Merge branch 'compose-and-send': composing and sending mail

Item 123, built over 2026-08-20 to 2026-08-23 in thirteen tasks against
docs/superpowers/specs/2026-08-20-compose-and-send-design.md.

The application writes mail now. A composer window per message, markdown as
the body, drafts autosaving into the account's Maildir, and sending through a
per-account command on stdin rather than any network protocol of this
program's own. A countdown with an Undo stands between pressing Send and the
command running.

Two things came in alongside it. The notmuch auto-tagging hooks moved here
from the retiring `mailctl` project and learned that mail this application
files itself never arrived, so sent mail and drafts stop appearing in the
inbox. And the v1/v2 language is retired: semver on the user-visible surface
is the rule, and those labels described a split that composing made obsolete.

Hand tested against a fake send command rather than a real one, deliberately:
New, Reply and Forward all produce correct messages, a forwarded attachment
survives intact, and the sent copy is filed. That testing found the two
defects fixed on this branch, and both were invisible to the suite: a composer
orphaned by quitting the main window, and every sent message tagged `inbox`.

Twenty-two defects were found in the plan document's own draft code while
building it, which is why CLAUDE.md says to treat every code block in a plan
as a draft.

1 files changed, 1051 insertions, 0 deletions

diff --git a/tests/test_composecontext.cpp b/tests/test_composecontext.cpp
new file mode 100644
index 0000000..fccec87
--- /dev/null
+++ b/tests/test_composecontext.cpp
@@ -0,0 +1,1051 @@
+/*
+ * qtmaildir - a Qt6 mail client for notmuch-indexed Maildirs
+ * Copyright (C) 2026 Danilo M. <danix@danix.xyz>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+// gmime BEFORE any Qt header. glib declares a struct field named "signals",
+// which Qt #defines to Q_SIGNALS. Needed here for g_log_set_handler(), which is
+// how aGroupIsDroppedByTheGuardAndNotByAFailedCast() sees the difference
+// between a group dropped by the guard and one dropped by a failed cast.
+#include <gmime/gmime.h>
+
+#include <QtTest>
+#include <QTemporaryDir>
+
+#include "composecontext.h"
+#include "config.h"
+#include "mimeparser.h"
+#include "types.h"
+
+using ComposeContextBuilder::Recipient;
+
+class TestComposeContext : public QObject
+{
+    Q_OBJECT
+
+private slots:
+    // Own addresses.
+    void everyOwnAddressIsCollected();
+    void aBlankOwnAddressIsNotCollected();
+
+    // Header parsing, the foundation the recipient rules stand on.
+    void aDisplayNameContainingACommaIsOneRecipient();
+    void aQuotedDisplayNameSurvivesRoundTripping();
+    void aMalformedHeaderYieldsNoRecipients();
+    void anEmptyHeaderYieldsNoRecipients();
+    void aGroupContributesNoRecipient();
+    void aGroupIsDroppedByTheGuardAndNotByAFailedCast();
+    void anInjectedHeaderLineIsNotCarriedForward();
+
+    // Reply and reply-all recipient derivation.
+    void aPlainReplyGoesToTheSenderOnly();
+    void aReplyPrefersReplyToOverFrom();
+    void aReplyAllPutsTheSenderInToAndTheRestInCc();
+    void aReplyAllStripsEveryOwnAddress();
+    void aReplyAllStripsAnOwnAddressRegardlessOfCase();
+    void aReplyAllDoesNotListTheSenderTwice();
+    void aReplyAllSuppressesDuplicatesAcrossToAndCc();
+    void aReplyToOneselfStillAddressesSomeone();
+    void aReplyToOwnMessageGoesToItsOriginalRecipients();
+    void aReplyAllToOwnMessageDoesNotRepeatToInCc();
+    void aCoSenderIsStillRepliedTo();
+    void anUnparseableSenderStillProducesARecipient();
+    void aReplyAllPrefersReplyToForTheToField();
+    void aDisplayNameContainingAnOwnAddressIsNotMistakenForIt();
+
+    // References.
+    void referencesCarryTheOriginalChainPlusItsId();
+    void referencesDoNotRepeatTheMessageId();
+    void aCommaSeparatedReferencesHeaderIsSplitIntoIds();
+
+    // Subjects.
+    void aReplySubjectDoesNotDoubleItsPrefix();
+    void aForwardSubjectDoesNotDoubleItsPrefix();
+    void anEmptySubjectStillGetsAPrefix();
+    void aSubjectMentioningReLaterStillGetsAPrefix();
+    void aNonEnglishPrefixIsNotDoubled();
+    void aCountedPrefixIsNotDoubled();
+    void aSingleLetterBeforeAColonIsNotAPrefix();
+
+    // Account resolution.
+    void theReplyAccountComesFromTheMessagesMaildir();
+    void anAccountIsNotMatchedByAPrefixOfItsMaildir();
+    void anAmbiguousMessagePrefersTheMatchingRecipient();
+    void anAmbiguousMessageWithNoMatchTakesTheFirst();
+    void aNewMessagePrefersTheSelectedAccount();
+    void aNewMessageFallsThroughASelectedAccountThatCannotSend();
+    void aNewMessageUsesDefaultAccountFromAllAccounts();
+    void aNewMessageUsesStartupAccountWhenNoDefaultIsSet();
+    void aNewMessageFallsBackToTheFirstSendingAccount();
+    void aNewMessageReturnsNothingWhenNoAccountCanSend();
+
+    // Quoting.
+    void aQuotedBodyPrefixesEveryLine();
+
+private:
+    QString writeConfig(const QString &contents);
+
+    QTemporaryDir m_dir;
+};
+
+QString TestComposeContext::writeConfig(const QString &contents)
+{
+    // A unique name per call: Config caches nothing, but reusing one path
+    // across tests in one binary invites a stale read to look like a pass.
+    static int counter = 0;
+    const QString path =
+        m_dir.filePath(QStringLiteral("qtmaildir%1.conf").arg(++counter));
+    QFile file(path);
+    if (!file.open(QIODevice::WriteOnly | QIODevice::Truncate | QIODevice::Text))
+        return {};
+    file.write(contents.toUtf8());
+    file.close();
+    return path;
+}
+
+// ---------------------------------------------------------------------------
+// Own addresses
+// ---------------------------------------------------------------------------
+
+void TestComposeContext::everyOwnAddressIsCollected()
+{
+    // All five of the user's addresses. Missing one means they receive their
+    // own reply, and with five accounts that is the likeliest bug here.
+    const QString path = writeConfig(QStringLiteral(
+        "[account.one]\nmaildir=one\ntrash=Trash\naddress=first@example.org\n"
+        "[account.two]\nmaildir=two\ntrash=Trash\naddress=second@example.org\n"
+        "[account.three]\nmaildir=three\ntrash=Trash\naddress=third@example.org\n"
+        "[account.four]\nmaildir=four\ntrash=Trash\naddress=fourth@example.org\n"
+        "[account.five]\nmaildir=five\ntrash=Trash\naddress=fifth@example.org\n"));
+    QVERIFY(!path.isEmpty());
+
+    Config config;
+    config.load(path);
+    QCOMPARE(config.accounts().size(), 5);
+
+    const QStringList own = ComposeContextBuilder::ownAddresses(config);
+    QCOMPARE(own.size(), 5);
+    for (const QString &address : { QStringLiteral("first@example.org"),
+                                    QStringLiteral("second@example.org"),
+                                    QStringLiteral("third@example.org"),
+                                    QStringLiteral("fourth@example.org"),
+                                    QStringLiteral("fifth@example.org") }) {
+        QVERIFY2(own.contains(address),
+                 qPrintable(QStringLiteral("own address %1 was not collected").arg(address)));
+    }
+}
+
+void TestComposeContext::aBlankOwnAddressIsNotCollected()
+{
+    // An account with no address key is legal. An empty string in this list
+    // would match nothing usefully and, in a substring filter, everything.
+    const QString path = writeConfig(QStringLiteral(
+        "[account.one]\nmaildir=one\ntrash=Trash\naddress=first@example.org\n"
+        "[account.noaddress]\nmaildir=two\ntrash=Trash\n"));
+    Config config;
+    config.load(path);
+    QCOMPARE(config.accounts().size(), 2);
+
+    const QStringList own = ComposeContextBuilder::ownAddresses(config);
+    QCOMPARE(own, QStringList{ QStringLiteral("first@example.org") });
+}
+
+// ---------------------------------------------------------------------------
+// Header parsing
+// ---------------------------------------------------------------------------
+
+void TestComposeContext::aDisplayNameContainingACommaIsOneRecipient()
+{
+    // The single most likely parsing bug: splitting on commas turns one
+    // recipient into two, one of which ("Rossi") is not an address at all and
+    // would be handed to the send command.
+    const QList<Recipient> parsed = ComposeContextBuilder::parseAddressHeader(
+        QStringLiteral("\"Rossi, Mario\" <m@example.org>, info@example.net"));
+
+    QCOMPARE(parsed.size(), 2);
+    QCOMPARE(parsed.at(0).address, QStringLiteral("m@example.org"));
+    QCOMPARE(parsed.at(1).address, QStringLiteral("info@example.net"));
+}
+
+void TestComposeContext::aQuotedDisplayNameSurvivesRoundTripping()
+{
+    // A comma in a display name must come back out QUOTED. Unquoted, the
+    // rendered form is not a legal single address: it happens to survive
+    // GMime's own lenient re-parse, but it goes into a To: header that other
+    // clients and MTAs read, and a bare comma there is a recipient separator.
+    //
+    // Asserted on the RENDERED TEXT rather than on a re-parse, and that is the
+    // point of the test: a round-trip through parseAddressHeader() passes
+    // against string-assembled "Rossi, Mario <m@example.org>" because GMime
+    // reads it back as one address anyway. Measured 2026-08-21, a mutation
+    // replacing the GMime rendering with `name + " <" + addr + ">"` left the
+    // whole suite green until this assertion was written this way.
+    const QList<Recipient> parsed = ComposeContextBuilder::parseAddressHeader(
+        QStringLiteral("\"Rossi, Mario\" <m@example.org>"));
+    QCOMPARE(parsed.size(), 1);
+    QCOMPARE(parsed.at(0).rendered,
+             QStringLiteral("\"Rossi, Mario\" <m@example.org>"));
+
+    // And it still re-parses to the same one address.
+    const QList<Recipient> again =
+        ComposeContextBuilder::parseAddressHeader(parsed.at(0).rendered);
+    QCOMPARE(again.size(), 1);
+    QCOMPARE(again.at(0).address, QStringLiteral("m@example.org"));
+}
+
+void TestComposeContext::aMalformedHeaderYieldsNoRecipients()
+{
+    // GMime returns NULL rather than an empty list for input it can make
+    // nothing of. Measured 2026-08-21: "not an address at all" and "<<<>>>"
+    // both return NULL.
+    QVERIFY(ComposeContextBuilder::parseAddressHeader(
+                QStringLiteral("not an address at all")).isEmpty());
+    QVERIFY(ComposeContextBuilder::parseAddressHeader(
+                QStringLiteral("<<<>>>")).isEmpty());
+}
+
+void TestComposeContext::anEmptyHeaderYieldsNoRecipients()
+{
+    QVERIFY(ComposeContextBuilder::parseAddressHeader(QString()).isEmpty());
+    QVERIFY(ComposeContextBuilder::parseAddressHeader(
+                QStringLiteral("   ")).isEmpty());
+}
+
+void TestComposeContext::aGroupContributesNoRecipient()
+{
+    // A group has a name and no mailbox. Carrying its name forward would put
+    // "undisclosed-recipients" in a To field as though it were a person.
+    const QList<Recipient> parsed = ComposeContextBuilder::parseAddressHeader(
+        QStringLiteral("undisclosed-recipients:;"));
+    QVERIFY2(parsed.isEmpty(),
+             qPrintable(QStringLiteral("a group produced %1 recipient(s)")
+                            .arg(parsed.size())));
+}
+
+void TestComposeContext::aGroupIsDroppedByTheGuardAndNotByAFailedCast()
+{
+    // The count alone cannot see this, which is why the guard survived a
+    // mutation until 2026-08-21. Removing the INTERNET_ADDRESS_IS_MAILBOX check
+    // still yields no recipients, because the invalid cast makes GMime's own
+    // assertion return NULL and the address is skipped one line later. The
+    // count is therefore right for the wrong reason, and the reason matters: an
+    // invalid GObject cast is undefined behaviour papered over by an assertion
+    // that G_DISABLE_CHECKS compiles out and that G_DEBUG=fatal-criticals turns
+    // into an abort. A security property must not rest on assertions staying
+    // enabled.
+    //
+    // So this asserts on the CRITICAL rather than on the count. glib routes it
+    // through the log handler installed here, and a clean parse emits none.
+    struct Captured
+    {
+        static void handler(const gchar *domain, GLogLevelFlags level,
+                            const gchar *messageText, gpointer userData)
+        {
+            Q_UNUSED(domain);
+            Q_UNUSED(level);
+            auto *messages = static_cast<QStringList *>(userData);
+            messages->append(QString::fromUtf8(messageText));
+        }
+    };
+
+    // Registered per DOMAIN, and the domain is the trap: the two criticals this
+    // watches for carry "GLib-GObject" and "gmime", while a NULL domain
+    // registers only for the default one. A handler on nullptr alone catches
+    // NOTHING here and the test passes against the mutation, measured
+    // 2026-08-21.
+    QStringList criticals;
+    const auto levels = GLogLevelFlags(G_LOG_LEVEL_CRITICAL | G_LOG_LEVEL_WARNING
+                                       | G_LOG_FLAG_FATAL | G_LOG_FLAG_RECURSION);
+    QList<guint> handlerIds;
+    for (const char *domain : { "GLib-GObject", "gmime" })
+        handlerIds.append(g_log_set_handler(domain, levels, &Captured::handler, &criticals));
+
+    // A group carrying MEMBERS, not the empty "undisclosed-recipients:;". The
+    // empty form has nothing to cast, so it cannot tell the two paths apart.
+    const QList<Recipient> parsed = ComposeContextBuilder::parseAddressHeader(
+        QStringLiteral("friends: a@example.org, b@example.net;"));
+
+    int i = 0;
+    for (const char *domain : { "GLib-GObject", "gmime" })
+        g_log_remove_handler(domain, handlerIds.at(i++));
+
+    QVERIFY2(parsed.isEmpty(),
+             qPrintable(QStringLiteral("a group with members produced %1 recipient(s)")
+                            .arg(parsed.size())));
+    QVERIFY2(criticals.isEmpty(),
+             qPrintable(QStringLiteral("GMime emitted %1 during the parse: %2")
+                            .arg(criticals.size())
+                            .arg(criticals.join(QLatin1Char('|')))));
+}
+
+void TestComposeContext::anInjectedHeaderLineIsNotCarriedForward()
+{
+    // Header injection, from a stranger's message into the user's reply.
+    // Measured 2026-08-21: GMime parses the smuggled line as a GROUP named
+    // "Bcc", so dropping non-mailboxes drops it. If groups were kept, a reply
+    // would silently pre-fill a recipient the user never saw.
+    const QList<Recipient> parsed = ComposeContextBuilder::parseAddressHeader(
+        QStringLiteral("a@example.org\nBcc: evil@example.net"));
+
+    QCOMPARE(parsed.size(), 1);
+    QCOMPARE(parsed.at(0).address, QStringLiteral("a@example.org"));
+    for (const Recipient &recipient : parsed) {
+        QVERIFY2(!recipient.rendered.contains(QStringLiteral("evil@example.net")),
+                 qPrintable(QStringLiteral("injected address survived in: %1")
+                                .arg(recipient.rendered)));
+    }
+
+    // The other injection shape: the newline hidden INSIDE a quoted display
+    // name, where it does not split the header and so is not dropped as a
+    // group. It has to come back RFC 2047 encoded, never as a raw newline: a
+    // bare CR or LF in a rendered recipient is a header-injection primitive
+    // the moment anything writes it into a To: line. Rendering by hand rather
+    // than through GMime is what loses the encoding.
+    const QList<Recipient> inName = ComposeContextBuilder::parseAddressHeader(
+        QStringLiteral("\"foo\nBcc: evil@example.net\" <a@example.org>"));
+    QCOMPARE(inName.size(), 1);
+    QCOMPARE(inName.at(0).address, QStringLiteral("a@example.org"));
+    QVERIFY2(!inName.at(0).rendered.contains(QLatin1Char('\n'))
+                 && !inName.at(0).rendered.contains(QLatin1Char('\r')),
+             qPrintable(QStringLiteral("a raw newline survived into a rendered "
+                                       "recipient: %1")
+                            .arg(inName.at(0).rendered)));
+}
+
+// ---------------------------------------------------------------------------
+// Reply and reply-all
+// ---------------------------------------------------------------------------
+
+void TestComposeContext::aPlainReplyGoesToTheSenderOnly()
+{
+    ParsedMessage message;
+    message.from = QStringLiteral("Sender <sender@example.org>");
+    message.to = QStringLiteral("me@example.org, other@example.net");
+    message.cc = QStringLiteral("third@example.com");
+
+    QStringList to;
+    QStringList cc;
+    ComposeContextBuilder::recipientsForReply(
+        message, /*replyAll=*/false, { QStringLiteral("me@example.org") }, &to, &cc);
+
+    QCOMPARE(to.size(), 1);
+    QVERIFY2(to.at(0).contains(QStringLiteral("sender@example.org")),
+             qPrintable(QStringLiteral("To was %1").arg(to.join(QLatin1Char('|')))));
+    QVERIFY2(cc.isEmpty(),
+             qPrintable(QStringLiteral("a plain reply put %1 in Cc")
+                            .arg(cc.join(QLatin1Char('|')))));
+}
+
+void TestComposeContext::aReplyPrefersReplyToOverFrom()
+{
+    // RFC 5322 3.6.2: Reply-To names where the author wants replies sent. This
+    // is what makes a list reply land on the list rather than on a person who
+    // never asked to be written to directly.
+    ParsedMessage message;
+    message.from = QStringLiteral("Sender <sender@example.org>");
+    message.replyTo = QStringLiteral("List <list@example.net>");
+
+    QStringList to;
+    QStringList cc;
+    ComposeContextBuilder::recipientsForReply(message, /*replyAll=*/false, {}, &to, &cc);
+
+    QCOMPARE(to.size(), 1);
+    QVERIFY2(to.at(0).contains(QStringLiteral("list@example.net")),
+             qPrintable(QStringLiteral("To was %1, expected the Reply-To")
+                            .arg(to.join(QLatin1Char('|')))));
+    QVERIFY2(!to.at(0).contains(QStringLiteral("sender@example.org")),
+             "From was used despite a Reply-To being present");
+}
+
+void TestComposeContext::aReplyAllPutsTheSenderInToAndTheRestInCc()
+{
+    ParsedMessage message;
+    message.from = QStringLiteral("Sender <sender@example.org>");
+    message.to = QStringLiteral("first@example.net");
+    message.cc = QStringLiteral("second@example.com");
+
+    QStringList to;
+    QStringList cc;
+    ComposeContextBuilder::recipientsForReply(message, /*replyAll=*/true, {}, &to, &cc);
+
+    QCOMPARE(to.size(), 1);
+    QVERIFY(to.at(0).contains(QStringLiteral("sender@example.org")));
+
+    QCOMPARE(cc.size(), 2);
+    QVERIFY2(cc.join(QLatin1Char('|')).contains(QStringLiteral("first@example.net")),
+             qPrintable(QStringLiteral("Cc was %1").arg(cc.join(QLatin1Char('|')))));
+    QVERIFY2(cc.join(QLatin1Char('|')).contains(QStringLiteral("second@example.com")),
+             qPrintable(QStringLiteral("Cc was %1").arg(cc.join(QLatin1Char('|')))));
+}
+
+void TestComposeContext::aReplyAllStripsEveryOwnAddress()
+{
+    // Five accounts, and the user's address appears in the original's To under
+    // THREE of them. Stripping only the first is the exact failure this guards:
+    // the reply-all would then be addressed to the user twice over.
+    ParsedMessage message;
+    message.from = QStringLiteral("Sender <sender@example.org>");
+    message.to = QStringLiteral(
+        "first@example.org, stranger@example.net, third@example.org");
+    message.cc = QStringLiteral("fifth@example.org, another@example.com");
+
+    const QStringList own = { QStringLiteral("first@example.org"),
+                              QStringLiteral("second@example.org"),
+                              QStringLiteral("third@example.org"),
+                              QStringLiteral("fourth@example.org"),
+                              QStringLiteral("fifth@example.org") };
+
+    QStringList to;
+    QStringList cc;
+    ComposeContextBuilder::recipientsForReply(message, /*replyAll=*/true, own, &to, &cc);
+
+    const QString all = (to + cc).join(QLatin1Char('|'));
+    for (const QString &address : own) {
+        QVERIFY2(!all.contains(address, Qt::CaseInsensitive),
+                 qPrintable(QStringLiteral("own address %1 survived in: %2")
+                                .arg(address, all)));
+    }
+    // And the strangers must all still be there: a filter that removed
+    // everything would pass the check above while producing an unsendable reply.
+    QVERIFY2(all.contains(QStringLiteral("stranger@example.net")),
+             qPrintable(QStringLiteral("a stranger was stripped too: %1").arg(all)));
+    QVERIFY2(all.contains(QStringLiteral("another@example.com")),
+             qPrintable(QStringLiteral("a stranger was stripped too: %1").arg(all)));
+    QVERIFY2(all.contains(QStringLiteral("sender@example.org")),
+             qPrintable(QStringLiteral("the sender was stripped: %1").arg(all)));
+}
+
+void TestComposeContext::aReplyAllStripsAnOwnAddressRegardlessOfCase()
+{
+    // A domain is case-insensitive by RFC and real mail varies the local part's
+    // case too. A case-sensitive filter lets the user's own address through and
+    // they receive their own reply.
+    ParsedMessage message;
+    message.from = QStringLiteral("Sender <sender@example.org>");
+    message.to = QStringLiteral("Me@Example.ORG, stranger@example.net");
+
+    QStringList to;
+    QStringList cc;
+    ComposeContextBuilder::recipientsForReply(
+        message, /*replyAll=*/true, { QStringLiteral("me@example.org") }, &to, &cc);
+
+    const QString all = (to + cc).join(QLatin1Char('|'));
+    QVERIFY2(!all.contains(QStringLiteral("Me@Example.ORG"), Qt::CaseInsensitive),
+             qPrintable(QStringLiteral("a differently-cased own address survived: %1")
+                            .arg(all)));
+    QVERIFY(all.contains(QStringLiteral("stranger@example.net")));
+}
+
+void TestComposeContext::aReplyAllDoesNotListTheSenderTwice()
+{
+    // The sender is very often also in their own message's To (a list posting
+    // reflected back). Without cross-field suppression they appear in To AND Cc.
+    ParsedMessage message;
+    message.from = QStringLiteral("Sender <sender@example.org>");
+    message.to = QStringLiteral("sender@example.org, stranger@example.net");
+
+    QStringList to;
+    QStringList cc;
+    ComposeContextBuilder::recipientsForReply(message, /*replyAll=*/true, {}, &to, &cc);
+
+    const QString all = (to + cc).join(QLatin1Char('|'));
+    QCOMPARE(all.count(QStringLiteral("sender@example.org")), 1);
+    QVERIFY(all.contains(QStringLiteral("stranger@example.net")));
+}
+
+void TestComposeContext::aReplyAllSuppressesDuplicatesAcrossToAndCc()
+{
+    // The same address in the original's To and Cc, with different display
+    // names so a whole-string comparison would treat them as distinct.
+    ParsedMessage message;
+    message.from = QStringLiteral("Sender <sender@example.org>");
+    message.to = QStringLiteral("Person One <dup@example.net>");
+    message.cc = QStringLiteral("P. One <dup@example.net>, other@example.com");
+
+    QStringList to;
+    QStringList cc;
+    ComposeContextBuilder::recipientsForReply(message, /*replyAll=*/true, {}, &to, &cc);
+
+    const QString all = (to + cc).join(QLatin1Char('|'));
+    QCOMPARE(all.count(QStringLiteral("dup@example.net")), 1);
+    QVERIFY(all.contains(QStringLiteral("other@example.com")));
+}
+
+void TestComposeContext::aReplyToOneselfStillAddressesSomeone()
+{
+    // Replying to a message the user sent themselves. Stripping own addresses
+    // from a plain Reply's To would leave a message with no recipient that
+    // still looks sendable.
+    ParsedMessage message;
+    message.from = QStringLiteral("Me <me@example.org>");
+    message.to = QStringLiteral("me@example.org");
+
+    QStringList to;
+    QStringList cc;
+    ComposeContextBuilder::recipientsForReply(
+        message, /*replyAll=*/false, { QStringLiteral("me@example.org") }, &to, &cc);
+
+    QVERIFY2(!to.isEmpty(), "a reply to oneself produced no recipient at all");
+    QVERIFY(to.join(QLatin1Char('|')).contains(QStringLiteral("me@example.org")));
+}
+
+void TestComposeContext::aReplyToOwnMessageGoesToItsOriginalRecipients()
+{
+    // The Sent view, and a follow-up on unanswered mail: the user replies to a
+    // message they sent. Addressing the sender there addresses the user, so To
+    // comes from the original's own recipients instead. The Cc entry is
+    // included because a reply to a conversation the user started belongs to
+    // everyone who was on it.
+    ParsedMessage message;
+    message.from = QStringLiteral("Me <me@example.org>");
+    message.to = QStringLiteral("Correspondent <them@example.net>");
+    message.cc = QStringLiteral("watcher@example.com");
+
+    QStringList to;
+    QStringList cc;
+    ComposeContextBuilder::recipientsForReply(
+        message, /*replyAll=*/false, { QStringLiteral("me@example.org") }, &to, &cc);
+
+    const QString joined = to.join(QLatin1Char('|'));
+    QVERIFY2(joined.contains(QStringLiteral("them@example.net")),
+             qPrintable(QStringLiteral("To was %1").arg(joined)));
+    QVERIFY2(joined.contains(QStringLiteral("watcher@example.com")),
+             qPrintable(QStringLiteral("To was %1").arg(joined)));
+    // The whole point: the user is not written back to themselves.
+    QVERIFY2(!joined.contains(QStringLiteral("me@example.org")),
+             qPrintable(QStringLiteral("the reply addressed the user: %1").arg(joined)));
+    QVERIFY2(cc.isEmpty(), "a plain reply produced a Cc");
+}
+
+void TestComposeContext::aReplyAllToOwnMessageDoesNotRepeatToInCc()
+{
+    // Reply-all to your own message MIRRORS the original's split: its To
+    // becomes To, its Cc becomes Cc. The split is the message's meaning, To
+    // being "addressed to you" and Cc "for information", and promoting a Cc'd
+    // party to To is visible to every recipient.
+    //
+    // Asserted per FIELD, not on the union. A test counting each address once
+    // across to + cc passes whether the split is preserved or collapsed, which
+    // is how the collapse shipped and survived its first mutation check.
+    ParsedMessage message;
+    message.from = QStringLiteral("Me <me@example.org>");
+    message.to = QStringLiteral("them@example.net");
+    message.cc = QStringLiteral("watcher@example.com");
+
+    QStringList to;
+    QStringList cc;
+    ComposeContextBuilder::recipientsForReply(
+        message, /*replyAll=*/true, { QStringLiteral("me@example.org") }, &to, &cc);
+
+    const QString toJoined = to.join(QLatin1Char('|'));
+    const QString ccJoined = cc.join(QLatin1Char('|'));
+    QVERIFY2(toJoined.contains(QStringLiteral("them@example.net")),
+             qPrintable(QStringLiteral("To was %1").arg(toJoined)));
+    QVERIFY2(!toJoined.contains(QStringLiteral("watcher@example.com")),
+             qPrintable(QStringLiteral("a Cc recipient was promoted to To: %1").arg(toJoined)));
+    QVERIFY2(ccJoined.contains(QStringLiteral("watcher@example.com")),
+             qPrintable(QStringLiteral("Cc was %1").arg(ccJoined)));
+    QVERIFY2(!ccJoined.contains(QStringLiteral("them@example.net")),
+             qPrintable(QStringLiteral("the To address repeated in Cc: %1").arg(ccJoined)));
+    // The whole point of the self-reply rule.
+    QVERIFY2(!(toJoined + ccJoined).contains(QStringLiteral("me@example.org")),
+             "the reply addressed the user");
+}
+
+void TestComposeContext::aCoSenderIsStillRepliedTo()
+{
+    // A message the user sent WITH somebody else is not a message to oneself.
+    // Only an all-own sender diverts To to the original recipients; here the
+    // co-sender is a real person expecting the reply.
+    ParsedMessage message;
+    message.from = QStringLiteral("Me <me@example.org>, Other <other@example.net>");
+    message.to = QStringLiteral("them@example.com");
+
+    QStringList to;
+    QStringList cc;
+    ComposeContextBuilder::recipientsForReply(
+        message, /*replyAll=*/false, { QStringLiteral("me@example.org") }, &to, &cc);
+
+    const QString joined = to.join(QLatin1Char('|'));
+    QVERIFY2(joined.contains(QStringLiteral("other@example.net")),
+             qPrintable(QStringLiteral("To was %1").arg(joined)));
+    QVERIFY2(!joined.contains(QStringLiteral("them@example.com")),
+             qPrintable(QStringLiteral("a plain reply reached the original's To: %1")
+                            .arg(joined)));
+}
+
+void TestComposeContext::anUnparseableSenderStillProducesARecipient()
+{
+    // "From: Mailer Daemon" is a bare display name with no angle brackets, which
+    // is what bounces and some automated senders emit. It parses to ZERO
+    // mailboxes, so the sender contributes nothing and To would otherwise come
+    // out empty.
+    //
+    // An empty To is the worst outcome available here, because MessageBuilder
+    // treats an empty recipient list as success: the message reaches the send
+    // command with nobody to deliver to and a copy is filed in Sent that looks
+    // sent and reached no one. The original's own recipients are the remaining
+    // candidates.
+    ParsedMessage message;
+    message.from = QStringLiteral("Mailer Daemon");
+    message.to = QStringLiteral("them@example.net");
+    message.cc = QStringLiteral("watcher@example.com");
+
+    QStringList to;
+    QStringList cc;
+    ComposeContextBuilder::recipientsForReply(
+        message, /*replyAll=*/false, { QStringLiteral("me@example.org") }, &to, &cc);
+
+    QVERIFY2(!to.isEmpty(), "an unparseable sender produced a reply with no recipient");
+    QVERIFY2(to.join(QLatin1Char('|')).contains(QStringLiteral("them@example.net")),
+             qPrintable(QStringLiteral("To was %1").arg(to.join(QLatin1Char('|')))));
+
+    // Reply-all is the worse half: without the fallback it puts every recipient
+    // in Cc and leaves To empty, which is a message addressed to nobody.
+    QStringList allTo;
+    QStringList allCc;
+    ComposeContextBuilder::recipientsForReply(
+        message, /*replyAll=*/true, { QStringLiteral("me@example.org") }, &allTo, &allCc);
+    QVERIFY2(!allTo.isEmpty(), "a reply-all to an unparseable sender left To empty");
+}
+
+void TestComposeContext::aReplyAllPrefersReplyToForTheToField()
+{
+    // Reply-To precedence is not a plain-Reply-only rule: a list's reply-all
+    // must also go to the list rather than to the individual poster.
+    ParsedMessage message;
+    message.from = QStringLiteral("Poster <poster@example.org>");
+    message.replyTo = QStringLiteral("List <list@example.net>");
+    message.to = QStringLiteral("list@example.net");
+    message.cc = QStringLiteral("watcher@example.com");
+
+    QStringList to;
+    QStringList cc;
+    ComposeContextBuilder::recipientsForReply(message, /*replyAll=*/true, {}, &to, &cc);
+
+    QCOMPARE(to.size(), 1);
+    QVERIFY2(to.at(0).contains(QStringLiteral("list@example.net")),
+             qPrintable(QStringLiteral("To was %1").arg(to.join(QLatin1Char('|')))));
+    // The list is in To, so it must not repeat in Cc even though the original's
+    // To named it.
+    QVERIFY2(!cc.join(QLatin1Char('|')).contains(QStringLiteral("list@example.net")),
+             qPrintable(QStringLiteral("the To address repeated in Cc: %1")
+                            .arg(cc.join(QLatin1Char('|')))));
+    QVERIFY(cc.join(QLatin1Char('|')).contains(QStringLiteral("watcher@example.com")));
+}
+
+void TestComposeContext::aDisplayNameContainingAnOwnAddressIsNotMistakenForIt()
+{
+    // A stranger whose DISPLAY NAME quotes the user's address. Comparing the
+    // rendered whole rather than the addr-spec would strip a real recipient,
+    // and the reply would silently not reach them.
+    ParsedMessage message;
+    message.from = QStringLiteral("Sender <sender@example.org>");
+    message.to = QStringLiteral("\"about me@example.org\" <stranger@example.net>");
+
+    QStringList to;
+    QStringList cc;
+    ComposeContextBuilder::recipientsForReply(
+        message, /*replyAll=*/true, { QStringLiteral("me@example.org") }, &to, &cc);
+
+    QVERIFY2((to + cc).join(QLatin1Char('|')).contains(QStringLiteral("stranger@example.net")),
+             "a stranger was stripped because their display name quoted an own address");
+}
+
+// ---------------------------------------------------------------------------
+// References
+// ---------------------------------------------------------------------------
+
+void TestComposeContext::referencesCarryTheOriginalChainPlusItsId()
+{
+    ParsedMessage message;
+    message.messageId = QStringLiteral("current@example.org");
+    message.references =
+        QStringLiteral("<first@example.org> <second@example.org>");
+
+    const QStringList refs = ComposeContextBuilder::referencesForReply(message);
+
+    QCOMPARE(refs.size(), 3);
+    QCOMPARE(refs.at(0), QStringLiteral("first@example.org"));
+    QCOMPARE(refs.at(1), QStringLiteral("second@example.org"));
+    QCOMPARE(refs.at(2), QStringLiteral("current@example.org"));
+}
+
+void TestComposeContext::referencesDoNotRepeatTheMessageId()
+{
+    ParsedMessage message;
+    message.messageId = QStringLiteral("current@example.org");
+    message.references = QStringLiteral("<first@example.org> <current@example.org>");
+
+    const QStringList refs = ComposeContextBuilder::referencesForReply(message);
+
+    QCOMPARE(refs.count(QStringLiteral("current@example.org")), 1);
+    QCOMPARE(refs.last(), QStringLiteral("current@example.org"));
+}
+
+// ---------------------------------------------------------------------------
+// Subjects
+// ---------------------------------------------------------------------------
+
+void TestComposeContext::aCommaSeparatedReferencesHeaderIsSplitIntoIds()
+{
+    // `<a@x>,<b@y>` is not conformant, RFC 5322 has no comma here, but some
+    // clients emit it. Splitting on whitespace alone makes that whole header ONE
+    // token, and stripping its outer brackets then yields the fabricated id
+    // `a@x>,<b@y`, which is sent to the recipient as a Message-ID reference. A
+    // comma cannot occur inside a msg-id, so accepting it as a separator is free.
+    ParsedMessage message;
+    message.references = QStringLiteral("<first@example.org>,<second@example.org>");
+    message.messageId = QStringLiteral("current@example.org");
+
+    const QStringList refs = ComposeContextBuilder::referencesForReply(message);
+
+    QCOMPARE(refs.size(), 3);
+    QCOMPARE(refs.at(0), QStringLiteral("first@example.org"));
+    QCOMPARE(refs.at(1), QStringLiteral("second@example.org"));
+    QCOMPARE(refs.at(2), QStringLiteral("current@example.org"));
+}
+
+void TestComposeContext::aReplySubjectDoesNotDoubleItsPrefix()
+{
+    QCOMPARE(ComposeContextBuilder::replySubject(QStringLiteral("Hello")),
+             QStringLiteral("Re: Hello"));
+    QCOMPARE(ComposeContextBuilder::replySubject(QStringLiteral("Re: Hello")),
+             QStringLiteral("Re: Hello"));
+    // Case and spacing vary between clients and neither justifies a second
+    // prefix. "RE:" from Outlook is the common one.
+    QCOMPARE(ComposeContextBuilder::replySubject(QStringLiteral("RE: Hello")),
+             QStringLiteral("RE: Hello"));
+    QCOMPARE(ComposeContextBuilder::replySubject(QStringLiteral("re:Hello")),
+             QStringLiteral("re:Hello"));
+}
+
+void TestComposeContext::aForwardSubjectDoesNotDoubleItsPrefix()
+{
+    QCOMPARE(ComposeContextBuilder::forwardSubject(QStringLiteral("Hello")),
+             QStringLiteral("Fwd: Hello"));
+    QCOMPARE(ComposeContextBuilder::forwardSubject(QStringLiteral("Fwd: Hello")),
+             QStringLiteral("Fwd: Hello"));
+    // "Fw:" is the other common spelling and means the same thing.
+    QCOMPARE(ComposeContextBuilder::forwardSubject(QStringLiteral("Fw: Hello")),
+             QStringLiteral("Fw: Hello"));
+}
+
+void TestComposeContext::anEmptySubjectStillGetsAPrefix()
+{
+    // A reply to a subjectless message is still a reply. "Re: " alone is
+    // correct and is what every other client produces.
+    QCOMPARE(ComposeContextBuilder::replySubject(QString()),
+             QStringLiteral("Re: "));
+}
+
+void TestComposeContext::aSubjectMentioningReLaterStillGetsAPrefix()
+{
+    // The prefix test is ANCHORED. An unanchored search would see "re:" inside
+    // an ordinary subject and refuse to prefix a genuine first reply, which
+    // breaks threading in the recipient's client.
+    QCOMPARE(ComposeContextBuilder::replySubject(QStringLiteral("Notes re: budget")),
+             QStringLiteral("Re: Notes re: budget"));
+    QCOMPARE(ComposeContextBuilder::forwardSubject(QStringLiteral("Notes fwd: budget")),
+             QStringLiteral("Fwd: Notes fwd: budget"));
+}
+
+void TestComposeContext::aNonEnglishPrefixIsNotDoubled()
+{
+    // A mixed-locale mailbox, which this one is. An English-only pattern turns
+    // every one of these into "Re: AW: subject", and the round after that into
+    // "Re: Re: AW:".
+    QCOMPARE(ComposeContextBuilder::replySubject(QStringLiteral("AW: Angebot")),
+             QStringLiteral("AW: Angebot"));
+    QCOMPARE(ComposeContextBuilder::replySubject(QStringLiteral("SV: innkalling")),
+             QStringLiteral("SV: innkalling"));
+    QCOMPARE(ComposeContextBuilder::replySubject(QStringLiteral("RES: pedido")),
+             QStringLiteral("RES: pedido"));
+    QCOMPARE(ComposeContextBuilder::forwardSubject(QStringLiteral("WG: Angebot")),
+             QStringLiteral("WG: Angebot"));
+    QCOMPARE(ComposeContextBuilder::forwardSubject(QStringLiteral("TR: document")),
+             QStringLiteral("TR: document"));
+}
+
+void TestComposeContext::aCountedPrefixIsNotDoubled()
+{
+    // Outlook and some list managers count the rounds. Same meaning, and
+    // prefixing again produces "Re: Re[2]:".
+    QCOMPARE(ComposeContextBuilder::replySubject(QStringLiteral("Re[2]: thread")),
+             QStringLiteral("Re[2]: thread"));
+    QCOMPARE(ComposeContextBuilder::replySubject(QStringLiteral("Re(3): thread")),
+             QStringLiteral("Re(3): thread"));
+}
+
+void TestComposeContext::aSingleLetterBeforeAColonIsNotAPrefix()
+{
+    // Italian clients do send "R:" and "I:", and they are deliberately NOT
+    // recognised. Measured 2026-08-21: with them in the pattern, "R: report on
+    // Q3" reads as an existing prefix, so a genuine FIRST reply gets no "Re:"
+    // and threads nowhere in the recipient's client, with nothing wrong to see
+    // locally. A doubled "Re: R:" is cosmetic; broken threading is not.
+    //
+    // "F:" is here for the same reason: the pattern was once `fwd?`, which
+    // matched it.
+    QCOMPARE(ComposeContextBuilder::replySubject(QStringLiteral("R: report on Q3")),
+             QStringLiteral("Re: R: report on Q3"));
+    QCOMPARE(ComposeContextBuilder::forwardSubject(QStringLiteral("I: notes")),
+             QStringLiteral("Fwd: I: notes"));
+    QCOMPARE(ComposeContextBuilder::forwardSubject(QStringLiteral("F: results")),
+             QStringLiteral("Fwd: F: results"));
+}
+
+// ---------------------------------------------------------------------------
+// Account resolution
+// ---------------------------------------------------------------------------
+
+void TestComposeContext::theReplyAccountComesFromTheMessagesMaildir()
+{
+    // The dropdown is NOT consulted: replying from the All accounts view to a
+    // message that arrived at account B sends from B.
+    const QString path = writeConfig(QStringLiteral(
+        "[account.work]\nmaildir=work\ntrash=Trash\naddress=work@example.org\n"
+        "send_command=/bin/true\n"
+        "[account.home]\nmaildir=home\ntrash=Trash\naddress=home@example.org\n"
+        "send_command=/bin/true\n"));
+    QVERIFY(!path.isEmpty());
+
+    Config config;
+    config.load(path);
+    QCOMPARE(config.accounts().size(), 2);
+
+    const QString account = ComposeContextBuilder::accountForReply(
+        config, { QStringLiteral("/mail/home/INBOX/cur/123") },
+        { QStringLiteral("home@example.org") }, QStringLiteral("/mail"));
+
+    QCOMPARE(account, QStringLiteral("home"));
+}
+
+void TestComposeContext::anAccountIsNotMatchedByAPrefixOfItsMaildir()
+{
+    // "work" must not claim a message living in "work-archive". Without the
+    // separator in the comparison it does, and the reply is sent from the
+    // wrong account.
+    //
+    // The account KEYS are chosen so the wrong answer is reached FIRST.
+    // Config builds its list from QSettings::childGroups(), which returns
+    // groups ALPHABETICALLY rather than in file order, so the section order
+    // here decides nothing and only the keys do. With "archive" before "work"
+    // the loop happens upon the correct account before it can mismatch, and
+    // the test passes against the bug: measured, a mutation dropping the
+    // separator left the suite fully green. "a-work" (maildir "work") sorts
+    // before "b-archive" (maildir "work-archive") and puts the prefix
+    // candidate first, where a textual comparison matches it.
+    const QString path = writeConfig(QStringLiteral(
+        "[account.a-work]\nmaildir=work\ntrash=Trash\naddress=work@example.org\n"
+        "send_command=/bin/true\n"
+        "[account.b-archive]\nmaildir=work-archive\ntrash=Trash\n"
+        "address=archive@example.org\nsend_command=/bin/true\n"));
+    Config config;
+    config.load(path);
+    QCOMPARE(config.accounts().size(), 2);
+    // The ordering the mutation depends on, asserted rather than assumed: if
+    // Config ever sorts differently this test silently stops testing anything.
+    QCOMPARE(config.accounts().at(0).key, QStringLiteral("a-work"));
+
+    const QString account = ComposeContextBuilder::accountForReply(
+        config, { QStringLiteral("/mail/work-archive/INBOX/cur/1") },
+        {}, QStringLiteral("/mail"));
+
+    QCOMPARE(account, QStringLiteral("b-archive"));
+}
+
+void TestComposeContext::anAmbiguousMessagePrefersTheMatchingRecipient()
+{
+    // One message, two maildirs: on a list twice under two addresses. The
+    // recipient headers are the tiebreak.
+    const QString path = writeConfig(QStringLiteral(
+        "[account.work]\nmaildir=work\ntrash=Trash\naddress=work@example.org\n"
+        "send_command=/bin/true\n"
+        "[account.home]\nmaildir=home\ntrash=Trash\naddress=home@example.org\n"
+        "send_command=/bin/true\n"));
+    QVERIFY(!path.isEmpty());
+
+    Config config;
+    config.load(path);
+
+    const QString account = ComposeContextBuilder::accountForReply(
+        config,
+        { QStringLiteral("/mail/work/Lists/cur/1"),
+          QStringLiteral("/mail/home/Lists/cur/1") },
+        { QStringLiteral("home@example.org") }, QStringLiteral("/mail"));
+
+    QCOMPARE(account, QStringLiteral("home"));
+}
+
+void TestComposeContext::anAmbiguousMessageWithNoMatchTakesTheFirst()
+{
+    // Arbitrary, and deliberately so: the From field shows the choice, which
+    // makes an arbitrary resolution visible rather than hidden.
+    const QString path = writeConfig(QStringLiteral(
+        "[account.work]\nmaildir=work\ntrash=Trash\naddress=work@example.org\n"
+        "send_command=/bin/true\n"
+        "[account.home]\nmaildir=home\ntrash=Trash\naddress=home@example.org\n"
+        "send_command=/bin/true\n"));
+    Config config;
+    config.load(path);
+
+    const QString account = ComposeContextBuilder::accountForReply(
+        config,
+        { QStringLiteral("/mail/work/Lists/cur/1"),
+          QStringLiteral("/mail/home/Lists/cur/1") },
+        { QStringLiteral("someone-else@example.org") }, QStringLiteral("/mail"));
+
+    QVERIFY2(!account.isEmpty(), "an ambiguous message resolved to no account");
+    QCOMPARE(account, QStringLiteral("work"));
+}
+
+void TestComposeContext::aNewMessagePrefersTheSelectedAccount()
+{
+    const QString path = writeConfig(QStringLiteral(
+        "[account.work]\nmaildir=work\ntrash=Trash\nsend_command=/bin/true\n"
+        "[account.home]\nmaildir=home\ntrash=Trash\nsend_command=/bin/true\n"));
+    Config config;
+    config.load(path);
+    QCOMPARE(config.accounts().size(), 2);
+
+    QCOMPARE(ComposeContextBuilder::accountForNew(config, QStringLiteral("home")),
+             QStringLiteral("home"));
+}
+
+void TestComposeContext::aNewMessageFallsThroughASelectedAccountThatCannotSend()
+{
+    // Rule 1 requires the selected account CAN send. Viewing a receive-only
+    // account and pressing compose must produce a working composer from
+    // another account, not a broken one from this.
+    const QString path = writeConfig(QStringLiteral(
+        "[account.listsonly]\nmaildir=listsonly\ntrash=Trash\n"
+        "[account.work]\nmaildir=work\ntrash=Trash\nsend_command=/bin/true\n"));
+    Config config;
+    config.load(path);
+    QCOMPARE(config.accounts().size(), 2);
+
+    QCOMPARE(ComposeContextBuilder::accountForNew(config, QStringLiteral("listsonly")),
+             QStringLiteral("work"));
+}
+
+void TestComposeContext::aNewMessageUsesDefaultAccountFromAllAccounts()
+{
+    // The All accounts view has no selected account and falls through to rule 2.
+    //
+    // The named account must NOT also be what rule 4 would answer, or the test
+    // passes with rule 2 deleted outright: measured, a mutation removing it
+    // left the suite green because the account list is ALPHABETICAL (Config
+    // builds it from QSettings::childGroups()) and the section order in this
+    // string decides nothing. "zeta" sorts last, so rule 4 would answer
+    // "alpha" and only rule 2 can produce "zeta".
+    const QString path = writeConfig(QStringLiteral(
+        "[account.alpha]\nmaildir=alpha\ntrash=Trash\nsend_command=/bin/true\n"
+        "[account.zeta]\nmaildir=zeta\ntrash=Trash\nsend_command=/bin/true\n"
+        "[compose]\ndefault_account=zeta\n"));
+    Config config;
+    config.load(path);
+    QCOMPARE(config.compose().defaultAccount, QStringLiteral("zeta"));
+    // Asserted rather than assumed, so the test stops silently proving nothing
+    // if Config ever changes its ordering.
+    QCOMPARE(config.sendingAccounts().first().key, QStringLiteral("alpha"));
+
+    QCOMPARE(ComposeContextBuilder::accountForNew(config, QString()),
+             QStringLiteral("zeta"));
+}
+
+void TestComposeContext::aNewMessageUsesStartupAccountWhenNoDefaultIsSet()
+{
+    // Rule 3. Same ordering trap as rule 2: "zeta" must not be what rule 4
+    // would answer, or a test for this rule passes with the rule deleted.
+    const QString path = writeConfig(QStringLiteral(
+        "[general]\nstartup_account=zeta\n"
+        "[account.alpha]\nmaildir=alpha\ntrash=Trash\nsend_command=/bin/true\n"
+        "[account.zeta]\nmaildir=zeta\ntrash=Trash\nsend_command=/bin/true\n"));
+    Config config;
+    config.load(path);
+    QCOMPARE(config.startupAccount(), QStringLiteral("zeta"));
+    QVERIFY(config.compose().defaultAccount.isEmpty());
+    QCOMPARE(config.sendingAccounts().first().key, QStringLiteral("alpha"));
+
+    QCOMPARE(ComposeContextBuilder::accountForNew(config, QString()),
+             QStringLiteral("zeta"));
+}
+
+void TestComposeContext::aNewMessageFallsBackToTheFirstSendingAccount()
+{
+    // Rule 4, arbitrary, and the reason rules 2 and 3 exist. The receive-only
+    // account is FIRST, so "the first account" and "the first sending account"
+    // are different answers and the test distinguishes them.
+    const QString path = writeConfig(QStringLiteral(
+        "[account.listsonly]\nmaildir=listsonly\ntrash=Trash\n"
+        "[account.work]\nmaildir=work\ntrash=Trash\nsend_command=/bin/true\n"));
+    Config config;
+    config.load(path);
+    QCOMPARE(config.accounts().size(), 2);
+
+    QCOMPARE(ComposeContextBuilder::accountForNew(config, QString()),
+             QStringLiteral("work"));
+}
+
+void TestComposeContext::aNewMessageReturnsNothingWhenNoAccountCanSend()
+{
+    // A valid read-only installation. The compose action is disabled, so this
+    // should be unreachable, and returning empty rather than a random account
+    // is what makes a mistake visible instead of silent.
+    const QString path = writeConfig(QStringLiteral(
+        "[account.listsonly]\nmaildir=listsonly\ntrash=Trash\n"));
+    Config config;
+    config.load(path);
+    QCOMPARE(config.accounts().size(), 1);
+
+    QVERIFY(ComposeContextBuilder::accountForNew(config, QString()).isEmpty());
+}
+
+// ---------------------------------------------------------------------------
+// Quoting
+// ---------------------------------------------------------------------------
+
+void TestComposeContext::aQuotedBodyPrefixesEveryLine()
+{
+    ParsedMessage message;
+    message.from = QStringLiteral("Sender <sender@example.org>");
+    message.date = QStringLiteral("Thu, 20 Aug 2026 10:00:00 +0200");
+    message.plainBody = QStringLiteral("first line\nsecond line\n\nafter a blank");
+
+    const QString quoted = ComposeContextBuilder::quoteBody(message);
+
+    QVERIFY2(quoted.contains(QStringLiteral("> first line")),
+             qPrintable(QStringLiteral("first line not quoted:\n%1").arg(quoted)));
+    QVERIFY2(quoted.contains(QStringLiteral("> second line")),
+             "second line not quoted");
+    // A blank line inside a quote must still carry the marker, or the quote
+    // visually ends there in every client that renders it.
+    QVERIFY2(quoted.contains(QStringLiteral("\n>\n")),
+             qPrintable(QStringLiteral("a blank line lost its marker:\n%1").arg(quoted)));
+    QVERIFY2(quoted.contains(QStringLiteral("sender@example.org")),
+             "no attribution line naming the sender");
+    // A CRLF body must not leave a stray carriage return before every marker.
+    ParsedMessage crlf;
+    crlf.plainBody = QStringLiteral("one\r\ntwo");
+    const QString quotedCrlf = ComposeContextBuilder::quoteBody(crlf);
+    QVERIFY2(!quotedCrlf.contains(QLatin1Char('\r')),
+             qPrintable(QStringLiteral("a carriage return survived quoting: %1")
+                            .arg(quotedCrlf)));
+}
+
+QTEST_MAIN(TestComposeContext)
+#include "test_composecontext.moc"