://example.com/unsubscribe',
-          ),
-          findsOneWidget,
-        );
-
-        await tester.longPress(find.text('Unsubscribe'));
-        await tester.pumpAndSettle();
-
-        expect(
-          find.text('https://example.com/unsubscribe'),
-          findsOneWidget,
-        );
-      },
-    );
-
    testWidgets('Show Mail Structure opens dialog with MIME parts', (
      tester,
    ) async {
@@ -1,5 +1,5 @@
 import 'package:flutter/material.dart';
-import 'package:flutter_riverpod/misc.dart' show Override;
+import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:flutter_test/flutter_test.dart';

 import 'package:sharedinbox/core/models/email.dart';
@@ -2,7 +2,6 @@ import 'package:flutter/material.dart';
 import 'package:flutter_test/flutter_test.dart';

 import 'package:sharedinbox/core/models/email.dart';
-import 'package:sharedinbox/core/models/mailbox.dart';
 import 'package:sharedinbox/di.dart';
 import 'package:sharedinbox/ui/screens/email_detail_screen.dart';
 import 'package:sharedinbox/ui/screens/email_list_screen.dart';
@@ -316,7 +315,7 @@ void main() {
      await tester.pumpAndSettle();

      expect(find.text('INBOX'), findsOneWidget);
-      expect(find.byIcon(Icons.close), findsNothing);
+      expect(find.byType(BottomAppBar), findsNothing);
    });

    testWidgets('tapping clear icon in search bar clears results', (
@@ -632,150 +631,5 @@ void main() {

      expect(find.text('This is the preview text'), findsOneWidget);
    });
-
-    group('archive with missing folder', () {
-      testWidgets('shows dialog when archive folder is not found', (
-        tester,
-      ) async {
-        final email = testEmail(subject: 'To archive');
-        await tester.pumpWidget(
-          buildApp(
-            initialLocation: '/accounts/acc-1/mailboxes/INBOX/emails',
-            overrides: [
-              accountRepositoryProvider.overrideWithValue(
-                FakeAccountRepository([kTestAccount]),
-              ),
-              // No archive folder in the repo.
-              mailboxRepositoryProvider.overrideWithValue(
-                FakeMailboxRepository(),
-              ),
-              emailRepositoryProvider.overrideWithValue(
-                FakeEmailRepository(emails: [email]),
-              ),
-            ],
-          ),
-        );
-        await tester.pumpAndSettle();
-
-        // Enter selection mode and tap archive.
-        await tester.longPress(find.text('To archive'));
-        await tester.pumpAndSettle();
-        await tester.tap(find.byIcon(Icons.archive));
-        await tester.pumpAndSettle();
-
-        expect(find.text('No archive folder found'), findsOneWidget);
-        expect(find.text('Choose existing folder'), findsOneWidget);
-        expect(find.text('Create "Archive"'), findsOneWidget);
-      });
-
-      testWidgets('tapping Create creates the folder and moves emails', (
-        tester,
-      ) async {
-        final email = testEmail(subject: 'To archive');
-        final movedTo = <String>[];
-
-        final fakeEmailRepo = _SpyEmailRepository(
-          emails: [email],
-          onMove: (id, path) => movedTo.add(path),
-        );
-
-        await tester.pumpWidget(
-          buildApp(
-            initialLocation: '/accounts/acc-1/mailboxes/INBOX/emails',
-            overrides: [
-              accountRepositoryProvider.overrideWithValue(
-                FakeAccountRepository([kTestAccount]),
-              ),
-              mailboxRepositoryProvider.overrideWithValue(
-                FakeMailboxRepository(),
-              ),
-              emailRepositoryProvider.overrideWithValue(fakeEmailRepo),
-            ],
-          ),
-        );
-        await tester.pumpAndSettle();
-
-        await tester.longPress(find.text('To archive'));
-        await tester.pumpAndSettle();
-        await tester.tap(find.byIcon(Icons.archive));
-        await tester.pumpAndSettle();
-
-        // Tap "Create Archive".
-        await tester.tap(find.text('Create "Archive"'));
-        await tester.pumpAndSettle();
-
-        expect(movedTo, contains('Archive'));
-      });
-
-      testWidgets(
-        'tapping Choose existing opens folder picker and moves emails',
-        (tester) async {
-          final email = testEmail(subject: 'To archive');
-          final movedTo = <String>[];
-
-          final fakeEmailRepo = _SpyEmailRepository(
-            emails: [email],
-            onMove: (id, path) => movedTo.add(path),
-          );
-          const archiveFolder = Mailbox(
-            id: 'acc-1:OldArchive',
-            accountId: 'acc-1',
-            path: 'OldArchive',
-            name: 'OldArchive',
-            unreadCount: 0,
-            totalCount: 0,
-          );
-
-          await tester.pumpWidget(
-            buildApp(
-              initialLocation: '/accounts/acc-1/mailboxes/INBOX/emails',
-              overrides: [
-                accountRepositoryProvider.overrideWithValue(
-                  FakeAccountRepository([kTestAccount]),
-                ),
-                // Repo has a folder but it has no 'archive' role.
-                mailboxRepositoryProvider.overrideWithValue(
-                  FakeMailboxRepository([archiveFolder]),
-                ),
-                emailRepositoryProvider.overrideWithValue(fakeEmailRepo),
-              ],
-            ),
-          );
-          await tester.pumpAndSettle();
-
-          await tester.longPress(find.text('To archive'));
-          await tester.pumpAndSettle();
-          await tester.tap(find.byIcon(Icons.archive));
-          await tester.pumpAndSettle();
-
-          // Tap "Choose existing folder".
-          await tester.tap(find.text('Choose existing folder'));
-          await tester.pumpAndSettle();
-
-          // Bottom sheet with folder list appears.
-          expect(find.text('OldArchive'), findsOneWidget);
-
-          await tester.tap(find.text('OldArchive'));
-          await tester.pumpAndSettle();
-
-          expect(movedTo, contains('OldArchive'));
-        },
-      );
-    });
  });
 }
-
-/// Email repository spy that records [moveEmail] calls.
-class _SpyEmailRepository extends FakeEmailRepository {
-  _SpyEmailRepository({
-    super.emails,
-    required void Function(String emailId, String path) onMove,
-  }) : _onMove = onMove;
-
-  final void Function(String emailId, String path) _onMove;
-
-  @override
-  Future<void> moveEmail(String emailId, String destMailboxPath) async {
-    _onMove(emailId, destMailboxPath);
-  }
-}
--- a/Show More
+++ b/Show More