feat(compose): derive a reply's recipients and headers, item 123

ComposeContext, task 7 of the compose-and-send plan. Address parsing,
recipient derivation, the References chain, subject prefixing and account
resolution, as free functions over values so they test without a painter.

Recipient derivation was designed from the spec rather than transcribed: the
plan's draft omitted it and its tests could not compile, calling
QVERIFY(config.load(path)) against a void return.

Six defects found in review, each pinned by a test checked against the
mutation that breaks it:

- Message-ids reached GMime bare, and GMime writes an EMPTY header for a bare
  addr-spec rather than complaining. In-Reply-To and References both shipped
  blank, so every reply would have arrived as an orphan thread with nothing
  wrong to see locally. MessageBuilder now brackets on write, in the one place
  that composes those headers rather than in each caller.
- internet_address_to_string was called with FALSE for the encode flag, so a
  display name carrying a raw newline rendered with the newline intact. That
  is a header-injection primitive.
- A reply to the user's own message addressed the user. It now goes to that
  message's original recipients, mirroring their To/Cc split, which is what
  the Sent view and a follow-up on unanswered mail need.
- A From parsing to no mailbox left To empty, reachable from real mail
  ("From: Mailer Daemon"). MessageBuilder treats an empty recipient list as
  success, so the message would have been handed to the send command with
  nobody to deliver to and filed in Sent looking sent.
- The References header was split on whitespace alone, so a client's
  non-conformant "<a@x>,<b@y>" became one token and the bracket strip produced
  the fabricated id "a@x>,<b@y".
- Reply and forward prefixes were recognised in English only, doubling every
  AW:, SV:, WG: and Re[2]: a mixed-locale mailbox receives. Single-letter
  spellings are deliberately excluded: with R: recognised, "R: report on Q3"
  reads as a prefix and a genuine first reply threads nowhere.

The mailbox-only guard in parseAddressHeader survived its first mutation
check, because removing it still yields no recipients: the invalid GObject
cast makes GMime's own assertion return NULL. That is undefined behaviour
papered over by an assertion G_DISABLE_CHECKS compiles out, so the test now
asserts on the emitted critical rather than on the count. Registering the log
handler on a NULL domain catches nothing; the criticals carry "GLib-GObject"
and "gmime".

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LoaLBowZ6w1JNx6SEhDP1L

1 files changed, 1051 insertions, 0 deletions

diff --git a/tests/test_composecontext.cpp b/tests/test_composecontext.cpp
new file mode 100644
index 0000000..fccec87
--- /dev/null
+++ b/tests/test_composecontext.cpp
@@ -0,0 +1,1051 @@
+/*
+ * qtmaildir - a Qt6 mail client for notmuch-indexed Maildirs
+ * Copyright (C) 2026 Danilo M. <danix@danix.xyz>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+// gmime BEFORE any Qt header. glib declares a struct field named "signals",
+// which Qt #defines to Q_SIGNALS. Needed here for g_log_set_handler(), which is
+// how aGroupIsDroppedByTheGuardAndNotByAFailedCast() sees the difference
+// between a group dropped by the guard and one dropped by a failed cast.
+#include <gmime/gmime.h>
+
+#include <QtTest>
+#include <QTemporaryDir>
+
+#include "composecontext.h"
+#include "config.h"
+#include "mimeparser.h"
+#include "types.h"
+
+using ComposeContextBuilder::Recipient;
+
+class TestComposeContext : public QObject
+{
+    Q_OBJECT
+
+private slots:
+    // Own addresses.
+    void everyOwnAddressIsCollected();
+    void aBlankOwnAddressIsNotCollected();
+
+    // Header parsing, the foundation the recipient rules stand on.
+    void aDisplayNameContainingACommaIsOneRecipient();
+    void aQuotedDisplayNameSurvivesRoundTripping();
+    void aMalformedHeaderYieldsNoRecipients();
+    void anEmptyHeaderYieldsNoRecipients();
+    void aGroupContributesNoRecipient();
+    void aGroupIsDroppedByTheGuardAndNotByAFailedCast();
+    void anInjectedHeaderLineIsNotCarriedForward();
+
+    // Reply and reply-all recipient derivation.
+    void aPlainReplyGoesToTheSenderOnly();
+    void aReplyPrefersReplyToOverFrom();
+    void aReplyAllPutsTheSenderInToAndTheRestInCc();
+    void aReplyAllStripsEveryOwnAddress();
+    void aReplyAllStripsAnOwnAddressRegardlessOfCase();
+    void aReplyAllDoesNotListTheSenderTwice();
+    void aReplyAllSuppressesDuplicatesAcrossToAndCc();
+    void aReplyToOneselfStillAddressesSomeone();
+    void aReplyToOwnMessageGoesToItsOriginalRecipients();
+    void aReplyAllToOwnMessageDoesNotRepeatToInCc();
+    void aCoSenderIsStillRepliedTo();
+    void anUnparseableSenderStillProducesARecipient();
+    void aReplyAllPrefersReplyToForTheToField();
+    void aDisplayNameContainingAnOwnAddressIsNotMistakenForIt();
+
+    // References.
+    void referencesCarryTheOriginalChainPlusItsId();
+    void referencesDoNotRepeatTheMessageId();
+    void aCommaSeparatedReferencesHeaderIsSplitIntoIds();
+
+    // Subjects.
+    void aReplySubjectDoesNotDoubleItsPrefix();
+    void aForwardSubjectDoesNotDoubleItsPrefix();
+    void anEmptySubjectStillGetsAPrefix();
+    void aSubjectMentioningReLaterStillGetsAPrefix();
+    void aNonEnglishPrefixIsNotDoubled();
+    void aCountedPrefixIsNotDoubled();
+    void aSingleLetterBeforeAColonIsNotAPrefix();
+
+    // Account resolution.
+    void theReplyAccountComesFromTheMessagesMaildir();
+    void anAccountIsNotMatchedByAPrefixOfItsMaildir();
+    void anAmbiguousMessagePrefersTheMatchingRecipient();
+    void anAmbiguousMessageWithNoMatchTakesTheFirst();
+    void aNewMessagePrefersTheSelectedAccount();
+    void aNewMessageFallsThroughASelectedAccountThatCannotSend();
+    void aNewMessageUsesDefaultAccountFromAllAccounts();
+    void aNewMessageUsesStartupAccountWhenNoDefaultIsSet();
+    void aNewMessageFallsBackToTheFirstSendingAccount();
+    void aNewMessageReturnsNothingWhenNoAccountCanSend();
+
+    // Quoting.
+    void aQuotedBodyPrefixesEveryLine();
+
+private:
+    QString writeConfig(const QString &contents);
+
+    QTemporaryDir m_dir;
+};
+
+QString TestComposeContext::writeConfig(const QString &contents)
+{
+    // A unique name per call: Config caches nothing, but reusing one path
+    // across tests in one binary invites a stale read to look like a pass.
+    static int counter = 0;
+    const QString path =
+        m_dir.filePath(QStringLiteral("qtmaildir%1.conf").arg(++counter));
+    QFile file(path);
+    if (!file.open(QIODevice::WriteOnly | QIODevice::Truncate | QIODevice::Text))
+        return {};
+    file.write(contents.toUtf8());
+    file.close();
+    return path;
+}
+
+// ---------------------------------------------------------------------------
+// Own addresses
+// ---------------------------------------------------------------------------
+
+void TestComposeContext::everyOwnAddressIsCollected()
+{
+    // All five of the user's addresses. Missing one means they receive their
+    // own reply, and with five accounts that is the likeliest bug here.
+    const QString path = writeConfig(QStringLiteral(
+        "[account.one]\nmaildir=one\ntrash=Trash\naddress=first@example.org\n"
+        "[account.two]\nmaildir=two\ntrash=Trash\naddress=second@example.org\n"
+        "[account.three]\nmaildir=three\ntrash=Trash\naddress=third@example.org\n"
+        "[account.four]\nmaildir=four\ntrash=Trash\naddress=fourth@example.org\n"
+        "[account.five]\nmaildir=five\ntrash=Trash\naddress=fifth@example.org\n"));
+    QVERIFY(!path.isEmpty());
+
+    Config config;
+    config.load(path);
+    QCOMPARE(config.accounts().size(), 5);
+
+    const QStringList own = ComposeContextBuilder::ownAddresses(config);
+    QCOMPARE(own.size(), 5);
+    for (const QString &address : { QStringLiteral("first@example.org"),
+                                    QStringLiteral("second@example.org"),
+                                    QStringLiteral("third@example.org"),
+                                    QStringLiteral("fourth@example.org"),
+                                    QStringLiteral("fifth@example.org") }) {
+        QVERIFY2(own.contains(address),
+                 qPrintable(QStringLiteral("own address %1 was not collected").arg(address)));
+    }
+}
+
+void TestComposeContext::aBlankOwnAddressIsNotCollected()
+{
+    // An account with no address key is legal. An empty string in this list
+    // would match nothing usefully and, in a substring filter, everything.
+    const QString path = writeConfig(QStringLiteral(
+        "[account.one]\nmaildir=one\ntrash=Trash\naddress=first@example.org\n"
+        "[account.noaddress]\nmaildir=two\ntrash=Trash\n"));
+    Config config;
+    config.load(path);
+    QCOMPARE(config.accounts().size(), 2);
+
+    const QStringList own = ComposeContextBuilder::ownAddresses(config);
+    QCOMPARE(own, QStringList{ QStringLiteral("first@example.org") });
+}
+
+// ---------------------------------------------------------------------------
+// Header parsing
+// ---------------------------------------------------------------------------
+
+void TestComposeContext::aDisplayNameContainingACommaIsOneRecipient()
+{
+    // The single most likely parsing bug: splitting on commas turns one
+    // recipient into two, one of which ("Rossi") is not an address at all and
+    // would be handed to the send command.
+    const QList<Recipient> parsed = ComposeContextBuilder::parseAddressHeader(
+        QStringLiteral("\"Rossi, Mario\" <m@example.org>, info@example.net"));
+
+    QCOMPARE(parsed.size(), 2);
+    QCOMPARE(parsed.at(0).address, QStringLiteral("m@example.org"));
+    QCOMPARE(parsed.at(1).address, QStringLiteral("info@example.net"));
+}
+
+void TestComposeContext::aQuotedDisplayNameSurvivesRoundTripping()
+{
+    // A comma in a display name must come back out QUOTED. Unquoted, the
+    // rendered form is not a legal single address: it happens to survive
+    // GMime's own lenient re-parse, but it goes into a To: header that other
+    // clients and MTAs read, and a bare comma there is a recipient separator.
+    //
+    // Asserted on the RENDERED TEXT rather than on a re-parse, and that is the
+    // point of the test: a round-trip through parseAddressHeader() passes
+    // against string-assembled "Rossi, Mario <m@example.org>" because GMime
+    // reads it back as one address anyway. Measured 2026-08-21, a mutation
+    // replacing the GMime rendering with `name + " <" + addr + ">"` left the
+    // whole suite green until this assertion was written this way.
+    const QList<Recipient> parsed = ComposeContextBuilder::parseAddressHeader(
+        QStringLiteral("\"Rossi, Mario\" <m@example.org>"));
+    QCOMPARE(parsed.size(), 1);
+    QCOMPARE(parsed.at(0).rendered,
+             QStringLiteral("\"Rossi, Mario\" <m@example.org>"));
+
+    // And it still re-parses to the same one address.
+    const QList<Recipient> again =
+        ComposeContextBuilder::parseAddressHeader(parsed.at(0).rendered);
+    QCOMPARE(again.size(), 1);
+    QCOMPARE(again.at(0).address, QStringLiteral("m@example.org"));
+}
+
+void TestComposeContext::aMalformedHeaderYieldsNoRecipients()
+{
+    // GMime returns NULL rather than an empty list for input it can make
+    // nothing of. Measured 2026-08-21: "not an address at all" and "<<<>>>"
+    // both return NULL.
+    QVERIFY(ComposeContextBuilder::parseAddressHeader(
+                QStringLiteral("not an address at all")).isEmpty());
+    QVERIFY(ComposeContextBuilder::parseAddressHeader(
+                QStringLiteral("<<<>>>")).isEmpty());
+}
+
+void TestComposeContext::anEmptyHeaderYieldsNoRecipients()
+{
+    QVERIFY(ComposeContextBuilder::parseAddressHeader(QString()).isEmpty());
+    QVERIFY(ComposeContextBuilder::parseAddressHeader(
+                QStringLiteral("   ")).isEmpty());
+}
+
+void TestComposeContext::aGroupContributesNoRecipient()
+{
+    // A group has a name and no mailbox. Carrying its name forward would put
+    // "undisclosed-recipients" in a To field as though it were a person.
+    const QList<Recipient> parsed = ComposeContextBuilder::parseAddressHeader(
+        QStringLiteral("undisclosed-recipients:;"));
+    QVERIFY2(parsed.isEmpty(),
+             qPrintable(QStringLiteral("a group produced %1 recipient(s)")
+                            .arg(parsed.size())));
+}
+
+void TestComposeContext::aGroupIsDroppedByTheGuardAndNotByAFailedCast()
+{
+    // The count alone cannot see this, which is why the guard survived a
+    // mutation until 2026-08-21. Removing the INTERNET_ADDRESS_IS_MAILBOX check
+    // still yields no recipients, because the invalid cast makes GMime's own
+    // assertion return NULL and the address is skipped one line later. The
+    // count is therefore right for the wrong reason, and the reason matters: an
+    // invalid GObject cast is undefined behaviour papered over by an assertion
+    // that G_DISABLE_CHECKS compiles out and that G_DEBUG=fatal-criticals turns
+    // into an abort. A security property must not rest on assertions staying
+    // enabled.
+    //
+    // So this asserts on the CRITICAL rather than on the count. glib routes it
+    // through the log handler installed here, and a clean parse emits none.
+    struct Captured
+    {
+        static void handler(const gchar *domain, GLogLevelFlags level,
+                            const gchar *messageText, gpointer userData)
+        {
+            Q_UNUSED(domain);
+            Q_UNUSED(level);
+            auto *messages = static_cast<QStringList *>(userData);
+            messages->append(QString::fromUtf8(messageText));
+        }
+    };
+
+    // Registered per DOMAIN, and the domain is the trap: the two criticals this
+    // watches for carry "GLib-GObject" and "gmime", while a NULL domain
+    // registers only for the default one. A handler on nullptr alone catches
+    // NOTHING here and the test passes against the mutation, measured
+    // 2026-08-21.
+    QStringList criticals;
+    const auto levels = GLogLevelFlags(G_LOG_LEVEL_CRITICAL | G_LOG_LEVEL_WARNING
+                                       | G_LOG_FLAG_FATAL | G_LOG_FLAG_RECURSION);
+    QList<guint> handlerIds;
+    for (const char *domain : { "GLib-GObject", "gmime" })
+        handlerIds.append(g_log_set_handler(domain, levels, &Captured::handler, &criticals));
+
+    // A group carrying MEMBERS, not the empty "undisclosed-recipients:;". The
+    // empty form has nothing to cast, so it cannot tell the two paths apart.
+    const QList<Recipient> parsed = ComposeContextBuilder::parseAddressHeader(
+        QStringLiteral("friends: a@example.org, b@example.net;"));
+
+    int i = 0;
+    for (const char *domain : { "GLib-GObject", "gmime" })
+        g_log_remove_handler(domain, handlerIds.at(i++));
+
+    QVERIFY2(parsed.isEmpty(),
+             qPrintable(QStringLiteral("a group with members produced %1 recipient(s)")
+                            .arg(parsed.size())));
+    QVERIFY2(criticals.isEmpty(),
+             qPrintable(QStringLiteral("GMime emitted %1 during the parse: %2")
+                            .arg(criticals.size())
+                            .arg(criticals.join(QLatin1Char('|')))));
+}
+
+void TestComposeContext::anInjectedHeaderLineIsNotCarriedForward()
+{
+    // Header injection, from a stranger's message into the user's reply.
+    // Measured 2026-08-21: GMime parses the smuggled line as a GROUP named
+    // "Bcc", so dropping non-mailboxes drops it. If groups were kept, a reply
+    // would silently pre-fill a recipient the user never saw.
+    const QList<Recipient> parsed = ComposeContextBuilder::parseAddressHeader(
+        QStringLiteral("a@example.org\nBcc: evil@example.net"));
+
+    QCOMPARE(parsed.size(), 1);
+    QCOMPARE(parsed.at(0).address, QStringLiteral("a@example.org"));
+    for (const Recipient &recipient : parsed) {
+        QVERIFY2(!recipient.rendered.contains(QStringLiteral("evil@example.net")),
+                 qPrintable(QStringLiteral("injected address survived in: %1")
+                                .arg(recipient.rendered)));
+    }
+
+    // The other injection shape: the newline hidden INSIDE a quoted display
+    // name, where it does not split the header and so is not dropped as a
+    // group. It has to come back RFC 2047 encoded, never as a raw newline: a
+    // bare CR or LF in a rendered recipient is a header-injection primitive
+    // the moment anything writes it into a To: line. Rendering by hand rather
+    // than through GMime is what loses the encoding.
+    const QList<Recipient> inName = ComposeContextBuilder::parseAddressHeader(
+        QStringLiteral("\"foo\nBcc: evil@example.net\" <a@example.org>"));
+    QCOMPARE(inName.size(), 1);
+    QCOMPARE(inName.at(0).address, QStringLiteral("a@example.org"));
+    QVERIFY2(!inName.at(0).rendered.contains(QLatin1Char('\n'))
+                 && !inName.at(0).rendered.contains(QLatin1Char('\r')),
+             qPrintable(QStringLiteral("a raw newline survived into a rendered "
+                                       "recipient: %1")
+                            .arg(inName.at(0).rendered)));
+}
+
+// ---------------------------------------------------------------------------
+// Reply and reply-all
+// ---------------------------------------------------------------------------
+
+void TestComposeContext::aPlainReplyGoesToTheSenderOnly()
+{
+    ParsedMessage message;
+    message.from = QStringLiteral("Sender <sender@example.org>");
+    message.to = QStringLiteral("me@example.org, other@example.net");
+    message.cc = QStringLiteral("third@example.com");
+
+    QStringList to;
+    QStringList cc;
+    ComposeContextBuilder::recipientsForReply(
+        message, /*replyAll=*/false, { QStringLiteral("me@example.org") }, &to, &cc);
+
+    QCOMPARE(to.size(), 1);
+    QVERIFY2(to.at(0).contains(QStringLiteral("sender@example.org")),
+             qPrintable(QStringLiteral("To was %1").arg(to.join(QLatin1Char('|')))));
+    QVERIFY2(cc.isEmpty(),
+             qPrintable(QStringLiteral("a plain reply put %1 in Cc")
+                            .arg(cc.join(QLatin1Char('|')))));
+}
+
+void TestComposeContext::aReplyPrefersReplyToOverFrom()
+{
+    // RFC 5322 3.6.2: Reply-To names where the author wants replies sent. This
+    // is what makes a list reply land on the list rather than on a person who
+    // never asked to be written to directly.
+    ParsedMessage message;
+    message.from = QStringLiteral("Sender <sender@example.org>");
+    message.replyTo = QStringLiteral("List <list@example.net>");
+
+    QStringList to;
+    QStringList cc;
+    ComposeContextBuilder::recipientsForReply(message, /*replyAll=*/false, {}, &to, &cc);
+
+    QCOMPARE(to.size(), 1);
+    QVERIFY2(to.at(0).contains(QStringLiteral("list@example.net")),
+             qPrintable(QStringLiteral("To was %1, expected the Reply-To")
+                            .arg(to.join(QLatin1Char('|')))));
+    QVERIFY2(!to.at(0).contains(QStringLiteral("sender@example.org")),
+             "From was used despite a Reply-To being present");
+}
+
+void TestComposeContext::aReplyAllPutsTheSenderInToAndTheRestInCc()
+{
+    ParsedMessage message;
+    message.from = QStringLiteral("Sender <sender@example.org>");
+    message.to = QStringLiteral("first@example.net");
+    message.cc = QStringLiteral("second@example.com");
+
+    QStringList to;
+    QStringList cc;
+    ComposeContextBuilder::recipientsForReply(message, /*replyAll=*/true, {}, &to, &cc);
+
+    QCOMPARE(to.size(), 1);
+    QVERIFY(to.at(0).contains(QStringLiteral("sender@example.org")));
+
+    QCOMPARE(cc.size(), 2);
+    QVERIFY2(cc.join(QLatin1Char('|')).contains(QStringLiteral("first@example.net")),
+             qPrintable(QStringLiteral("Cc was %1").arg(cc.join(QLatin1Char('|')))));
+    QVERIFY2(cc.join(QLatin1Char('|')).contains(QStringLiteral("second@example.com")),
+             qPrintable(QStringLiteral("Cc was %1").arg(cc.join(QLatin1Char('|')))));
+}
+
+void TestComposeContext::aReplyAllStripsEveryOwnAddress()
+{
+    // Five accounts, and the user's address appears in the original's To under
+    // THREE of them. Stripping only the first is the exact failure this guards:
+    // the reply-all would then be addressed to the user twice over.
+    ParsedMessage message;
+    message.from = QStringLiteral("Sender <sender@example.org>");
+    message.to = QStringLiteral(
+        "first@example.org, stranger@example.net, third@example.org");
+    message.cc = QStringLiteral("fifth@example.org, another@example.com");
+
+    const QStringList own = { QStringLiteral("first@example.org"),
+                              QStringLiteral("second@example.org"),
+                              QStringLiteral("third@example.org"),
+                              QStringLiteral("fourth@example.org"),
+                              QStringLiteral("fifth@example.org") };
+
+    QStringList to;
+    QStringList cc;
+    ComposeContextBuilder::recipientsForReply(message, /*replyAll=*/true, own, &to, &cc);
+
+    const QString all = (to + cc).join(QLatin1Char('|'));
+    for (const QString &address : own) {
+        QVERIFY2(!all.contains(address, Qt::CaseInsensitive),
+                 qPrintable(QStringLiteral("own address %1 survived in: %2")
+                                .arg(address, all)));
+    }
+    // And the strangers must all still be there: a filter that removed
+    // everything would pass the check above while producing an unsendable reply.
+    QVERIFY2(all.contains(QStringLiteral("stranger@example.net")),
+             qPrintable(QStringLiteral("a stranger was stripped too: %1").arg(all)));
+    QVERIFY2(all.contains(QStringLiteral("another@example.com")),
+             qPrintable(QStringLiteral("a stranger was stripped too: %1").arg(all)));
+    QVERIFY2(all.contains(QStringLiteral("sender@example.org")),
+             qPrintable(QStringLiteral("the sender was stripped: %1").arg(all)));
+}
+
+void TestComposeContext::aReplyAllStripsAnOwnAddressRegardlessOfCase()
+{
+    // A domain is case-insensitive by RFC and real mail varies the local part's
+    // case too. A case-sensitive filter lets the user's own address through and
+    // they receive their own reply.
+    ParsedMessage message;
+    message.from = QStringLiteral("Sender <sender@example.org>");
+    message.to = QStringLiteral("Me@Example.ORG, stranger@example.net");
+
+    QStringList to;
+    QStringList cc;
+    ComposeContextBuilder::recipientsForReply(
+        message, /*replyAll=*/true, { QStringLiteral("me@example.org") }, &to, &cc);
+
+    const QString all = (to + cc).join(QLatin1Char('|'));
+    QVERIFY2(!all.contains(QStringLiteral("Me@Example.ORG"), Qt::CaseInsensitive),
+             qPrintable(QStringLiteral("a differently-cased own address survived: %1")
+                            .arg(all)));
+    QVERIFY(all.contains(QStringLiteral("stranger@example.net")));
+}
+
+void TestComposeContext::aReplyAllDoesNotListTheSenderTwice()
+{
+    // The sender is very often also in their own message's To (a list posting
+    // reflected back). Without cross-field suppression they appear in To AND Cc.
+    ParsedMessage message;
+    message.from = QStringLiteral("Sender <sender@example.org>");
+    message.to = QStringLiteral("sender@example.org, stranger@example.net");
+
+    QStringList to;
+    QStringList cc;
+    ComposeContextBuilder::recipientsForReply(message, /*replyAll=*/true, {}, &to, &cc);
+
+    const QString all = (to + cc).join(QLatin1Char('|'));
+    QCOMPARE(all.count(QStringLiteral("sender@example.org")), 1);
+    QVERIFY(all.contains(QStringLiteral("stranger@example.net")));
+}
+
+void TestComposeContext::aReplyAllSuppressesDuplicatesAcrossToAndCc()
+{
+    // The same address in the original's To and Cc, with different display
+    // names so a whole-string comparison would treat them as distinct.
+    ParsedMessage message;
+    message.from = QStringLiteral("Sender <sender@example.org>");
+    message.to = QStringLiteral("Person One <dup@example.net>");
+    message.cc = QStringLiteral("P. One <dup@example.net>, other@example.com");
+
+    QStringList to;
+    QStringList cc;
+    ComposeContextBuilder::recipientsForReply(message, /*replyAll=*/true, {}, &to, &cc);
+
+    const QString all = (to + cc).join(QLatin1Char('|'));
+    QCOMPARE(all.count(QStringLiteral("dup@example.net")), 1);
+    QVERIFY(all.contains(QStringLiteral("other@example.com")));
+}
+
+void TestComposeContext::aReplyToOneselfStillAddressesSomeone()
+{
+    // Replying to a message the user sent themselves. Stripping own addresses
+    // from a plain Reply's To would leave a message with no recipient that
+    // still looks sendable.
+    ParsedMessage message;
+    message.from = QStringLiteral("Me <me@example.org>");
+    message.to = QStringLiteral("me@example.org");
+
+    QStringList to;
+    QStringList cc;
+    ComposeContextBuilder::recipientsForReply(
+        message, /*replyAll=*/false, { QStringLiteral("me@example.org") }, &to, &cc);
+
+    QVERIFY2(!to.isEmpty(), "a reply to oneself produced no recipient at all");
+    QVERIFY(to.join(QLatin1Char('|')).contains(QStringLiteral("me@example.org")));
+}
+
+void TestComposeContext::aReplyToOwnMessageGoesToItsOriginalRecipients()
+{
+    // The Sent view, and a follow-up on unanswered mail: the user replies to a
+    // message they sent. Addressing the sender there addresses the user, so To
+    // comes from the original's own recipients instead. The Cc entry is
+    // included because a reply to a conversation the user started belongs to
+    // everyone who was on it.
+    ParsedMessage message;
+    message.from = QStringLiteral("Me <me@example.org>");
+    message.to = QStringLiteral("Correspondent <them@example.net>");
+    message.cc = QStringLiteral("watcher@example.com");
+
+    QStringList to;
+    QStringList cc;
+    ComposeContextBuilder::recipientsForReply(
+        message, /*replyAll=*/false, { QStringLiteral("me@example.org") }, &to, &cc);
+
+    const QString joined = to.join(QLatin1Char('|'));
+    QVERIFY2(joined.contains(QStringLiteral("them@example.net")),
+             qPrintable(QStringLiteral("To was %1").arg(joined)));
+    QVERIFY2(joined.contains(QStringLiteral("watcher@example.com")),
+             qPrintable(QStringLiteral("To was %1").arg(joined)));
+    // The whole point: the user is not written back to themselves.
+    QVERIFY2(!joined.contains(QStringLiteral("me@example.org")),
+             qPrintable(QStringLiteral("the reply addressed the user: %1").arg(joined)));
+    QVERIFY2(cc.isEmpty(), "a plain reply produced a Cc");
+}
+
+void TestComposeContext::aReplyAllToOwnMessageDoesNotRepeatToInCc()
+{
+    // Reply-all to your own message MIRRORS the original's split: its To
+    // becomes To, its Cc becomes Cc. The split is the message's meaning, To
+    // being "addressed to you" and Cc "for information", and promoting a Cc'd
+    // party to To is visible to every recipient.
+    //
+    // Asserted per FIELD, not on the union. A test counting each address once
+    // across to + cc passes whether the split is preserved or collapsed, which
+    // is how the collapse shipped and survived its first mutation check.
+    ParsedMessage message;
+    message.from = QStringLiteral("Me <me@example.org>");
+    message.to = QStringLiteral("them@example.net");
+    message.cc = QStringLiteral("watcher@example.com");
+
+    QStringList to;
+    QStringList cc;
+    ComposeContextBuilder::recipientsForReply(
+        message, /*replyAll=*/true, { QStringLiteral("me@example.org") }, &to, &cc);
+
+    const QString toJoined = to.join(QLatin1Char('|'));
+    const QString ccJoined = cc.join(QLatin1Char('|'));
+    QVERIFY2(toJoined.contains(QStringLiteral("them@example.net")),
+             qPrintable(QStringLiteral("To was %1").arg(toJoined)));
+    QVERIFY2(!toJoined.contains(QStringLiteral("watcher@example.com")),
+             qPrintable(QStringLiteral("a Cc recipient was promoted to To: %1").arg(toJoined)));
+    QVERIFY2(ccJoined.contains(QStringLiteral("watcher@example.com")),
+             qPrintable(QStringLiteral("Cc was %1").arg(ccJoined)));
+    QVERIFY2(!ccJoined.contains(QStringLiteral("them@example.net")),
+             qPrintable(QStringLiteral("the To address repeated in Cc: %1").arg(ccJoined)));
+    // The whole point of the self-reply rule.
+    QVERIFY2(!(toJoined + ccJoined).contains(QStringLiteral("me@example.org")),
+             "the reply addressed the user");
+}
+
+void TestComposeContext::aCoSenderIsStillRepliedTo()
+{
+    // A message the user sent WITH somebody else is not a message to oneself.
+    // Only an all-own sender diverts To to the original recipients; here the
+    // co-sender is a real person expecting the reply.
+    ParsedMessage message;
+    message.from = QStringLiteral("Me <me@example.org>, Other <other@example.net>");
+    message.to = QStringLiteral("them@example.com");
+
+    QStringList to;
+    QStringList cc;
+    ComposeContextBuilder::recipientsForReply(
+        message, /*replyAll=*/false, { QStringLiteral("me@example.org") }, &to, &cc);
+
+    const QString joined = to.join(QLatin1Char('|'));
+    QVERIFY2(joined.contains(QStringLiteral("other@example.net")),
+             qPrintable(QStringLiteral("To was %1").arg(joined)));
+    QVERIFY2(!joined.contains(QStringLiteral("them@example.com")),
+             qPrintable(QStringLiteral("a plain reply reached the original's To: %1")
+                            .arg(joined)));
+}
+
+void TestComposeContext::anUnparseableSenderStillProducesARecipient()
+{
+    // "From: Mailer Daemon" is a bare display name with no angle brackets, which
+    // is what bounces and some automated senders emit. It parses to ZERO
+    // mailboxes, so the sender contributes nothing and To would otherwise come
+    // out empty.
+    //
+    // An empty To is the worst outcome available here, because MessageBuilder
+    // treats an empty recipient list as success: the message reaches the send
+    // command with nobody to deliver to and a copy is filed in Sent that looks
+    // sent and reached no one. The original's own recipients are the remaining
+    // candidates.
+    ParsedMessage message;
+    message.from = QStringLiteral("Mailer Daemon");
+    message.to = QStringLiteral("them@example.net");
+    message.cc = QStringLiteral("watcher@example.com");
+
+    QStringList to;
+    QStringList cc;
+    ComposeContextBuilder::recipientsForReply(
+        message, /*replyAll=*/false, { QStringLiteral("me@example.org") }, &to, &cc);
+
+    QVERIFY2(!to.isEmpty(), "an unparseable sender produced a reply with no recipient");
+    QVERIFY2(to.join(QLatin1Char('|')).contains(QStringLiteral("them@example.net")),
+             qPrintable(QStringLiteral("To was %1").arg(to.join(QLatin1Char('|')))));
+
+    // Reply-all is the worse half: without the fallback it puts every recipient
+    // in Cc and leaves To empty, which is a message addressed to nobody.
+    QStringList allTo;
+    QStringList allCc;
+    ComposeContextBuilder::recipientsForReply(
+        message, /*replyAll=*/true, { QStringLiteral("me@example.org") }, &allTo, &allCc);
+    QVERIFY2(!allTo.isEmpty(), "a reply-all to an unparseable sender left To empty");
+}
+
+void TestComposeContext::aReplyAllPrefersReplyToForTheToField()
+{
+    // Reply-To precedence is not a plain-Reply-only rule: a list's reply-all
+    // must also go to the list rather than to the individual poster.
+    ParsedMessage message;
+    message.from = QStringLiteral("Poster <poster@example.org>");
+    message.replyTo = QStringLiteral("List <list@example.net>");
+    message.to = QStringLiteral("list@example.net");
+    message.cc = QStringLiteral("watcher@example.com");
+
+    QStringList to;
+    QStringList cc;
+    ComposeContextBuilder::recipientsForReply(message, /*replyAll=*/true, {}, &to, &cc);
+
+    QCOMPARE(to.size(), 1);
+    QVERIFY2(to.at(0).contains(QStringLiteral("list@example.net")),
+             qPrintable(QStringLiteral("To was %1").arg(to.join(QLatin1Char('|')))));
+    // The list is in To, so it must not repeat in Cc even though the original's
+    // To named it.
+    QVERIFY2(!cc.join(QLatin1Char('|')).contains(QStringLiteral("list@example.net")),
+             qPrintable(QStringLiteral("the To address repeated in Cc: %1")
+                            .arg(cc.join(QLatin1Char('|')))));
+    QVERIFY(cc.join(QLatin1Char('|')).contains(QStringLiteral("watcher@example.com")));
+}
+
+void TestComposeContext::aDisplayNameContainingAnOwnAddressIsNotMistakenForIt()
+{
+    // A stranger whose DISPLAY NAME quotes the user's address. Comparing the
+    // rendered whole rather than the addr-spec would strip a real recipient,
+    // and the reply would silently not reach them.
+    ParsedMessage message;
+    message.from = QStringLiteral("Sender <sender@example.org>");
+    message.to = QStringLiteral("\"about me@example.org\" <stranger@example.net>");
+
+    QStringList to;
+    QStringList cc;
+    ComposeContextBuilder::recipientsForReply(
+        message, /*replyAll=*/true, { QStringLiteral("me@example.org") }, &to, &cc);
+
+    QVERIFY2((to + cc).join(QLatin1Char('|')).contains(QStringLiteral("stranger@example.net")),
+             "a stranger was stripped because their display name quoted an own address");
+}
+
+// ---------------------------------------------------------------------------
+// References
+// ---------------------------------------------------------------------------
+
+void TestComposeContext::referencesCarryTheOriginalChainPlusItsId()
+{
+    ParsedMessage message;
+    message.messageId = QStringLiteral("current@example.org");
+    message.references =
+        QStringLiteral("<first@example.org> <second@example.org>");
+
+    const QStringList refs = ComposeContextBuilder::referencesForReply(message);
+
+    QCOMPARE(refs.size(), 3);
+    QCOMPARE(refs.at(0), QStringLiteral("first@example.org"));
+    QCOMPARE(refs.at(1), QStringLiteral("second@example.org"));
+    QCOMPARE(refs.at(2), QStringLiteral("current@example.org"));
+}
+
+void TestComposeContext::referencesDoNotRepeatTheMessageId()
+{
+    ParsedMessage message;
+    message.messageId = QStringLiteral("current@example.org");
+    message.references = QStringLiteral("<first@example.org> <current@example.org>");
+
+    const QStringList refs = ComposeContextBuilder::referencesForReply(message);
+
+    QCOMPARE(refs.count(QStringLiteral("current@example.org")), 1);
+    QCOMPARE(refs.last(), QStringLiteral("current@example.org"));
+}
+
+// ---------------------------------------------------------------------------
+// Subjects
+// ---------------------------------------------------------------------------
+
+void TestComposeContext::aCommaSeparatedReferencesHeaderIsSplitIntoIds()
+{
+    // `<a@x>,<b@y>` is not conformant, RFC 5322 has no comma here, but some
+    // clients emit it. Splitting on whitespace alone makes that whole header ONE
+    // token, and stripping its outer brackets then yields the fabricated id
+    // `a@x>,<b@y`, which is sent to the recipient as a Message-ID reference. A
+    // comma cannot occur inside a msg-id, so accepting it as a separator is free.
+    ParsedMessage message;
+    message.references = QStringLiteral("<first@example.org>,<second@example.org>");
+    message.messageId = QStringLiteral("current@example.org");
+
+    const QStringList refs = ComposeContextBuilder::referencesForReply(message);
+
+    QCOMPARE(refs.size(), 3);
+    QCOMPARE(refs.at(0), QStringLiteral("first@example.org"));
+    QCOMPARE(refs.at(1), QStringLiteral("second@example.org"));
+    QCOMPARE(refs.at(2), QStringLiteral("current@example.org"));
+}
+
+void TestComposeContext::aReplySubjectDoesNotDoubleItsPrefix()
+{
+    QCOMPARE(ComposeContextBuilder::replySubject(QStringLiteral("Hello")),
+             QStringLiteral("Re: Hello"));
+    QCOMPARE(ComposeContextBuilder::replySubject(QStringLiteral("Re: Hello")),
+             QStringLiteral("Re: Hello"));
+    // Case and spacing vary between clients and neither justifies a second
+    // prefix. "RE:" from Outlook is the common one.
+    QCOMPARE(ComposeContextBuilder::replySubject(QStringLiteral("RE: Hello")),
+             QStringLiteral("RE: Hello"));
+    QCOMPARE(ComposeContextBuilder::replySubject(QStringLiteral("re:Hello")),
+             QStringLiteral("re:Hello"));
+}
+
+void TestComposeContext::aForwardSubjectDoesNotDoubleItsPrefix()
+{
+    QCOMPARE(ComposeContextBuilder::forwardSubject(QStringLiteral("Hello")),
+             QStringLiteral("Fwd: Hello"));
+    QCOMPARE(ComposeContextBuilder::forwardSubject(QStringLiteral("Fwd: Hello")),
+             QStringLiteral("Fwd: Hello"));
+    // "Fw:" is the other common spelling and means the same thing.
+    QCOMPARE(ComposeContextBuilder::forwardSubject(QStringLiteral("Fw: Hello")),
+             QStringLiteral("Fw: Hello"));
+}
+
+void TestComposeContext::anEmptySubjectStillGetsAPrefix()
+{
+    // A reply to a subjectless message is still a reply. "Re: " alone is
+    // correct and is what every other client produces.
+    QCOMPARE(ComposeContextBuilder::replySubject(QString()),
+             QStringLiteral("Re: "));
+}
+
+void TestComposeContext::aSubjectMentioningReLaterStillGetsAPrefix()
+{
+    // The prefix test is ANCHORED. An unanchored search would see "re:" inside
+    // an ordinary subject and refuse to prefix a genuine first reply, which
+    // breaks threading in the recipient's client.
+    QCOMPARE(ComposeContextBuilder::replySubject(QStringLiteral("Notes re: budget")),
+             QStringLiteral("Re: Notes re: budget"));
+    QCOMPARE(ComposeContextBuilder::forwardSubject(QStringLiteral("Notes fwd: budget")),
+             QStringLiteral("Fwd: Notes fwd: budget"));
+}
+
+void TestComposeContext::aNonEnglishPrefixIsNotDoubled()
+{
+    // A mixed-locale mailbox, which this one is. An English-only pattern turns
+    // every one of these into "Re: AW: subject", and the round after that into
+    // "Re: Re: AW:".
+    QCOMPARE(ComposeContextBuilder::replySubject(QStringLiteral("AW: Angebot")),
+             QStringLiteral("AW: Angebot"));
+    QCOMPARE(ComposeContextBuilder::replySubject(QStringLiteral("SV: innkalling")),
+             QStringLiteral("SV: innkalling"));
+    QCOMPARE(ComposeContextBuilder::replySubject(QStringLiteral("RES: pedido")),
+             QStringLiteral("RES: pedido"));
+    QCOMPARE(ComposeContextBuilder::forwardSubject(QStringLiteral("WG: Angebot")),
+             QStringLiteral("WG: Angebot"));
+    QCOMPARE(ComposeContextBuilder::forwardSubject(QStringLiteral("TR: document")),
+             QStringLiteral("TR: document"));
+}
+
+void TestComposeContext::aCountedPrefixIsNotDoubled()
+{
+    // Outlook and some list managers count the rounds. Same meaning, and
+    // prefixing again produces "Re: Re[2]:".
+    QCOMPARE(ComposeContextBuilder::replySubject(QStringLiteral("Re[2]: thread")),
+             QStringLiteral("Re[2]: thread"));
+    QCOMPARE(ComposeContextBuilder::replySubject(QStringLiteral("Re(3): thread")),
+             QStringLiteral("Re(3): thread"));
+}
+
+void TestComposeContext::aSingleLetterBeforeAColonIsNotAPrefix()
+{
+    // Italian clients do send "R:" and "I:", and they are deliberately NOT
+    // recognised. Measured 2026-08-21: with them in the pattern, "R: report on
+    // Q3" reads as an existing prefix, so a genuine FIRST reply gets no "Re:"
+    // and threads nowhere in the recipient's client, with nothing wrong to see
+    // locally. A doubled "Re: R:" is cosmetic; broken threading is not.
+    //
+    // "F:" is here for the same reason: the pattern was once `fwd?`, which
+    // matched it.
+    QCOMPARE(ComposeContextBuilder::replySubject(QStringLiteral("R: report on Q3")),
+             QStringLiteral("Re: R: report on Q3"));
+    QCOMPARE(ComposeContextBuilder::forwardSubject(QStringLiteral("I: notes")),
+             QStringLiteral("Fwd: I: notes"));
+    QCOMPARE(ComposeContextBuilder::forwardSubject(QStringLiteral("F: results")),
+             QStringLiteral("Fwd: F: results"));
+}
+
+// ---------------------------------------------------------------------------
+// Account resolution
+// ---------------------------------------------------------------------------
+
+void TestComposeContext::theReplyAccountComesFromTheMessagesMaildir()
+{
+    // The dropdown is NOT consulted: replying from the All accounts view to a
+    // message that arrived at account B sends from B.
+    const QString path = writeConfig(QStringLiteral(
+        "[account.work]\nmaildir=work\ntrash=Trash\naddress=work@example.org\n"
+        "send_command=/bin/true\n"
+        "[account.home]\nmaildir=home\ntrash=Trash\naddress=home@example.org\n"
+        "send_command=/bin/true\n"));
+    QVERIFY(!path.isEmpty());
+
+    Config config;
+    config.load(path);
+    QCOMPARE(config.accounts().size(), 2);
+
+    const QString account = ComposeContextBuilder::accountForReply(
+        config, { QStringLiteral("/mail/home/INBOX/cur/123") },
+        { QStringLiteral("home@example.org") }, QStringLiteral("/mail"));
+
+    QCOMPARE(account, QStringLiteral("home"));
+}
+
+void TestComposeContext::anAccountIsNotMatchedByAPrefixOfItsMaildir()
+{
+    // "work" must not claim a message living in "work-archive". Without the
+    // separator in the comparison it does, and the reply is sent from the
+    // wrong account.
+    //
+    // The account KEYS are chosen so the wrong answer is reached FIRST.
+    // Config builds its list from QSettings::childGroups(), which returns
+    // groups ALPHABETICALLY rather than in file order, so the section order
+    // here decides nothing and only the keys do. With "archive" before "work"
+    // the loop happens upon the correct account before it can mismatch, and
+    // the test passes against the bug: measured, a mutation dropping the
+    // separator left the suite fully green. "a-work" (maildir "work") sorts
+    // before "b-archive" (maildir "work-archive") and puts the prefix
+    // candidate first, where a textual comparison matches it.
+    const QString path = writeConfig(QStringLiteral(
+        "[account.a-work]\nmaildir=work\ntrash=Trash\naddress=work@example.org\n"
+        "send_command=/bin/true\n"
+        "[account.b-archive]\nmaildir=work-archive\ntrash=Trash\n"
+        "address=archive@example.org\nsend_command=/bin/true\n"));
+    Config config;
+    config.load(path);
+    QCOMPARE(config.accounts().size(), 2);
+    // The ordering the mutation depends on, asserted rather than assumed: if
+    // Config ever sorts differently this test silently stops testing anything.
+    QCOMPARE(config.accounts().at(0).key, QStringLiteral("a-work"));
+
+    const QString account = ComposeContextBuilder::accountForReply(
+        config, { QStringLiteral("/mail/work-archive/INBOX/cur/1") },
+        {}, QStringLiteral("/mail"));
+
+    QCOMPARE(account, QStringLiteral("b-archive"));
+}
+
+void TestComposeContext::anAmbiguousMessagePrefersTheMatchingRecipient()
+{
+    // One message, two maildirs: on a list twice under two addresses. The
+    // recipient headers are the tiebreak.
+    const QString path = writeConfig(QStringLiteral(
+        "[account.work]\nmaildir=work\ntrash=Trash\naddress=work@example.org\n"
+        "send_command=/bin/true\n"
+        "[account.home]\nmaildir=home\ntrash=Trash\naddress=home@example.org\n"
+        "send_command=/bin/true\n"));
+    QVERIFY(!path.isEmpty());
+
+    Config config;
+    config.load(path);
+
+    const QString account = ComposeContextBuilder::accountForReply(
+        config,
+        { QStringLiteral("/mail/work/Lists/cur/1"),
+          QStringLiteral("/mail/home/Lists/cur/1") },
+        { QStringLiteral("home@example.org") }, QStringLiteral("/mail"));
+
+    QCOMPARE(account, QStringLiteral("home"));
+}
+
+void TestComposeContext::anAmbiguousMessageWithNoMatchTakesTheFirst()
+{
+    // Arbitrary, and deliberately so: the From field shows the choice, which
+    // makes an arbitrary resolution visible rather than hidden.
+    const QString path = writeConfig(QStringLiteral(
+        "[account.work]\nmaildir=work\ntrash=Trash\naddress=work@example.org\n"
+        "send_command=/bin/true\n"
+        "[account.home]\nmaildir=home\ntrash=Trash\naddress=home@example.org\n"
+        "send_command=/bin/true\n"));
+    Config config;
+    config.load(path);
+
+    const QString account = ComposeContextBuilder::accountForReply(
+        config,
+        { QStringLiteral("/mail/work/Lists/cur/1"),
+          QStringLiteral("/mail/home/Lists/cur/1") },
+        { QStringLiteral("someone-else@example.org") }, QStringLiteral("/mail"));
+
+    QVERIFY2(!account.isEmpty(), "an ambiguous message resolved to no account");
+    QCOMPARE(account, QStringLiteral("work"));
+}
+
+void TestComposeContext::aNewMessagePrefersTheSelectedAccount()
+{
+    const QString path = writeConfig(QStringLiteral(
+        "[account.work]\nmaildir=work\ntrash=Trash\nsend_command=/bin/true\n"
+        "[account.home]\nmaildir=home\ntrash=Trash\nsend_command=/bin/true\n"));
+    Config config;
+    config.load(path);
+    QCOMPARE(config.accounts().size(), 2);
+
+    QCOMPARE(ComposeContextBuilder::accountForNew(config, QStringLiteral("home")),
+             QStringLiteral("home"));
+}
+
+void TestComposeContext::aNewMessageFallsThroughASelectedAccountThatCannotSend()
+{
+    // Rule 1 requires the selected account CAN send. Viewing a receive-only
+    // account and pressing compose must produce a working composer from
+    // another account, not a broken one from this.
+    const QString path = writeConfig(QStringLiteral(
+        "[account.listsonly]\nmaildir=listsonly\ntrash=Trash\n"
+        "[account.work]\nmaildir=work\ntrash=Trash\nsend_command=/bin/true\n"));
+    Config config;
+    config.load(path);
+    QCOMPARE(config.accounts().size(), 2);
+
+    QCOMPARE(ComposeContextBuilder::accountForNew(config, QStringLiteral("listsonly")),
+             QStringLiteral("work"));
+}
+
+void TestComposeContext::aNewMessageUsesDefaultAccountFromAllAccounts()
+{
+    // The All accounts view has no selected account and falls through to rule 2.
+    //
+    // The named account must NOT also be what rule 4 would answer, or the test
+    // passes with rule 2 deleted outright: measured, a mutation removing it
+    // left the suite green because the account list is ALPHABETICAL (Config
+    // builds it from QSettings::childGroups()) and the section order in this
+    // string decides nothing. "zeta" sorts last, so rule 4 would answer
+    // "alpha" and only rule 2 can produce "zeta".
+    const QString path = writeConfig(QStringLiteral(
+        "[account.alpha]\nmaildir=alpha\ntrash=Trash\nsend_command=/bin/true\n"
+        "[account.zeta]\nmaildir=zeta\ntrash=Trash\nsend_command=/bin/true\n"
+        "[compose]\ndefault_account=zeta\n"));
+    Config config;
+    config.load(path);
+    QCOMPARE(config.compose().defaultAccount, QStringLiteral("zeta"));
+    // Asserted rather than assumed, so the test stops silently proving nothing
+    // if Config ever changes its ordering.
+    QCOMPARE(config.sendingAccounts().first().key, QStringLiteral("alpha"));
+
+    QCOMPARE(ComposeContextBuilder::accountForNew(config, QString()),
+             QStringLiteral("zeta"));
+}
+
+void TestComposeContext::aNewMessageUsesStartupAccountWhenNoDefaultIsSet()
+{
+    // Rule 3. Same ordering trap as rule 2: "zeta" must not be what rule 4
+    // would answer, or a test for this rule passes with the rule deleted.
+    const QString path = writeConfig(QStringLiteral(
+        "[general]\nstartup_account=zeta\n"
+        "[account.alpha]\nmaildir=alpha\ntrash=Trash\nsend_command=/bin/true\n"
+        "[account.zeta]\nmaildir=zeta\ntrash=Trash\nsend_command=/bin/true\n"));
+    Config config;
+    config.load(path);
+    QCOMPARE(config.startupAccount(), QStringLiteral("zeta"));
+    QVERIFY(config.compose().defaultAccount.isEmpty());
+    QCOMPARE(config.sendingAccounts().first().key, QStringLiteral("alpha"));
+
+    QCOMPARE(ComposeContextBuilder::accountForNew(config, QString()),
+             QStringLiteral("zeta"));
+}
+
+void TestComposeContext::aNewMessageFallsBackToTheFirstSendingAccount()
+{
+    // Rule 4, arbitrary, and the reason rules 2 and 3 exist. The receive-only
+    // account is FIRST, so "the first account" and "the first sending account"
+    // are different answers and the test distinguishes them.
+    const QString path = writeConfig(QStringLiteral(
+        "[account.listsonly]\nmaildir=listsonly\ntrash=Trash\n"
+        "[account.work]\nmaildir=work\ntrash=Trash\nsend_command=/bin/true\n"));
+    Config config;
+    config.load(path);
+    QCOMPARE(config.accounts().size(), 2);
+
+    QCOMPARE(ComposeContextBuilder::accountForNew(config, QString()),
+             QStringLiteral("work"));
+}
+
+void TestComposeContext::aNewMessageReturnsNothingWhenNoAccountCanSend()
+{
+    // A valid read-only installation. The compose action is disabled, so this
+    // should be unreachable, and returning empty rather than a random account
+    // is what makes a mistake visible instead of silent.
+    const QString path = writeConfig(QStringLiteral(
+        "[account.listsonly]\nmaildir=listsonly\ntrash=Trash\n"));
+    Config config;
+    config.load(path);
+    QCOMPARE(config.accounts().size(), 1);
+
+    QVERIFY(ComposeContextBuilder::accountForNew(config, QString()).isEmpty());
+}
+
+// ---------------------------------------------------------------------------
+// Quoting
+// ---------------------------------------------------------------------------
+
+void TestComposeContext::aQuotedBodyPrefixesEveryLine()
+{
+    ParsedMessage message;
+    message.from = QStringLiteral("Sender <sender@example.org>");
+    message.date = QStringLiteral("Thu, 20 Aug 2026 10:00:00 +0200");
+    message.plainBody = QStringLiteral("first line\nsecond line\n\nafter a blank");
+
+    const QString quoted = ComposeContextBuilder::quoteBody(message);
+
+    QVERIFY2(quoted.contains(QStringLiteral("> first line")),
+             qPrintable(QStringLiteral("first line not quoted:\n%1").arg(quoted)));
+    QVERIFY2(quoted.contains(QStringLiteral("> second line")),
+             "second line not quoted");
+    // A blank line inside a quote must still carry the marker, or the quote
+    // visually ends there in every client that renders it.
+    QVERIFY2(quoted.contains(QStringLiteral("\n>\n")),
+             qPrintable(QStringLiteral("a blank line lost its marker:\n%1").arg(quoted)));
+    QVERIFY2(quoted.contains(QStringLiteral("sender@example.org")),
+             "no attribution line naming the sender");
+    // A CRLF body must not leave a stray carriage return before every marker.
+    ParsedMessage crlf;
+    crlf.plainBody = QStringLiteral("one\r\ntwo");
+    const QString quotedCrlf = ComposeContextBuilder::quoteBody(crlf);
+    QVERIFY2(!quotedCrlf.contains(QLatin1Char('\r')),
+             qPrintable(QStringLiteral("a carriage return survived quoting: %1")
+                            .arg(quotedCrlf)));
+}
+
+QTEST_MAIN(TestComposeContext)
+#include "test_composecontext.moc"