# InboxIntel — TODO / follow-ups

Outstanding items after the 2026-07-04 work session (UI refactor, category fixes, login fix,
Pi deployment, mockups). Nothing here is blocking; these are the known loose ends.

## Sync — Sent / Drafts folders
The PHASE 2 category fix (PR #38) is correct — after a re-sync, **Spam and Trash now populate**
(Trash 1363, Spam 112 on staging). But:

- [ ] **Uncapped re-sync to confirm Sent.** Sent is still empty on staging only because of the
      2000-message dev cap (`GmailSync:MaxMessages=2000`) + Gmail's newest-first ordering — the
      newest 2000 are dominated by trash/promotions, so Sent/Draft/most Inbox mail falls outside
      the window. An uncapped sync (`MAX_MESSAGES=0`, real deployment) should include Sent.
      To re-run: `DELETE FROM sync_states` for the user, then reload the dashboard (auto-fires a
      full sync). Note: the capped re-sync also left staging's Inbox sparse (~5) — staging-only.

- [ ] **Drafts fix.** User added a drafts scope in Google Cloud console. Code side: `gmail.readonly`
      already grants draft *read*, but `messages.list` doesn't return drafts — add a `users.drafts.list`
      fetch in `GmailService`/`SyncService` and link the DRAFT label. (Add the new scope to
      `GoogleOAuth:Scopes` in appsettings if compose/modify is needed for drafts too.)

- [ ] Optional: with `IncludeSpamTrash=true`, a *capped* sync gets flooded by trash. If caps are
      kept, consider prioritising non-trash or making the cap per-folder.

## Pi deployment — real login
InboxIntel is live on the homelab at http://192.168.50.13:8090 (auto-deploys from `develop`).

- [x] Live message cap removed — `MAX_MESSAGES=0` in the Pi `deploy/.env` (takes effect on next sync).
- [ ] **Google login on the Pi.** Subdomain: **inboxintel.cesnimda.uk** (user wiring traefik+TLS manually).
      Redirect URI (in the new live Google OAuth client): `https://inboxintel.cesnimda.uk/signin-google`.
      Once traefik is up: set `FRONTEND_ORIGIN=https://inboxintel.cesnimda.uk` in the Pi `deploy/.env`,
      set `AllowedHosts`, and put the **new live** `GOOGLE_CLIENT_ID`/`GOOGLE_CLIENT_SECRET` in the Pi
      `deploy/.env` (see below), then redeploy.
- [ ] **Where the live OAuth ID/secret go: the Pi `/opt/inboxintel/deploy/.env`** (git-ignored) — NOT
      Gitea secrets. The Pi auto-deploys via a cron `git pull` + `docker compose`, which reads
      `deploy/.env` directly; there's no Gitea Actions runner on the Pi, so Gitea secrets wouldn't be
      injected. (Gitea secrets only matter for the staging CD runner.)

## Release / housekeeping
- [ ] Decide on promoting `develop` → `main` and cutting a release tag (e.g. v0.1.0). `main` is
      stale; all current work lives on `develop`. Stale PR #6 (develop→main) can be closed/redone.
- [ ] Deferred by user: "Clean up my inbox" natural-language chat feature (do last).
- [ ] Accessibility pass before launch (green accent must not be colour-only) — noted as nice-to-have.

## Done this session (for reference)
- Login 500 fixed (root-owned DataProtection keys volume) — PR #37
- All 7 smart-category bugs fixed at source — PR #38
- Email dashboard UX: split-view, custom checkbox, row polish, bulk/keyboard, dashboard
  heatmap→category-bar, skeletons/empty states — PR #44
- Dead backend heatmap removed — PR #45
- .NET 10 migration, Renovate, DB backups, OpenTelemetry, hybrid semantic search, keyset
  pagination, feature-flags foundation, Semgrep SAST (earlier PRs)
- Resume mockups → F:\Pictures\website\inboxintel
- Live Docker deployment + cron auto-deploy on pi@192.168.50.13