feat(ui): fill the blank message pane with a branded placeholder

An empty right pane said nothing, and multi-select made it a routine
sight. It now carries the wordmark, thread counts that run their query
when clicked, and a sync line that appears only when something needs
attention.

Rendered into the existing web view as a third document shape, so there
is one document path and one set of security rules. The brand palette is
a deliberate exception to deriving colours from the desktop theme, since
a logo is brand rather than chrome; the theme still picks which of the
two sets is used.

Counts refresh when the pane is about to show rather than in the
background: one goes stale the moment a tag is edited, and refreshing one
nobody is looking at is work for nothing. A generation counter discards a
superseded reply, and a late answer cannot repaint over an opened thread.

The helper lines are real links because JavaScript is off in this
profile. The handler is gated on the placeholder actually being
displayed, so the same URL inside a message body is dropped: a stranger's
mail must not drive the thread list, even to run a harmless query.

Three defects found while building, all silent:

- Every CSS percentage was invalid. QString::arg does not collapse "%%"
  into "%", so the document carried "50%%" and the browser dropped each
  declaration holding one, disabling the mask, the glow and both radial
  gradients while still rendering something plausible. Substitution is by
  named token now, which cannot collide with a percent sign.
- A geometry probe endorsed the layout while that was live, because it
  measured only properties without percentages.
- The font test passed against a build with one face missing, since the
  other satisfied both of its checks on its own.

The mockup's light values needed correcting against a real pane: the grid
vanished at a 2% luminance step on white, and the glow subtracts light
there rather than adding it, washing the pane. Strength only, not hue.

9 files changed, 596 insertions, 3 deletions

diff --git a/src/htmlbuilder.cpp b/src/htmlbuilder.cpp
index c8f039f..30fab9f 100644
--- a/src/htmlbuilder.cpp
+++ b/src/htmlbuilder.cpp
@@ -19,8 +19,10 @@
 #include "htmlbuilder.h"
 
 #include <QCoreApplication>
+#include <QFile>
 #include <QGuiApplication>
 #include <QRegularExpression>
+#include <QUrl>
 
 namespace {
 
@@ -84,6 +86,259 @@ HtmlBuilder::Palette HtmlBuilder::paletteFrom(const QPalette &palette)
     return result;
 }
 
+HtmlBuilder::BrandPalette HtmlBuilder::brandPaletteFrom(const QPalette &palette)
+{
+    // Base, the same surface paletteFrom() reads, so the placeholder and a
+    // rendered message never disagree about which way round the theme is.
+    const bool dark = palette.color(QPalette::Base).lightnessF() < 0.5;
+
+    BrandPalette brand;
+    if (dark) {
+        brand.background   = QColor(0x06, 0x0b, 0x10);
+        brand.backgroundIn = QColor(0x0c, 0x15, 0x20);
+        brand.grid         = QColor(0x18, 0x28, 0x40);
+        brand.tile         = QColor(0x10, 0x1e, 0x2d);
+        brand.tileBorder   = QColor(0x18, 0x28, 0x40);
+        brand.accent       = QColor(0xa8, 0x55, 0xf7);
+        brand.accentEdge   = QColor(0x7c, 0x3a, 0xed);
+        brand.title        = QColor(0xc4, 0xd6, 0xe8);
+        brand.subtitle     = QColor(0x7a, 0x9b, 0xb8);
+        brand.glowAlpha    = 16;
+    } else {
+        // **Not the mockup's light values as written.** Rendered side by side
+        // with the dark set, three of them did not survive contact with a real
+        // pane, because the same nominal contrast behaves differently against
+        // white than against near-black:
+        //
+        // - The grid at #d9dfe8 on white is about a 2% luminance step and
+        //   vanished entirely, where #182840 on #060b10 reads clearly. Darkened
+        //   here, and the opacity is raised for this set alone below.
+        // - The glow SUBTRACTS light on white instead of adding it, so 14%
+        //   washed most of the pane purple rather than hinting at a glow. The
+        //   dark set keeps 16 for the opposite reason.
+        // - The tile at #f0f3f7 inside a #d9dfe8 border did not separate from
+        //   the background, leaving the icon floating.
+        //
+        // The hues are the mockup's throughout; only their strength changed.
+        brand.background   = QColor(0xff, 0xff, 0xff);
+        brand.backgroundIn = QColor(0xf4, 0xf6, 0xfa);
+        brand.grid         = QColor(0xb9, 0xc4, 0xd4);
+        brand.tile         = QColor(0xf0, 0xf3, 0xf7);
+        brand.tileBorder   = QColor(0xc7, 0xd0, 0xdd);
+        brand.accent       = QColor(0x93, 0x33, 0xea);
+        brand.accentEdge   = QColor(0x7c, 0x3a, 0xed);
+        brand.title        = QColor(0x1f, 0x29, 0x37);
+        brand.subtitle     = QColor(0x37, 0x41, 0x51);
+        brand.glowAlpha    = 6;
+        brand.gridOpacity  = 45;
+    }
+    return brand;
+}
+
+namespace {
+
+/// A bundled font as a data: URI.
+///
+/// The mockup reaches Google Fonts with an @import, which the interceptor
+/// blocks by design and which would be a network request from a mail client
+/// besides. The faces ship in the binary and are inlined here, so the document
+/// fetches nothing at all.
+QString fontDataUri(const char *resource)
+{
+    QFile file(QString::fromLatin1(resource));
+    if (!file.open(QIODevice::ReadOnly)) {
+        // Falls back to the generic family in the font stack rather than
+        // failing to render. A missing resource is a build fault, not
+        // something the user can act on mid-session.
+        return QString();
+    }
+    return QStringLiteral("data:font/woff2;base64,")
+        + QString::fromLatin1(file.readAll().toBase64());
+}
+
+/// rgba() from a colour and a percentage, for the translucent washes.
+QString rgba(const QColor &c, int percent)
+{
+    return QStringLiteral("rgba(%1,%2,%3,%4)")
+        .arg(c.red()).arg(c.green()).arg(c.blue())
+        .arg(percent / 100.0);
+}
+
+/// The placeholder's stylesheet.
+///
+/// Sizes are clamped rather than fixed or purely fluid: this is a splitter
+/// panel whose width varies from a couple of hundred pixels to most of a
+/// screen. A fixed wordmark is lost in a wide pane and overflows a narrow one;
+/// a purely fluid one is unreadable at one end and absurd at the other. The
+/// vw term scales it, the clamp bounds stop it going either way.
+///
+/// Substituted by NAME, not by QString::arg positions. The stylesheet is full
+/// of CSS percentages, and **arg() does NOT collapse "%%" into "%"**: every
+/// percentage written that way stayed literally "50%%", which is invalid, so
+/// the browser dropped each declaration containing one. That silently killed
+/// the mask, the glow and both radial gradients while the pane still rendered
+/// and still looked plausible, and a probe measuring only the properties
+/// without percentages reported everything correct. Named tokens cannot
+/// collide with a percent sign at all.
+const char *kPlaceholderStyleTemplate = R"CSS(
+@font-face { font-family: 'Oxanium qtmaildir'; font-weight: 800;
+             font-style: normal; font-display: block;
+             src: url('@FONT_OXANIUM@') format('woff2'); }
+@font-face { font-family: 'Plex qtmaildir'; font-weight: 400;
+             font-style: normal; font-display: block;
+             src: url('@FONT_PLEX@') format('woff2'); }
+* { margin: 0; padding: 0; box-sizing: border-box; }
+html, body { width: 100%; height: 100%; overflow: hidden;
+             background: @BG@; }
+.bg { position: absolute; inset: 0;
+      background: radial-gradient(circle at 30% 20%, @BG_IN@ 0%, @BG@ 55%, @BG@ 100%);
+      display: flex; align-items: center; justify-content: center; }
+/* The grid and the glow are sized RELATIVE TO THE PANE, which is the one place
+   this departs from the mockup's numbers rather than porting them.
+
+   The mockup draws into a fixed 1920x1080 box and scales the whole box to fit.
+   Its mask is `circle at 50% 45%` fading out by 70%, which in a box that shape
+   means the fade completes well inside the frame and the grid dissolves into
+   darkness around the lockup. Taking those same values into a box the size of
+   this pane keeps the RATIO but loses the effect: `circle` with no explicit
+   extent resolves to farthest-corner, so in a pane roughly 990x650 the fade
+   only completes past the corners and the grid reads as uniform to the edges,
+   which is what it looked like. The same applies to the 900px glow, which is
+   larger than a short pane is tall, so its falloff never appears.
+
+   `closest-side` pins the fade to the nearer edge instead, so the vignette
+   completes inside the pane at any splitter position, and the glow is a
+   percentage of the pane rather than a pixel count. */
+.grid { position: absolute; inset: 0;
+        background-image: linear-gradient(@GRID@ 1px, transparent 1px),
+                          linear-gradient(90deg, @GRID@ 1px, transparent 1px);
+        background-size: 64px 64px; opacity: @GRID_OPACITY@;
+        mask-image: radial-gradient(closest-side circle at 50% 45%,
+                    rgba(0,0,0,0.9) 0%, transparent 75%);
+        -webkit-mask-image: radial-gradient(closest-side circle at 50% 45%,
+                    rgba(0,0,0,0.9) 0%, transparent 75%); }
+.glow { position: absolute;
+        width: min(95%, 900px); aspect-ratio: 1;
+        background: radial-gradient(circle, @GLOW@ 0%, transparent 70%);
+        top: 50%; left: 50%; transform: translate(-50%, -55%); }
+/* Natural height, centred. The user rejected a fixed vertical split: this
+   pane's height varies enormously and a ratio breaks at one extreme. */
+.content { position: relative; z-index: 2; width: 100%;
+           padding: 0 clamp(12px, 4vw, 48px);
+           display: flex; flex-direction: column; align-items: center;
+           gap: clamp(10px, 2.2vw, 22px); }
+/* Header ROW, per the decision of 2026-08-07: icon left, wordmark right,
+   with the glow and grid still centred behind. */
+.lockup { display: flex; align-items: center;
+          gap: clamp(10px, 2.4vw, 26px); }
+.icon-tile { flex: none;
+             width: clamp(48px, 11vw, 104px); height: clamp(48px, 11vw, 104px);
+             border-radius: clamp(12px, 2.6vw, 26px);
+             background: @TILE@; border: 1px solid @TILE_BORDER@;
+             display: flex; align-items: center; justify-content: center;
+             box-shadow: 0 0 60px @TILE_SHADOW@; }
+.icon-tile svg { width: 68%; height: 68%; }
+.wordmark { display: flex; flex-direction: column; gap: 0.25em; }
+.title { font-family: 'Oxanium qtmaildir', sans-serif; font-weight: 800;
+         font-size: clamp(26px, 6.4vw, 60px); letter-spacing: 0.01em;
+         color: @TITLE@; line-height: 1; white-space: nowrap; }
+.title .accent { color: @ACCENT@; }
+.subtitle { font-family: 'Plex qtmaildir', sans-serif; font-weight: 400;
+            font-size: clamp(9px, 1.7vw, 15px); letter-spacing: 0.04em;
+            color: @SUBTITLE@; text-transform: uppercase; }
+.helpers { display: flex; flex-wrap: wrap; justify-content: center;
+           gap: clamp(8px, 1.8vw, 18px);
+           font-family: 'Plex qtmaildir', sans-serif;
+           font-size: clamp(10px, 1.8vw, 15px); }
+.helpers a, .helpers span { color: @SUBTITLE@; text-decoration: none;
+                            border-bottom: 1px solid transparent;
+                            padding-bottom: 1px; }
+.helpers a:hover { color: @ACCENT@; border-bottom-color: @ACCENT@; }
+.footer { font-family: 'Plex qtmaildir', sans-serif;
+          font-size: clamp(8px, 1.4vw, 12px); color: @SUBTITLE@; opacity: 0.75;
+          text-align: center; line-height: 1.6; }
+.footer a { color: @SUBTITLE@; text-decoration: none;
+            border-bottom: 1px solid @GRID@; }
+.footer a:hover { color: @ACCENT@; }
+)CSS";
+
+} // namespace
+
+QString HtmlBuilder::buildPlaceholder(const QList<PlaceholderHelper> &helpers,
+                                      const QString &version,
+                                      const BrandPalette &brand)
+{
+    QString style = QString::fromUtf8(kPlaceholderStyleTemplate);
+    const QList<QPair<QString, QString>> tokens = {
+        { QStringLiteral("@BG@"),           brand.background.name() },
+        { QStringLiteral("@BG_IN@"),        brand.backgroundIn.name() },
+        { QStringLiteral("@GRID@"),         brand.grid.name() },
+        { QStringLiteral("@TILE_BORDER@"),  brand.tileBorder.name() },
+        { QStringLiteral("@GRID_OPACITY@"),
+          QString::number(brand.gridOpacity / 100.0) },
+        { QStringLiteral("@TILE@"),         brand.tile.name() },
+        { QStringLiteral("@ACCENT@"),       brand.accent.name() },
+        { QStringLiteral("@TITLE@"),        brand.title.name() },
+        { QStringLiteral("@SUBTITLE@"),     brand.subtitle.name() },
+        { QStringLiteral("@GLOW@"),         rgba(brand.accent, brand.glowAlpha) },
+        { QStringLiteral("@TILE_SHADOW@"),  rgba(brand.accent, brand.glowAlpha - 4) },
+        { QStringLiteral("@FONT_OXANIUM@"), fontDataUri(":/fonts/Oxanium-ExtraBold.woff2") },
+        { QStringLiteral("@FONT_PLEX@"),    fontDataUri(":/fonts/IBMPlexSans-Regular.woff2") },
+    };
+    for (const auto &token : tokens)
+        style.replace(token.first, token.second);
+
+    QString helperHtml;
+    for (const PlaceholderHelper &helper : helpers) {
+        const QString label = helper.label.toHtmlEscaped();
+        if (helper.query.isEmpty()) {
+            // A state, not a search. Rendering it as a link would invite a
+            // click that runs an empty query and empties the thread list.
+            helperHtml += QStringLiteral("<span>%1</span>").arg(label);
+            continue;
+        }
+
+        // Percent-encoded into the URL, then escaped into the attribute. A
+        // saved query is user-written and reaches here verbatim, so both
+        // layers are needed: one keeps it a single URL, the other keeps it
+        // inside the attribute.
+        const QString href = QString::fromLatin1(
+            QUrl::toPercentEncoding(helper.query)).toHtmlEscaped();
+        helperHtml += QStringLiteral(
+            "<a href=\"qtmaildir-query:%1\">%2</a>").arg(href, label);
+    }
+
+    return QStringLiteral(
+        "<!DOCTYPE html><html><head><meta charset=\"utf-8\">"
+        "<style>%1</style></head><body><div class=\"bg\">"
+        "<div class=\"grid\"></div><div class=\"glow\"></div>"
+        "<div class=\"content\">"
+        "<div class=\"lockup\">"
+        "<div class=\"icon-tile\">"
+        "<svg viewBox=\"0 0 256 256\" xmlns=\"http://www.w3.org/2000/svg\">"
+        "<path d=\"M100,70 L176,70 A14,14 0 0 1 190,84 L190,172 "
+        "A14,14 0 0 1 176,186 L100,186 L40,128 Z\" fill=\"%2\" stroke=\"%3\" "
+        "stroke-width=\"6\" stroke-linejoin=\"round\"/>"
+        "<circle cx=\"100\" cy=\"128\" r=\"15\" fill=\"%4\"/>"
+        "</svg></div>"
+        "<div class=\"wordmark\">"
+        "<div class=\"title\">qt<span class=\"accent\">Mail</span>Dir</div>"
+        "<div class=\"subtitle\">%5</div>"
+        "</div></div>"
+        "<div class=\"helpers\">%6</div>"
+        "<div class=\"footer\">%7<br>"
+        "<a href=\"https://danix.xyz/qtmaildir\">danix.xyz/qtmaildir</a>"
+        "</div></div></div></body></html>")
+        .arg(style, brand.accent.name(), brand.accentEdge.name(),
+             brand.tile.name(),
+             QCoreApplication::translate(
+                 "HtmlBuilder", "local mail, tagged and searched"),
+             helperHtml,
+             QCoreApplication::translate(
+                 "HtmlBuilder", "Copyright &copy; 2026 Danilo M. &middot; "
+                                "version %1").arg(version.toHtmlEscaped()));
+}
+
 HtmlBuilder::Palette HtmlBuilder::defaultPalette()
 {
     if (const QGuiApplication *app =
diff --git a/src/htmlbuilder.h b/src/htmlbuilder.h
index 75fd1f8..3ade530 100644
--- a/src/htmlbuilder.h
+++ b/src/htmlbuilder.h
@@ -81,6 +81,58 @@ public:
         QColor quote;       ///< Quoted lines in plain text.
     };
 
+    /// The brand colours of the placeholder pane.
+    ///
+    /// **A deliberate exception to the Palette above**, which derives from the
+    /// desktop theme. A logo is brand rather than chrome, so these are the
+    /// values from the user's mockup and are not blended toward anything. The
+    /// desktop theme still decides WHICH set is used, so the pane never renders
+    /// a light lockup on a dark desktop.
+    struct BrandPalette {
+        QColor background;   ///< The pane, behind the radial wash.
+        QColor backgroundIn; ///< The lighter centre of that wash.
+        QColor grid;         ///< Grid rules, and the icon tile's border.
+        QColor tile;         ///< The icon tile's fill.
+        QColor tileBorder;   ///< The icon tile's edge. Separate from `grid`,
+                             ///< which needs a different strength on light.
+        QColor accent;       ///< "Mail" in the wordmark, and the envelope.
+        QColor accentEdge;   ///< The envelope's stroke.
+        QColor title;        ///< The wordmark, apart from the accent span.
+        QColor subtitle;     ///< The tagline, the helpers and the footer.
+
+        /// Percent alpha of the accent glow. Deliberately different between the
+        /// two sets: on dark the glow adds light and can be generous, on light
+        /// it subtracts and the same value washes the whole pane.
+        int glowAlpha = 0;
+
+        /// Percent opacity of the grid, for the same reason.
+        int gridOpacity = 35;
+    };
+
+    /// Picks the dark or the light brand set from the desktop palette.
+    ///
+    /// Decided on the window's Base lightness, the same surface the document
+    /// Palette reads, so the two agree about which way round the theme is.
+    static BrandPalette brandPaletteFrom(const QPalette &palette);
+
+    /// One helper line under the wordmark: a count, and the query it runs.
+    ///
+    /// An empty query renders as text rather than as a link, which is what the
+    /// sync line uses: it reports a state rather than naming a search.
+    struct PlaceholderHelper {
+        QString label;  ///< Already-translated, e.g. "12 unread".
+        QString query;  ///< notmuch query, or empty for a non-link line.
+    };
+
+    /// The pane shown when no thread is displayed.
+    ///
+    /// Rendered into the same web view as a message rather than into a second
+    /// widget stacked behind it, so there is one document path and one set of
+    /// security rules.
+    static QString buildPlaceholder(const QList<PlaceholderHelper> &helpers,
+                                    const QString &version,
+                                    const BrandPalette &brand);
+
     /// Derives the document palette from a widget palette.
     ///
     /// The dim and border colours are blends rather than fixed greys, which is
diff --git a/src/mainwindow.cpp b/src/mainwindow.cpp
index 77322bc..5af6624 100644
--- a/src/mainwindow.cpp
+++ b/src/mainwindow.cpp
@@ -577,6 +577,8 @@ void MainWindow::buildUi()
     m_messageView->setTagColors(&m_tagColors);
     connect(m_messageView, &MessageView::statusMessage,
             this, [this](const QString &text) { m_statusLabel->setText(text); });
+    connect(m_messageView, &MessageView::queryRequested,
+            this, &MainWindow::onPlaceholderQueryRequested);
 
     m_splitter = new QSplitter(Qt::Horizontal, central);
     m_splitter->addWidget(m_threadView);
@@ -781,6 +783,7 @@ void MainWindow::registerActions()
         // CLAUDE.md.
         m_currentThreadId.clear();
         m_messageView->clear();
+        showPlaceholderPane();
         m_markReadTimer->stop();
         m_markReadThreadId.clear();
     });
@@ -1060,6 +1063,8 @@ void MainWindow::wireWorker()
             this, &MainWindow::onWorkerError);
     connect(m_worker, &NotmuchWorker::allTagsReady,
             this, &MainWindow::onAllTagsReady);
+    connect(m_worker, &NotmuchWorker::countsReady,
+            this, &MainWindow::onCountsReady);
 
     // A confirmed write clears the pending revert: without this, a later
     // unrelated error would roll back a change that actually succeeded.
@@ -1092,6 +1097,92 @@ void MainWindow::onAllTagsReady(const QStringList &tags)
     m_queryCompleter->setTags(tags);
 }
 
+namespace {
+
+/// The queries behind the placeholder's helper lines, in render order.
+///
+/// Wire format, deliberately untranslated: `tag:` is notmuch syntax, not user
+/// -facing prose. Only the labels beside them are translated.
+const std::array<const char *, 3> kPlaceholderQueries = {
+    "tag:unread",
+    "tag:flagged",
+    "tag:inbox",
+};
+
+} // namespace
+
+QList<HtmlBuilder::PlaceholderHelper> MainWindow::placeholderHelpers() const
+{
+    QList<HtmlBuilder::PlaceholderHelper> helpers;
+
+    // Empty until the first reply lands. Rendering three zeroes meanwhile
+    // would be worse than rendering nothing: a zero is a claim.
+    if (m_placeholderCounts.size() == int(kPlaceholderQueries.size())) {
+        const QStringList labels = {
+            tr("%n unread", "", m_placeholderCounts.at(0)),
+            tr("%n flagged", "", m_placeholderCounts.at(1)),
+            tr("%n in inbox", "", m_placeholderCounts.at(2)),
+        };
+
+        for (int i = 0; i < labels.size(); ++i) {
+            // A query notmuch could not count yields -1; skip that line rather
+            // than print a negative number at the user.
+            if (m_placeholderCounts.at(i) < 0)
+                continue;
+            helpers.append({ labels.at(i),
+                             QString::fromLatin1(kPlaceholderQueries[i]) });
+        }
+    }
+
+    // The sync line, and only when something needs attention: a line that is
+    // always there becomes wallpaper and stops being read.
+    if (m_lastSyncFailed) {
+        helpers.append({ tr("last sync failed"), QString() });
+    } else if (const int pending = pendingEditCount(); pending > 0) {
+        helpers.append({ tr("%n change(s) waiting to sync", "", pending),
+                         QString() });
+    }
+
+    return helpers;
+}
+
+void MainWindow::showPlaceholderPane()
+{
+    m_messageView->showPlaceholder(placeholderHelpers());
+
+    QStringList queries;
+    for (const char *query : kPlaceholderQueries)
+        queries.append(QString::fromLatin1(query));
+
+    QMetaObject::invokeMethod(m_worker, "requestCounts", Qt::QueuedConnection,
+                              Q_ARG(QStringList, queries),
+                              Q_ARG(quint64, ++m_countsGeneration));
+}
+
+void MainWindow::onCountsReady(const QVector<int> &counts, quint64 generation)
+{
+    // A reply for a superseded request carries counts taken before whatever
+    // prompted the newer one, so accepting it would repaint the pane with
+    // older numbers than it already has.
+    if (generation != m_countsGeneration)
+        return;
+
+    m_placeholderCounts = counts;
+
+    // Only repaint what is actually on screen. Without this, a reply arriving
+    // after the user opened a thread would replace the message with the logo.
+    if (m_messageView->showingPlaceholder())
+        m_messageView->showPlaceholder(placeholderHelpers());
+}
+
+void MainWindow::onPlaceholderQueryRequested(const QString &query)
+{
+    // Through the query bar rather than straight to the worker, so the bar
+    // shows what is being displayed and the user can edit it from there.
+    m_queryEdit->setText(query);
+    runCurrentQuery();
+}
+
 void MainWindow::showWarnings()
 {
     const QStringList warnings = m_config.warnings() + m_keyMap.warnings();
@@ -1132,6 +1223,7 @@ void MainWindow::runCurrentQuery()
     ++m_generation;
     m_model->clear();
     m_messageView->clear();
+    showPlaceholderPane();
 
     // Undo entries refer to rows that are about to be discarded. The model
     // update they invert would be a no-op against the new result set, leaving
@@ -1287,6 +1379,7 @@ void MainWindow::onSelectionChanged()
     m_markReadThreadId.clear();
     m_currentThreadId.clear();
     m_messageView->clear();
+    showPlaceholderPane();
 }
 
 void MainWindow::onThreadSelected(const QModelIndex &current,
@@ -1317,6 +1410,7 @@ void MainWindow::onThreadSelected(const QModelIndex &current,
         m_markReadThreadId.clear();
         m_currentThreadId.clear();
         m_messageView->clear();
+        showPlaceholderPane();
         return;
     }
 
@@ -1488,6 +1582,7 @@ void MainWindow::onSyncFinished(bool success, int exitCode)
         // what failed to put them there.
         m_pendingTagEdits.clear();
         m_unnettablePendingEdits = 0;
+        m_lastSyncFailed = false;
         updatePendingIndicator();
 
         showTransientStatus(tr("Sync complete"));
@@ -1544,6 +1639,12 @@ void MainWindow::onSyncFinished(bool success, int exitCode)
                    "has been left open."));
         }
     } else {
+        // Latched until a sync succeeds, so the placeholder's sync line still
+        // says so on the next blank pane rather than only in a status message
+        // the user may not have been looking at. A skipped run does not set
+        // this: it is a branch of its own above, and a skip means another
+        // process is doing the work rather than that the work failed.
+        m_lastSyncFailed = true;
         m_statusLabel->setText(tr("Sync failed (exit %1)").arg(exitCode));
         m_syncLogPane->show();
 
diff --git a/src/mainwindow.h b/src/mainwindow.h
index adb973c..8043727 100644
--- a/src/mainwindow.h
+++ b/src/mainwindow.h
@@ -27,6 +27,7 @@
 #include <functional>
 
 #include "config.h"
+#include "htmlbuilder.h"
 #include "keymap.h"
 // Included rather than forward-declared: SyncPhaseTracker is held by value, so
 // its size must be known here. MailSync itself stays a forward declaration.
@@ -184,6 +185,13 @@ private slots:
     void onTagsApplied(const TagChange &change);
     void onAllTagsReady(const QStringList &tags);
 
+    /// Thread counts for the placeholder's helper lines, in the order
+    /// requestPlaceholderCounts() asked for them.
+    void onCountsReady(const QVector<int> &counts, quint64 generation);
+
+    /// Runs a query the user clicked on the placeholder pane.
+    void onPlaceholderQueryRequested(const QString &query);
+
 private:
     void buildUi();
 
@@ -199,6 +207,20 @@ private:
     /// Asks the worker to re-enumerate the database tags for the completer.
     void requestAllTags();
 
+    /// Shows the placeholder pane and asks the worker to refresh its counts.
+    ///
+    /// **The single route to a blank pane.** Every site that used to call
+    /// MessageView::clear() goes through here, so the pane is never left empty
+    /// by accident and the counts are refreshed exactly when they are about to
+    /// be looked at. A count goes stale the moment a tag is edited, and one
+    /// nobody is looking at is not worth keeping fresh.
+    void showPlaceholderPane();
+
+    /// The helper lines, built from the last counts received. Rendered with
+    /// whatever the previous answer was until the new one lands, so the pane
+    /// never flashes empty while the worker replies.
+    QList<HtmlBuilder::PlaceholderHelper> placeholderHelpers() const;
+
     void showWarnings();
     void showShortcutReference();
     void showAbout();
@@ -385,6 +407,21 @@ private:
     /// Indeterminate, shown only while a sync runs. See setSyncBusy().
     QProgressBar *m_syncProgress = nullptr;
 
+    /// The last counts the worker answered, one per kPlaceholderQueries entry.
+    /// Empty until the first reply, which renders the pane without its helper
+    /// lines rather than with three zeroes that would be a lie.
+    QVector<int> m_placeholderCounts;
+
+    /// Discriminates a counts reply from a superseded request, the same way the
+    /// query generation does. A reply for an older request is dropped rather
+    /// than repainting the pane with counts taken before the last edit.
+    quint64 m_countsGeneration = 0;
+
+    /// Set when a sync ends in failure, cleared when one succeeds. Drives the
+    /// placeholder's sync line, which appears only when something needs
+    /// attention, so it must survive until the next successful run.
+    bool m_lastSyncFailed = false;
+
     /// Holds the sync log and its close button, so the pane can be dismissed.
     QWidget *m_syncLogPane = nullptr;
     QPlainTextEdit *m_syncLog = nullptr;
diff --git a/src/messageview.cpp b/src/messageview.cpp
index 10b21a9..b804d37 100644
--- a/src/messageview.cpp
+++ b/src/messageview.cpp
@@ -43,12 +43,15 @@
 #include <QWebEngineView>
 
 #include <algorithm>
+#include <functional>
+#include <utility>
 
 #include "cidschemehandler.h"
 #include "htmlbuilder.h"
 #include "requestinterceptor.h"
 #include "tagstrip.h"
 #include "threadcidmap.h"
+#include "version.h"
 
 namespace {
 
@@ -56,8 +59,11 @@ namespace {
 class MessagePage : public QWebEnginePage
 {
 public:
-    MessagePage(QWebEngineProfile *profile, QObject *parent)
-        : QWebEnginePage(profile, parent) {}
+    using QueryHandler = std::function<bool(const QString &)>;
+
+    MessagePage(QWebEngineProfile *profile, QObject *parent,
+                QueryHandler onQuery)
+        : QWebEnginePage(profile, parent), m_onQuery(std::move(onQuery)) {}
 
 protected:
     bool acceptNavigationRequest(const QUrl &url, NavigationType type,
@@ -78,6 +84,24 @@ protected:
             return true;
 
         if (type == NavigationTypeLinkClicked) {
+            // The placeholder's helper lines. JavaScript is off in this
+            // profile, so a clickable count can only be a real link, and this
+            // is where it is turned back into an action.
+            //
+            // The handler decides whether to accept it, not this function: the
+            // view refuses unless the placeholder is what is actually
+            // displayed, so a qtmaildir-query: link inside a message body is
+            // dropped rather than handed a query to run.
+            if (url.scheme() == QLatin1String("qtmaildir-query")) {
+                // path() already percent-decodes; verified against Qt 6.11,
+                // which returns tag:unread for qtmaildir-query:tag%3Aunread.
+                // Decoding it a second time would corrupt a query carrying a
+                // literal '%', which notmuch accepts in a quoted term.
+                if (m_onQuery)
+                    m_onQuery(url.path());
+                return false;
+            }
+
             QDesktopServices::openUrl(url);
             return false;
         }
@@ -86,6 +110,9 @@ protected:
         // navigation would replace the pane, which no message may do.
         return !isMainFrame;
     }
+
+private:
+    QueryHandler m_onQuery;
 };
 
 } // namespace
@@ -105,7 +132,16 @@ MessageView::MessageView(QWidget *parent)
     m_profile->installUrlSchemeHandler(QByteArrayLiteral("cid"), m_cidHandler);
 
     m_view = new QWebEngineView(this);
-    m_view->setPage(new MessagePage(m_profile, m_view));
+    // The gate the queryRequested() documentation describes: a helper link is
+    // only honoured while the placeholder is what is on screen, so the same
+    // URL inside a message body reaches here and is dropped.
+    m_view->setPage(new MessagePage(m_profile, m_view,
+                                    [this](const QString &query) {
+        if (!m_showingPlaceholder)
+            return false;
+        emit queryRequested(query);
+        return true;
+    }));
 
     QWebEngineSettings *settings = m_view->settings();
     settings->setAttribute(QWebEngineSettings::JavascriptEnabled, false);
@@ -196,9 +232,40 @@ void MessageView::setDocument(const QString &html)
     m_view->setHtml(html, documentUrl());
 }
 
+void MessageView::showPlaceholder(
+    const QList<HtmlBuilder::PlaceholderHelper> &helpers)
+{
+    // Everything clear() drops, dropped again: this is reachable directly and
+    // must not leave a previous thread's parts serveable behind the logo.
+    m_items.clear();
+    m_tagStrip->setTags({});
+    m_cidHandler->setParts({});
+    m_interceptor->setAllowedCids({});
+    m_interceptor->resetForNewMessage();
+
+    m_headerLabel->clear();
+    m_detailsButton->hide();
+    m_blockedLabel->hide();
+    m_loadRemoteButton->hide();
+    rebuildAttachmentBar();
+
+    // Set before the document loads, not after: acceptNavigationRequest reads
+    // it, and a click cannot arrive before setDocument() returns, but ordering
+    // it this way makes that independent of how the load is scheduled.
+    m_showingPlaceholder = true;
+
+    // The widget's own palette, not qApp's, for the reason the render path
+    // uses it: a style sheet or a themed parent can give this pane different
+    // colours from the application.
+    setDocument(HtmlBuilder::buildPlaceholder(
+        helpers, QStringLiteral(QTMAILDIR_VERSION),
+        HtmlBuilder::brandPaletteFrom(palette())));
+}
+
 void MessageView::clear()
 {
     m_items.clear();
+    m_showingPlaceholder = false;
     m_tagStrip->setTags({});
 
     // No thread is displayed, so nothing may be served or allowed. Without
@@ -221,6 +288,7 @@ void MessageView::showThread(const QList<ThreadRenderItem> &items)
 {
     m_items = items;
     m_preferHtml = true;
+    m_showingPlaceholder = false;
 
     // Every thread starts from a clean policy: no remote grant carries over.
     m_interceptor->resetForNewMessage();
@@ -258,6 +326,7 @@ void MessageView::showThread(const QList<ThreadRenderItem> &items)
 void MessageView::showError(const QString &text, const QString &filePath)
 {
     m_items.clear();
+    m_showingPlaceholder = false;
 
     // An error card references nothing, so the policy is emptied rather than
     // left holding the previous thread's parts.
diff --git a/src/messageview.h b/src/messageview.h
index c55f5c5..135c85d 100644
--- a/src/messageview.h
+++ b/src/messageview.h
@@ -59,6 +59,22 @@ public:
     void showError(const QString &text, const QString &filePath);
     void clear();
 
+    /// Shows the branded pane used when no thread is displayed.
+    ///
+    /// Separate from clear(), which still exists and still blanks: clear()
+    /// drops the previous thread's state, and a caller that wants the
+    /// placeholder asks for it afterwards. Keeping them apart is what stops
+    /// the pane flashing a logo between selecting a thread and rendering it,
+    /// which the item lists as a constraint.
+    ///
+    /// helpers are already-translated lines; an empty query makes one plain
+    /// text rather than a link.
+    void showPlaceholder(const QList<HtmlBuilder::PlaceholderHelper> &helpers);
+
+    /// True while the placeholder is what the view is showing. Lets the window
+    /// re-render it with fresh counts without guessing what is on screen.
+    bool showingPlaceholder() const { return m_showingPlaceholder; }
+
     /// Supplies the tag strip's colours. Not owned; must outlive the view.
     void setTagColors(const TagColors *colours);
 
@@ -98,6 +114,17 @@ public slots:
 signals:
     void statusMessage(const QString &text);
 
+    /// A helper line on the placeholder was clicked. The window runs the query;
+    /// the view has no business driving the query bar itself.
+    ///
+    /// **Gated on the placeholder being what is displayed.** A message body is
+    /// attacker-controlled HTML and can carry a qtmaildir-query: link as easily
+    /// as any other; without the gate, clicking one would let a stranger's mail
+    /// drive the thread list. The consequence is mild (a query runs, nothing is
+    /// mutated or sent), but "a link in a message does something inside the
+    /// app" is a boundary worth keeping shut rather than arguing about.
+    void queryRequested(const QString &query);
+
 protected:
     /// Turns Ctrl+wheel over the body into zoom, and Ctrl+middle-click into a
     /// reset. Both events are delivered to the web view's internal QQuickWidget
@@ -147,6 +174,9 @@ private:
     QList<ThreadRenderItem> m_items;
     bool m_preferHtml = true;
 
+    /// Gates queryRequested(), so a link in a message body cannot run a query.
+    bool m_showingPlaceholder = false;
+
     QWebEngineProfile *m_profile = nullptr;
     QWebEngineView *m_view = nullptr;
     RequestInterceptor *m_interceptor = nullptr;
diff --git a/src/notmuchworker.cpp b/src/notmuchworker.cpp
index 3525a2b..973d110 100644
--- a/src/notmuchworker.cpp
+++ b/src/notmuchworker.cpp
@@ -362,3 +362,33 @@ void NotmuchWorker::requestAllTags(quint64 generation)
     result.sort();
     emit allTagsReady(result, generation);
 }
+
+void NotmuchWorker::requestCounts(const QStringList &queries, quint64 generation)
+{
+    if (!openReadOnly())
+        return;
+
+    QVector<int> counts;
+    counts.reserve(queries.size());
+
+    for (const QString &query : queries) {
+        NmQuery nmQuery(notmuch_query_create(m_db, query.toUtf8().constData()));
+
+        unsigned int count = 0;
+        // -1 rather than a skipped entry: the caller pairs these with its own
+        // labels positionally, so a dropped answer would put a real number
+        // against the wrong name, which is worse than showing none.
+        if (!nmQuery ||
+            notmuch_query_count_threads(nmQuery.get(), &count)
+                != NOTMUCH_STATUS_SUCCESS) {
+            counts.append(-1);
+            continue;
+        }
+
+        // Threads, matching what the thread list shows. A message count would
+        // disagree with the number of rows a click on this line produces.
+        counts.append(static_cast<int>(count));
+    }
+
+    emit countsReady(counts, generation);
+}
diff --git a/src/notmuchworker.h b/src/notmuchworker.h
index 96e75f8..05c1d3a 100644
--- a/src/notmuchworker.h
+++ b/src/notmuchworker.h
@@ -74,6 +74,15 @@ public slots:
     /// after a sync, and after a tag mutation introduces an unknown tag.
     void requestAllTags(quint64 generation);
 
+    /// Thread counts for the placeholder pane's helper lines, one per query,
+    /// answered in the order asked. Counts rather than results: the pane says
+    /// how much there is, and clicking a line runs the query properly.
+    ///
+    /// Requested when the pane is about to go blank rather than kept fresh in
+    /// the background. A count goes stale the moment a tag is edited, and
+    /// refreshing one nobody is looking at is work for nothing.
+    void requestCounts(const QStringList &queries, quint64 generation);
+
 signals:
     void threadsReady(const QVector<ThreadSummary> &threads, quint64 generation);
     void queryFinished(int totalThreads, quint64 generation);
@@ -81,6 +90,11 @@ signals:
     void tagsApplied(const TagChange &change);
     void allTagsReady(const QStringList &tags, quint64 generation);
 
+    /// One entry per requested query, in the order they were asked for. A query
+    /// notmuch rejects yields -1 rather than dropping the entry, so the
+    /// positional correspondence the caller relies on always holds.
+    void countsReady(const QVector<int> &counts, quint64 generation);
+
     void errorOccurred(const QString &message);
 
 private:
diff --git a/src/resources.qrc b/src/resources.qrc
index 7bdb592..f6bb6a4 100644
--- a/src/resources.qrc
+++ b/src/resources.qrc
@@ -2,5 +2,10 @@
 <RCC version="1.0">
   <qresource prefix="/">
     <file alias="icons/qtmaildir.svg">../assets/icons/qtmaildir.svg</file>
+    <!-- Subset, and embedded as data: URIs by HtmlBuilder::buildPlaceholder.
+         The web view's interceptor blocks every remote request, so the
+         mockup's Google Fonts @import cannot be ported. -->
+    <file alias="fonts/Oxanium-ExtraBold.woff2">../assets/fonts/Oxanium-ExtraBold-subset.woff2</file>
+    <file alias="fonts/IBMPlexSans-Regular.woff2">../assets/fonts/IBMPlexSans-Regular-subset.woff2</file>
   </qresource>
 </RCC>