diff --git a/internal/adapters/nylas/calendars_events.go b/internal/adapters/nylas/calendars_events.go
index 681e7b4..fc737e4 100644
--- a/internal/adapters/nylas/calendars_events.go
+++ b/internal/adapters/nylas/calendars_events.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"net/http"
 	"net/url"
+	"strings"
 
 	"github.com/nylas/cli/internal/domain"
 )
@@ -25,6 +26,12 @@ func (c *HTTPClient) GetEvents(ctx context.Context, grantID, calendarID string,
 
 // GetEventsWithCursor retrieves events with pagination cursor support.
 func (c *HTTPClient) GetEventsWithCursor(ctx context.Context, grantID, calendarID string, params *domain.EventQueryParams) (*domain.EventListResponse, error) {
+	if err := validateRequired("grant ID", grantID); err != nil {
+		return nil, err
+	}
+	if err := validateRequired("calendar ID", calendarID); err != nil {
+		return nil, err
+	}
 	if params == nil {
 		params = &domain.EventQueryParams{Limit: 10}
 	}
@@ -45,6 +52,7 @@ func (c *HTTPClient) GetEventsWithCursor(ctx context.Context, grantID, calendarI
 		AddBool("expand_recurring", params.ExpandRecurring).
 		AddBoolPtr("busy", params.Busy).
 		Add("order_by", params.OrderBy).
+		Add("ical_uid", params.ICalUID).
 		BuildURL(baseURL)
 
 	var result struct {
@@ -201,13 +209,46 @@ func (c *HTTPClient) DeleteEvent(ctx context.Context, grantID, calendarID, event
 	return c.doDelete(ctx, queryURL)
 }
 
+// rsvpCommentMaxBytes caps the free-form RSVP comment forwarded to Nylas.
+// Defense-in-depth alongside the Air handler's own 1024-byte cap: any
+// future caller (CLI, SDK consumer) gets the same protection without
+// having to re-implement the rule.
+const rsvpCommentMaxBytes = 1024
+
 // SendRSVP sends an RSVP response to an event invitation.
+//
+// Validation errors are wrapped in domain.ErrInvalidInput so callers can
+// classify them with errors.Is — matches the rest of this client.
 func (c *HTTPClient) SendRSVP(ctx context.Context, grantID, calendarID, eventID string, req *domain.SendRSVPRequest) error {
+	if err := validateRequired("grant ID", grantID); err != nil {
+		return err
+	}
+	if err := validateRequired("calendar ID", calendarID); err != nil {
+		return err
+	}
+	if err := validateRequired("event ID", eventID); err != nil {
+		return err
+	}
+	if req == nil {
+		return fmt.Errorf("%w: RSVP request cannot be nil", domain.ErrInvalidInput)
+	}
+	// Normalise so case/whitespace differences from CLI/TUI/SDK callers
+	// don't bypass the allow-list. Nylas itself only accepts lowercase.
+	status := strings.ToLower(strings.TrimSpace(req.Status))
+	switch status {
+	case "yes", "no", "maybe":
+	default:
+		return fmt.Errorf("%w: RSVP status must be one of: yes, no, maybe (got %q)", domain.ErrInvalidInput, req.Status)
+	}
+	if len(req.Comment) > rsvpCommentMaxBytes {
+		return fmt.Errorf("%w: RSVP comment must be %d bytes or fewer", domain.ErrInvalidInput, rsvpCommentMaxBytes)
+	}
+
 	baseURL := fmt.Sprintf("%s/v3/grants/%s/events/%s/send-rsvp", c.baseURL, url.PathEscape(grantID), url.PathEscape(eventID))
 	queryURL := NewQueryBuilder().Add("calendar_id", calendarID).BuildURL(baseURL)
 
 	payload := map[string]any{
-		"status": req.Status,
+		"status": status,
 	}
 	if req.Comment != "" {
 		payload["comment"] = req.Comment
diff --git a/internal/adapters/nylas/calendars_events_rsvp_test.go b/internal/adapters/nylas/calendars_events_rsvp_test.go
index cf149dc..b3020ae 100644
--- a/internal/adapters/nylas/calendars_events_rsvp_test.go
+++ b/internal/adapters/nylas/calendars_events_rsvp_test.go
@@ -6,8 +6,11 @@ package nylas_test
 import (
 	"context"
 	"encoding/json"
+	"errors"
+	"io"
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
 	"time"
 
@@ -179,3 +182,299 @@ func TestHTTPClient_GetAvailability(t *testing.T) {
 		assert.NotNil(t, result)
 	})
 }
+
+// TestHTTPClient_SendRSVP_RejectsEmptyArgs pins the input-validation
+// invariant on SendRSVP. Every other Get/Update method on this client
+// validates required fields up-front; without these checks an empty
+// grantID would form `/v3/grants//events//send-rsvp` and 404 silently
+// upstream — a confusing failure for any future caller (e.g. CLI) that
+// doesn't validate at its own boundary.
+func TestHTTPClient_SendRSVP_RejectsEmptyArgs(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		name       string
+		grantID    string
+		calendarID string
+		eventID    string
+		req        *domain.SendRSVPRequest
+		wantSubstr string
+	}{
+		{
+			name:       "empty grant ID",
+			grantID:    "",
+			calendarID: "cal-1",
+			eventID:    "evt-1",
+			req:        &domain.SendRSVPRequest{Status: "yes"},
+			wantSubstr: "grant ID",
+		},
+		{
+			name:       "empty calendar ID",
+			grantID:    "grant-1",
+			calendarID: "",
+			eventID:    "evt-1",
+			req:        &domain.SendRSVPRequest{Status: "yes"},
+			wantSubstr: "calendar ID",
+		},
+		{
+			name:       "empty event ID",
+			grantID:    "grant-1",
+			calendarID: "cal-1",
+			eventID:    "",
+			req:        &domain.SendRSVPRequest{Status: "yes"},
+			wantSubstr: "event ID",
+		},
+		{
+			name:       "nil request",
+			grantID:    "grant-1",
+			calendarID: "cal-1",
+			eventID:    "evt-1",
+			req:        nil,
+			wantSubstr: "nil",
+		},
+		{
+			name:       "invalid status",
+			grantID:    "grant-1",
+			calendarID: "cal-1",
+			eventID:    "evt-1",
+			req:        &domain.SendRSVPRequest{Status: "bogus"},
+			wantSubstr: "yes, no, maybe",
+		},
+		{
+			name:       "empty status",
+			grantID:    "grant-1",
+			calendarID: "cal-1",
+			eventID:    "evt-1",
+			req:        &domain.SendRSVPRequest{Status: ""},
+			wantSubstr: "yes, no, maybe",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			called := false
+			server := httptest.NewServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {
+				called = true
+			}))
+			defer server.Close()
+
+			client := nylas.NewHTTPClient()
+			client.SetCredentials("client-id", "secret", "api-key")
+			client.SetBaseURL(server.URL)
+
+			err := client.SendRSVP(context.Background(), tc.grantID, tc.calendarID, tc.eventID, tc.req)
+			require.Error(t, err, "validation must fail closed before any HTTP request")
+			assert.Contains(t, strings.ToLower(err.Error()), strings.ToLower(tc.wantSubstr),
+				"error %q must mention %q so callers can diagnose", err.Error(), tc.wantSubstr)
+			assert.False(t, called, "SendRSVP must not issue any HTTP request when validation fails")
+		})
+	}
+}
+
+// TestHTTPClient_SendRSVP_OmitsEmptyComment pins the contract that an
+// empty comment is NOT serialized into the JSON body. Nylas v3 treats a
+// "comment":"" field as a literal empty comment-line, which Gmail then
+// renders as a blank line under the attendee name in the organiser's
+// notification email — visible UX rot from the user's perspective.
+func TestHTTPClient_SendRSVP_OmitsEmptyComment(t *testing.T) {
+	t.Parallel()
+
+	var rawBody string
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// io.ReadAll is required because (a) r.Body is a stream — a
+		// single Read() is not guaranteed to fill the buffer, and (b)
+		// r.ContentLength can be -1 for chunked requests, which would
+		// panic make([]byte, -1).
+		body, _ := io.ReadAll(r.Body)
+		rawBody = string(body)
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer server.Close()
+
+	client := nylas.NewHTTPClient()
+	client.SetCredentials("client-id", "secret", "api-key")
+	client.SetBaseURL(server.URL)
+
+	err := client.SendRSVP(context.Background(), "grant-1", "cal-1", "evt-1", &domain.SendRSVPRequest{
+		Status: "yes",
+	})
+	require.NoError(t, err)
+	assert.NotContains(t, rawBody, `"comment"`,
+		"empty comment must be omitted from the request body to avoid rendering a blank attendee comment in the organiser's notification; raw=%s", rawBody)
+}
+
+// TestHTTPClient_SendRSVP_PropagatesUpstreamError pins the 4xx/5xx
+// surface area: a Nylas error during send-rsvp must surface as a real
+// error (not nil). Air's handler relies on this to return 502 to the
+// browser instead of a misleading 200.
+func TestHTTPClient_SendRSVP_PropagatesUpstreamError(t *testing.T) {
+	t.Parallel()
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusForbidden)
+		_, _ = w.Write([]byte(`{"error":"calendar permission denied"}`))
+	}))
+	defer server.Close()
+
+	client := nylas.NewHTTPClient()
+	client.SetCredentials("client-id", "secret", "api-key")
+	client.SetBaseURL(server.URL)
+
+	err := client.SendRSVP(context.Background(), "grant-1", "cal-1", "evt-1", &domain.SendRSVPRequest{
+		Status: "yes",
+	})
+	require.Error(t, err, "adapter must surface non-2xx responses as errors")
+}
+
+// TestHTTPClient_SendRSVP_ValidationErrorsWrapErrInvalidInput pins that
+// every input-validation failure wraps domain.ErrInvalidInput so callers
+// can classify the failure with errors.Is. Without the wrap, the rest of
+// this client (which IS consistent) becomes impossible to align against —
+// CLI / Air handlers can no longer return a uniform 4xx envelope for
+// validation failures coming out of any adapter method.
+func TestHTTPClient_SendRSVP_ValidationErrorsWrapErrInvalidInput(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		name       string
+		grantID    string
+		calendarID string
+		eventID    string
+		req        *domain.SendRSVPRequest
+	}{
+		{name: "empty grant", grantID: "", calendarID: "c", eventID: "e", req: &domain.SendRSVPRequest{Status: "yes"}},
+		{name: "empty calendar", grantID: "g", calendarID: "", eventID: "e", req: &domain.SendRSVPRequest{Status: "yes"}},
+		{name: "empty event", grantID: "g", calendarID: "c", eventID: "", req: &domain.SendRSVPRequest{Status: "yes"}},
+		{name: "nil request", grantID: "g", calendarID: "c", eventID: "e", req: nil},
+		{name: "bad status", grantID: "g", calendarID: "c", eventID: "e", req: &domain.SendRSVPRequest{Status: "definitely"}},
+		{name: "oversized comment", grantID: "g", calendarID: "c", eventID: "e", req: &domain.SendRSVPRequest{
+			Status:  "yes",
+			Comment: strings.Repeat("x", 2000),
+		}},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			client := nylas.NewHTTPClient()
+			client.SetCredentials("client-id", "secret", "api-key")
+			client.SetBaseURL("http://invalid.example") // never reached
+
+			err := client.SendRSVP(context.Background(), tc.grantID, tc.calendarID, tc.eventID, tc.req)
+			require.Error(t, err)
+			assert.ErrorIs(t, err, domain.ErrInvalidInput,
+				"validation error %q must wrap domain.ErrInvalidInput so callers can classify it", err)
+		})
+	}
+}
+
+// TestHTTPClient_SendRSVP_NormalizesStatusCase pins that adapter-level
+// validation accepts "YES" / "Yes" / " maybe " — a CLI or future SDK
+// caller that doesn't normalize at its own layer must not be rejected
+// for a cosmetic difference. Nylas itself only accepts lowercase; the
+// adapter must lowercase before forwarding.
+func TestHTTPClient_SendRSVP_NormalizesStatusCase(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		name        string
+		input       string
+		wantPayload string
+	}{
+		{name: "uppercase", input: "YES", wantPayload: "yes"},
+		{name: "titlecase", input: "Maybe", wantPayload: "maybe"},
+		{name: "padded", input: "  no  ", wantPayload: "no"},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			var rawBody string
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				body, _ := io.ReadAll(r.Body)
+				rawBody = string(body)
+				w.WriteHeader(http.StatusOK)
+			}))
+			defer server.Close()
+
+			client := nylas.NewHTTPClient()
+			client.SetCredentials("client-id", "secret", "api-key")
+			client.SetBaseURL(server.URL)
+
+			err := client.SendRSVP(context.Background(), "g", "c", "e", &domain.SendRSVPRequest{Status: tc.input})
+			require.NoError(t, err)
+			assert.Contains(t, rawBody, `"status":"`+tc.wantPayload+`"`,
+				"expected normalized status %q in body, got %s", tc.wantPayload, rawBody)
+		})
+	}
+}
+
+// TestHTTPClient_SendRSVP_ForwardsCommentExactly pins that a non-empty
+// comment is forwarded byte-for-byte (modulo JSON encoding) — quoting,
+// special characters, multi-byte unicode all round-trip. Without this
+// pin a future refactor that "cleans up" the comment (e.g. stripping
+// quotes, ASCII-only) would silently corrupt user-typed messages on
+// the way to the organiser's inbox.
+func TestHTTPClient_SendRSVP_ForwardsCommentExactly(t *testing.T) {
+	t.Parallel()
+	tricky := `He said "hi" — and \\ then 🎉`
+
+	var rawBody string
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		body, _ := io.ReadAll(r.Body)
+		rawBody = string(body)
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer server.Close()
+
+	client := nylas.NewHTTPClient()
+	client.SetCredentials("client-id", "secret", "api-key")
+	client.SetBaseURL(server.URL)
+
+	err := client.SendRSVP(context.Background(), "g", "c", "e", &domain.SendRSVPRequest{
+		Status:  "yes",
+		Comment: tricky,
+	})
+	require.NoError(t, err)
+
+	// Decode the wire body to compare against the input post-JSON.
+	var got struct {
+		Status  string `json:"status"`
+		Comment string `json:"comment"`
+	}
+	require.NoError(t, json.Unmarshal([]byte(rawBody), &got),
+		"server-side body must be valid JSON, got %q", rawBody)
+	assert.Equal(t, tricky, got.Comment,
+		"adapter must forward comment exactly; quotes/backslash/emoji should round-trip")
+	assert.Equal(t, "yes", got.Status)
+}
+
+// TestHTTPClient_SendRSVP_RejectsOversizedComment pins the
+// defense-in-depth comment cap at the adapter boundary. The Air handler
+// has a matching cap, but CLI / SDK consumers go straight through the
+// adapter — without this the cap is single-layer.
+func TestHTTPClient_SendRSVP_RejectsOversizedComment(t *testing.T) {
+	t.Parallel()
+
+	called := false
+	server := httptest.NewServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {
+		called = true
+	}))
+	defer server.Close()
+
+	client := nylas.NewHTTPClient()
+	client.SetCredentials("client-id", "secret", "api-key")
+	client.SetBaseURL(server.URL)
+
+	err := client.SendRSVP(context.Background(), "g", "c", "e", &domain.SendRSVPRequest{
+		Status:  "yes",
+		Comment: strings.Repeat("x", 2000),
+	})
+	require.Error(t, err)
+	assert.True(t, errors.Is(err, domain.ErrInvalidInput),
+		"oversized comment must surface as ErrInvalidInput")
+	assert.False(t, called, "adapter must short-circuit before issuing any HTTP request")
+}
diff --git a/internal/adapters/nylas/calendars_events_test.go b/internal/adapters/nylas/calendars_events_test.go
index c438bbb..0253b3a 100644
--- a/internal/adapters/nylas/calendars_events_test.go
+++ b/internal/adapters/nylas/calendars_events_test.go
@@ -180,6 +180,17 @@ func TestHTTPClient_GetEventsWithCursor(t *testing.T) {
 			},
 			wantQueryKeys: []string{"page_token"},
 		},
+		{
+			// ical_uid is the bridge between an emailed invite and a Nylas
+			// event ID; the RSVP handler relies on the upstream filter so
+			// we don't have to scan the whole calendar.
+			name: "includes ical_uid filter",
+			params: &domain.EventQueryParams{
+				Limit:   1,
+				ICalUID: "abc-123@example.com",
+			},
+			wantQueryKeys: []string{"ical_uid"},
+		},
 	}
 
 	for _, tt := range tests {
@@ -206,6 +217,29 @@ func TestHTTPClient_GetEventsWithCursor(t *testing.T) {
 		})
 	}
 
+	t.Run("ical_uid value is forwarded verbatim", func(t *testing.T) {
+		// Real iCal UIDs frequently contain '@' and '.', and Outlook
+		// occasionally emits ones with hex-tagged suffixes. URL-escaping
+		// must not corrupt them before Nylas sees the filter.
+		uid := "0123-DEF@calendar.example.com"
+		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			assert.Equal(t, uid, r.URL.Query().Get("ical_uid"))
+			w.Header().Set("Content-Type", "application/json")
+			_ = json.NewEncoder(w).Encode(map[string]any{"data": []any{}})
+		}))
+		defer server.Close()
+
+		client := nylas.NewHTTPClient()
+		client.SetCredentials("client-id", "secret", "api-key")
+		client.SetBaseURL(server.URL)
+
+		_, err := client.GetEventsWithCursor(context.Background(), "grant-123", "cal-123", &domain.EventQueryParams{
+			Limit:   1,
+			ICalUID: uid,
+		})
+		require.NoError(t, err)
+	})
+
 	t.Run("returns pagination info", func(t *testing.T) {
 		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			response := map[string]any{
diff --git a/internal/adapters/nylas/client_types_test.go b/internal/adapters/nylas/client_types_test.go
index dac67d8..988c521 100644
--- a/internal/adapters/nylas/client_types_test.go
+++ b/internal/adapters/nylas/client_types_test.go
@@ -150,14 +150,16 @@ func TestCreateFolderRequest(t *testing.T) {
 func TestUpdateMessageRequest(t *testing.T) {
 	unread := false
 	starred := true
+	folders := []string{"folder-1", "folder-2"}
 	req := &domain.UpdateMessageRequest{
 		Unread:  &unread,
 		Starred: &starred,
-		Folders: []string{"folder-1", "folder-2"},
+		Folders: folders,
 	}
 
 	assert.False(t, *req.Unread)
 	assert.True(t, *req.Starred)
+	require.NotNil(t, req.Folders)
 	assert.Len(t, req.Folders, 2)
 }
 
diff --git a/internal/adapters/nylas/messages.go b/internal/adapters/nylas/messages.go
index 32948f7..e005b5e 100644
--- a/internal/adapters/nylas/messages.go
+++ b/internal/adapters/nylas/messages.go
@@ -173,7 +173,8 @@ func (c *HTTPClient) UpdateMessage(ctx context.Context, grantID, messageID strin
 	if req.Starred != nil {
 		payload["starred"] = *req.Starred
 	}
-	if len(req.Folders) > 0 {
+	// nil = leave alone; non-nil (incl. empty) = set; empty archives in Gmail.
+	if req.Folders != nil {
 		payload["folders"] = req.Folders
 	}
 
diff --git a/internal/adapters/nylas/messages_update_test.go b/internal/adapters/nylas/messages_update_test.go
index 258edb9..0f7b20f 100644
--- a/internal/adapters/nylas/messages_update_test.go
+++ b/internal/adapters/nylas/messages_update_test.go
@@ -42,20 +42,34 @@ func TestHTTPClient_UpdateMessage(t *testing.T) {
 		},
 		{
 			name: "moves to folders",
-			request: &domain.UpdateMessageRequest{
-				Folders: []string{"Archive", "Important"},
-			},
+			request: func() *domain.UpdateMessageRequest {
+				folders := []string{"Archive", "Important"}
+				return &domain.UpdateMessageRequest{Folders: folders}
+			}(),
 			wantFields: map[string]any{"folders": []string{"Archive", "Important"}},
 		},
+		{
+			// Regression: Gmail archive (drop INBOX) sends folders:[]. The
+			// adapter must forward an explicit empty array — silently
+			// dropping it leaves the message in the inbox while the UI
+			// reports success.
+			name: "archives to empty folders (gmail)",
+			request: func() *domain.UpdateMessageRequest {
+				empty := []string{}
+				return &domain.UpdateMessageRequest{Folders: empty}
+			}(),
+			wantFields: map[string]any{"folders": []any{}},
+		},
 		{
 			name: "updates multiple fields",
 			request: func() *domain.UpdateMessageRequest {
 				unread := true
 				starred := true
+				folders := []string{"INBOX"}
 				return &domain.UpdateMessageRequest{
 					Unread:  &unread,
 					Starred: &starred,
-					Folders: []string{"INBOX"},
+					Folders: folders,
 				}
 			}(),
 			wantFields: map[string]any{
@@ -106,6 +120,106 @@ func TestHTTPClient_UpdateMessage(t *testing.T) {
 	}
 }
 
+// TestHTTPClient_UpdateMessage_ForwardsEmptyFolders pins the Gmail-archive
+// contract: when the caller passes []string{} (drop all labels), the PUT
+// body MUST contain "folders":[] verbatim. The previous len()>0 guard
+// silently elided the array, so archive succeeded in the UI but never
+// happened upstream — a particularly nasty class of bug because the
+// browser optimistically removes the row before the server lies. Today
+// the adapter uses `!= nil` so a non-nil empty slice forwards correctly
+// while nil is skipped (leave-alone).
+func TestHTTPClient_UpdateMessage_ForwardsEmptyFolders(t *testing.T) {
+	t.Parallel()
+
+	var rawBody string
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		raw, _ := io.ReadAll(r.Body)
+		rawBody = string(raw)
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(map[string]any{
+			"data": map[string]any{
+				"id":       "msg-456",
+				"grant_id": "grant-123",
+				"subject":  "Archived",
+				"date":     1704067200,
+			},
+		})
+	}))
+	defer server.Close()
+
+	client := nylas.NewHTTPClient()
+	client.SetCredentials("client-id", "secret", "api-key")
+	client.SetBaseURL(server.URL)
+
+	_, err := client.UpdateMessage(context.Background(), "grant-123", "msg-456", &domain.UpdateMessageRequest{
+		Folders: []string{},
+	})
+	require.NoError(t, err)
+
+	// Decode and assert the exact key shape — a nil Folders is skipped
+	// by the adapter so the key would be absent; only a non-nil empty
+	// slice produces "folders":[].
+	var parsed map[string]any
+	require.NoError(t, json.Unmarshal([]byte(rawBody), &parsed))
+	folders, present := parsed["folders"]
+	require.True(t, present, "folders key must be present so Gmail archive reaches the API; raw=%s", rawBody)
+	assert.Equal(t, []any{}, folders, "folders must serialize as an explicit empty array; got %#v", folders)
+}
+
+// TestHTTPClient_UpdateMessage_EmptyFolders_PropagatesUpstreamError pins
+// that a 4xx from Nylas on an archive PUT (e.g. Gmail rate limit, label
+// permission denied) is surfaced as a real error rather than silently
+// reported as success. The optimistic UI in Air relies on this — without
+// error propagation the row stays visually archived while the server
+// rejects the change, and the next refresh re-introduces the email.
+func TestHTTPClient_UpdateMessage_EmptyFolders_PropagatesUpstreamError(t *testing.T) {
+	t.Parallel()
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Pin that we even saw the request (no early exit on empty
+		// folders) — a regression that elided the body would never
+		// reach this assertion.
+		raw, _ := io.ReadAll(r.Body)
+		assert.Contains(t, string(raw), `"folders":[]`,
+			"adapter must still send the empty-folders body even when the upstream errors; raw=%s", string(raw))
+		w.WriteHeader(http.StatusForbidden)
+		_, _ = w.Write([]byte(`{"error":"label permission denied"}`))
+	}))
+	defer server.Close()
+
+	client := nylas.NewHTTPClient()
+	client.SetCredentials("client-id", "secret", "api-key")
+	client.SetBaseURL(server.URL)
+
+	_, err := client.UpdateMessage(context.Background(), "grant-123", "msg-456", &domain.UpdateMessageRequest{
+		Folders: []string{},
+	})
+	require.Error(t, err, "4xx upstream must surface as a real error, not nil")
+}
+
+// TestHTTPClient_UpdateMessage_EmptyFolders_PropagatesServerError pins
+// the 5xx path: a transient Nylas outage during archive must not be
+// silently swallowed. Air's offline queue keys off this error to retry
+// the action when connectivity returns.
+func TestHTTPClient_UpdateMessage_EmptyFolders_PropagatesServerError(t *testing.T) {
+	t.Parallel()
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusBadGateway)
+		_, _ = w.Write([]byte(`{"error":"upstream timeout"}`))
+	}))
+	defer server.Close()
+
+	client := nylas.NewHTTPClient()
+	client.SetCredentials("client-id", "secret", "api-key")
+	client.SetBaseURL(server.URL)
+
+	_, err := client.UpdateMessage(context.Background(), "grant-123", "msg-456", &domain.UpdateMessageRequest{
+		Folders: []string{},
+	})
+	require.Error(t, err, "5xx upstream must surface as a real error so the offline queue can retry")
+}
+
 func TestHTTPClient_UpdateMessage_RetriesReplayBody(t *testing.T) {
 	t.Parallel()
 
diff --git a/internal/adapters/nylas/mock_client.go b/internal/adapters/nylas/mock_client.go
index ce3f634..6020975 100644
--- a/internal/adapters/nylas/mock_client.go
+++ b/internal/adapters/nylas/mock_client.go
@@ -154,14 +154,16 @@ type MockClient struct {
 	DeleteWorkflowFunc        func(ctx context.Context, scope domain.RemoteScope, grantID, workflowID string) error
 
 	// Calendar functions
-	GetCalendarsFunc    func(ctx context.Context, grantID string) ([]domain.Calendar, error)
-	GetEventsFunc       func(ctx context.Context, grantID, calendarID string, params *domain.EventQueryParams) ([]domain.Event, error)
-	GetEventFunc        func(ctx context.Context, grantID, calendarID, eventID string) (*domain.Event, error)
-	CreateEventFunc     func(ctx context.Context, grantID, calendarID string, req *domain.CreateEventRequest) (*domain.Event, error)
-	UpdateEventFunc     func(ctx context.Context, grantID, calendarID, eventID string, req *domain.UpdateEventRequest) (*domain.Event, error)
-	DeleteEventFunc     func(ctx context.Context, grantID, calendarID, eventID string) error
-	GetFreeBusyFunc     func(ctx context.Context, grantID string, req *domain.FreeBusyRequest) (*domain.FreeBusyResponse, error)
-	GetAvailabilityFunc func(ctx context.Context, req *domain.AvailabilityRequest) (*domain.AvailabilityResponse, error)
+	GetCalendarsFunc        func(ctx context.Context, grantID string) ([]domain.Calendar, error)
+	GetEventsFunc           func(ctx context.Context, grantID, calendarID string, params *domain.EventQueryParams) ([]domain.Event, error)
+	GetEventsWithCursorFunc func(ctx context.Context, grantID, calendarID string, params *domain.EventQueryParams) (*domain.EventListResponse, error)
+	GetEventFunc            func(ctx context.Context, grantID, calendarID, eventID string) (*domain.Event, error)
+	CreateEventFunc         func(ctx context.Context, grantID, calendarID string, req *domain.CreateEventRequest) (*domain.Event, error)
+	UpdateEventFunc         func(ctx context.Context, grantID, calendarID, eventID string, req *domain.UpdateEventRequest) (*domain.Event, error)
+	DeleteEventFunc         func(ctx context.Context, grantID, calendarID, eventID string) error
+	SendRSVPFunc            func(ctx context.Context, grantID, calendarID, eventID string, req *domain.SendRSVPRequest) error
+	GetFreeBusyFunc         func(ctx context.Context, grantID string, req *domain.FreeBusyRequest) (*domain.FreeBusyResponse, error)
+	GetAvailabilityFunc     func(ctx context.Context, req *domain.AvailabilityRequest) (*domain.AvailabilityResponse, error)
 
 	// Contact functions
 	GetContactsFunc func(ctx context.Context, grantID string, params *domain.ContactQueryParams) ([]domain.Contact, error)
diff --git a/internal/adapters/nylas/mock_events.go b/internal/adapters/nylas/mock_events.go
index 78c90a0..38ad740 100644
--- a/internal/adapters/nylas/mock_events.go
+++ b/internal/adapters/nylas/mock_events.go
@@ -15,6 +15,9 @@ func (m *MockClient) GetEvents(ctx context.Context, grantID, calendarID string,
 
 // GetEventsWithCursor retrieves events with pagination.
 func (m *MockClient) GetEventsWithCursor(ctx context.Context, grantID, calendarID string, params *domain.EventQueryParams) (*domain.EventListResponse, error) {
+	if m.GetEventsWithCursorFunc != nil {
+		return m.GetEventsWithCursorFunc(ctx, grantID, calendarID, params)
+	}
 	return &domain.EventListResponse{Data: []domain.Event{}}, nil
 }
 
@@ -67,6 +70,9 @@ func (m *MockClient) DeleteEvent(ctx context.Context, grantID, calendarID, event
 
 // SendRSVP sends an RSVP response to an event invitation.
 func (m *MockClient) SendRSVP(ctx context.Context, grantID, calendarID, eventID string, req *domain.SendRSVPRequest) error {
+	if m.SendRSVPFunc != nil {
+		return m.SendRSVPFunc(ctx, grantID, calendarID, eventID, req)
+	}
 	return nil
 }
 
diff --git a/internal/adapters/nylas/threads.go b/internal/adapters/nylas/threads.go
index be4d878..0a0e9a2 100644
--- a/internal/adapters/nylas/threads.go
+++ b/internal/adapters/nylas/threads.go
@@ -89,7 +89,8 @@ func (c *HTTPClient) UpdateThread(ctx context.Context, grantID, threadID string,
 	if req.Starred != nil {
 		payload["starred"] = *req.Starred
 	}
-	if len(req.Folders) > 0 {
+	// nil = leave alone; non-nil (incl. empty) = set; empty archives in Gmail.
+	if req.Folders != nil {
 		payload["folders"] = req.Folders
 	}
 
diff --git a/internal/adapters/nylas/threads_http_test.go b/internal/adapters/nylas/threads_http_test.go
index 9e5f1ae..7342b11 100644
--- a/internal/adapters/nylas/threads_http_test.go
+++ b/internal/adapters/nylas/threads_http_test.go
@@ -6,6 +6,7 @@ package nylas_test
 import (
 	"context"
 	"encoding/json"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"testing"
@@ -342,9 +343,10 @@ func TestHTTPClient_UpdateThread(t *testing.T) {
 		},
 		{
 			name: "moves thread to folders",
-			request: &domain.UpdateMessageRequest{
-				Folders: []string{"Archive", "Work"},
-			},
+			request: func() *domain.UpdateMessageRequest {
+				folders := []string{"Archive", "Work"}
+				return &domain.UpdateMessageRequest{Folders: folders}
+			}(),
 			wantFields: []string{"folders"},
 		},
 		{
@@ -352,10 +354,11 @@ func TestHTTPClient_UpdateThread(t *testing.T) {
 			request: func() *domain.UpdateMessageRequest {
 				unread := true
 				starred := true
+				folders := []string{"INBOX"}
 				return &domain.UpdateMessageRequest{
 					Unread:  &unread,
 					Starred: &starred,
-					Folders: []string{"INBOX"},
+					Folders: folders,
 				}
 			}(),
 			wantFields: []string{"unread", "starred", "folders"},
@@ -404,6 +407,95 @@ func TestHTTPClient_UpdateThread(t *testing.T) {
 	}
 }
 
+// TestHTTPClient_UpdateThread_ForwardsEmptyFolders is the thread-level
+// twin of the same test on UpdateMessage: archiving a Gmail thread (drop
+// every label) sends &[]string{} to the adapter and the resulting PUT
+// body MUST contain "folders":[] verbatim. UpdateThread shares the same
+// "build payload then PUT" code shape as UpdateMessage, so a future
+// refactor that re-introduces the `len(req.Folders) > 0` guard would
+// silently regress thread archive on Gmail without this test.
+func TestHTTPClient_UpdateThread_ForwardsEmptyFolders(t *testing.T) {
+	t.Parallel()
+
+	var rawBody string
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		raw, _ := io.ReadAll(r.Body)
+		rawBody = string(raw)
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(map[string]any{
+			"data": map[string]any{
+				"id":       "thread-456",
+				"grant_id": "grant-123",
+				"subject":  "Archived",
+			},
+		})
+	}))
+	defer server.Close()
+
+	client := nylas.NewHTTPClient()
+	client.SetCredentials("client-id", "secret", "api-key")
+	client.SetBaseURL(server.URL)
+
+	_, err := client.UpdateThread(context.Background(), "grant-123", "thread-456", &domain.UpdateMessageRequest{
+		Folders: []string{},
+	})
+	require.NoError(t, err)
+
+	var parsed map[string]any
+	require.NoError(t, json.Unmarshal([]byte(rawBody), &parsed))
+	folders, present := parsed["folders"]
+	require.True(t, present, "folders key must be present so Gmail thread archive reaches the API; raw=%s", rawBody)
+	assert.Equal(t, []any{}, folders, "folders must serialize as an explicit empty array; got %#v", folders)
+}
+
+// TestHTTPClient_UpdateThread_EmptyFolders_PropagatesUpstreamError is
+// the thread-level twin of the same UpdateMessage test: a 4xx from
+// Nylas on archive must surface as a real error so Air's optimistic UI
+// can roll back, not silently report success.
+func TestHTTPClient_UpdateThread_EmptyFolders_PropagatesUpstreamError(t *testing.T) {
+	t.Parallel()
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		raw, _ := io.ReadAll(r.Body)
+		assert.Contains(t, string(raw), `"folders":[]`,
+			"adapter must still send the empty-folders body even when the upstream errors; raw=%s", string(raw))
+		w.WriteHeader(http.StatusForbidden)
+		_, _ = w.Write([]byte(`{"error":"label permission denied"}`))
+	}))
+	defer server.Close()
+
+	client := nylas.NewHTTPClient()
+	client.SetCredentials("client-id", "secret", "api-key")
+	client.SetBaseURL(server.URL)
+
+	_, err := client.UpdateThread(context.Background(), "grant-123", "thread-456", &domain.UpdateMessageRequest{
+		Folders: []string{},
+	})
+	require.Error(t, err, "4xx upstream must surface as a real error, not nil")
+}
+
+// TestHTTPClient_UpdateThread_EmptyFolders_PropagatesServerError pins
+// the 5xx path: a transient Nylas outage during thread archive must
+// surface so Air's offline queue can retry the action.
+func TestHTTPClient_UpdateThread_EmptyFolders_PropagatesServerError(t *testing.T) {
+	t.Parallel()
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusBadGateway)
+		_, _ = w.Write([]byte(`{"error":"upstream timeout"}`))
+	}))
+	defer server.Close()
+
+	client := nylas.NewHTTPClient()
+	client.SetCredentials("client-id", "secret", "api-key")
+	client.SetBaseURL(server.URL)
+
+	_, err := client.UpdateThread(context.Background(), "grant-123", "thread-456", &domain.UpdateMessageRequest{
+		Folders: []string{},
+	})
+	require.Error(t, err, "5xx upstream must surface as a real error so the offline queue can retry")
+}
+
 func TestHTTPClient_DeleteThread(t *testing.T) {
 	tests := []struct {
 		name       string
diff --git a/internal/adapters/nylas/threads_test.go b/internal/adapters/nylas/threads_test.go
index 76315d1..965ef57 100644
--- a/internal/adapters/nylas/threads_test.go
+++ b/internal/adapters/nylas/threads_test.go
@@ -428,8 +428,9 @@ func TestHTTPClient_UpdateThread_WithFolders(t *testing.T) {
 	client.SetBaseURL(server.URL)
 
 	ctx := context.Background()
+	folders := []string{"folder-archive", "folder-done"}
 	req := &domain.UpdateMessageRequest{
-		Folders: []string{"folder-archive", "folder-done"},
+		Folders: folders,
 	}
 
 	thread, err := client.UpdateThread(ctx, "grant-folders", "thread-move", req)
diff --git a/internal/adapters/output/quiet.go b/internal/adapters/output/quiet.go
index aeb4dad..87c6d62 100644
--- a/internal/adapters/output/quiet.go
+++ b/internal/adapters/output/quiet.go
@@ -30,7 +30,7 @@ func (qw *QuietWriter) Write(data any) error {
 // WriteList outputs IDs only, one per line.
 func (qw *QuietWriter) WriteList(data any, _ []ports.Column) error {
 	v := reflect.ValueOf(data)
-	if v.Kind() == reflect.Ptr {
+	if v.Kind() == reflect.Pointer {
 		v = v.Elem()
 	}
 
@@ -64,7 +64,7 @@ func extractQuietField(data any) string {
 	}
 
 	v := reflect.ValueOf(data)
-	if v.Kind() == reflect.Ptr {
+	if v.Kind() == reflect.Pointer {
 		v = v.Elem()
 	}
 
diff --git a/internal/adapters/output/table.go b/internal/adapters/output/table.go
index c8eef55..cd4c844 100644
--- a/internal/adapters/output/table.go
+++ b/internal/adapters/output/table.go
@@ -33,7 +33,7 @@ func NewTableWriter(w io.Writer, colored bool) *TableWriter {
 func (tw *TableWriter) Write(data any) error {
 	// For single objects, output as key: value pairs
 	v := reflect.ValueOf(data)
-	if v.Kind() == reflect.Ptr {
+	if v.Kind() == reflect.Pointer {
 		v = v.Elem()
 	}
 
@@ -69,7 +69,7 @@ func (tw *TableWriter) Write(data any) error {
 // WriteList outputs a list of objects as a table
 func (tw *TableWriter) WriteList(data any, columns []ports.Column) error {
 	v := reflect.ValueOf(data)
-	if v.Kind() == reflect.Ptr {
+	if v.Kind() == reflect.Pointer {
 		v = v.Elem()
 	}
 
@@ -93,7 +93,7 @@ func (tw *TableWriter) WriteList(data any, columns []ports.Column) error {
 	// Write rows
 	for i := range v.Len() {
 		row := v.Index(i)
-		if row.Kind() == reflect.Ptr {
+		if row.Kind() == reflect.Pointer {
 			row = row.Elem()
 		}
 
@@ -144,7 +144,7 @@ func (tw *TableWriter) WriteError(err error) error {
 
 // getFieldValue extracts a field value from a struct or map
 func getFieldValue(v reflect.Value, field string) any {
-	if v.Kind() == reflect.Ptr {
+	if v.Kind() == reflect.Pointer {
 		v = v.Elem()
 	}
 
diff --git a/internal/air/cache/offline.go b/internal/air/cache/offline.go
index 15836e7..96afed6 100644
--- a/internal/air/cache/offline.go
+++ b/internal/air/cache/offline.go
@@ -262,13 +262,15 @@ type MarkReadPayload struct {
 	Unread  bool   `json:"unread"`
 }
 
-// UpdateMessagePayload is the payload for a generic message update.
+// UpdateMessagePayload is the queued form of domain.UpdateMessageRequest.
+// Folders has no `omitempty` so the nil-vs-empty distinction round-trips
+// through SQLite; see domain.UpdateMessageRequest.
 type UpdateMessagePayload struct {
 	GrantID string   `json:"grant_id,omitempty"`
 	EmailID string   `json:"email_id"`
 	Unread  *bool    `json:"unread,omitempty"`
 	Starred *bool    `json:"starred,omitempty"`
-	Folders []string `json:"folders,omitempty"`
+	Folders []string `json:"folders"`
 }
 
 // StarPayload is the payload for star/unstar actions.
diff --git a/internal/air/handlers_availability.go b/internal/air/handlers_availability.go
index 5a30d51..d014eeb 100644
--- a/internal/air/handlers_availability.go
+++ b/internal/air/handlers_availability.go
@@ -1,7 +1,9 @@
 package air
 
 import (
+	"fmt"
 	"net/http"
+	"net/url"
 	"strconv"
 	"strings"
 	"time"
@@ -13,6 +15,31 @@ import (
 // AVAILABILITY & FIND TIME HANDLERS
 // ====================================
 
+// parseInt64Param reads an int64 query parameter; an absent param yields zero.
+func parseInt64Param(query url.Values, key string) (int64, error) {
+	raw := query.Get(key)
+	if raw == "" {
+		return 0, nil
+	}
+	v, err := strconv.ParseInt(raw, 10, 64)
+	if err != nil {
+		return 0, fmt.Errorf("invalid %s: %q is not a valid integer", key, raw)
+	}
+	return v, nil
+}
+
+func parseIntParam(query url.Values, key string) (int, error) {
+	raw := query.Get(key)
+	if raw == "" {
+		return 0, nil
+	}
+	v, err := strconv.Atoi(raw)
+	if err != nil {
+		return 0, fmt.Errorf("invalid %s: %q is not a valid integer", key, raw)
+	}
+	return v, nil
+}
+
 // AvailabilityRequest represents a request to find available times.
 type AvailabilityRequest struct {
 	StartTime       int64    `json:"start_time"`
@@ -75,7 +102,7 @@ type EventConflict struct {
 // handleAvailability finds available meeting times.
 func (s *Server) handleAvailability(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodGet && r.Method != http.MethodPost {
-		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		writeError(w, http.StatusMethodNotAllowed, "Method not allowed")
 		return
 	}
 
@@ -108,22 +135,30 @@ func (s *Server) handleAvailability(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 	} else {
-		// Parse from query params for GET
+		// Parse from query params for GET. We validate each numeric param
+		// rather than swallowing errors — the previous version silently
+		// fell through to the default 7-day window when callers sent
+		// malformed input, which masked client bugs in test harnesses.
 		query := r.URL.Query()
-		if startStr := query.Get("start_time"); startStr != "" {
-			req.StartTime, _ = strconv.ParseInt(startStr, 10, 64)
+		var perr error
+		if req.StartTime, perr = parseInt64Param(query, "start_time"); perr != nil {
+			writeBadParamError(w, "start_time", perr)
+			return
 		}
-		if endStr := query.Get("end_time"); endStr != "" {
-			req.EndTime, _ = strconv.ParseInt(endStr, 10, 64)
+		if req.EndTime, perr = parseInt64Param(query, "end_time"); perr != nil {
+			writeBadParamError(w, "end_time", perr)
+			return
 		}
-		if durationStr := query.Get("duration_minutes"); durationStr != "" {
-			req.DurationMinutes, _ = strconv.Atoi(durationStr)
+		if req.DurationMinutes, perr = parseIntParam(query, "duration_minutes"); perr != nil {
+			writeBadParamError(w, "duration_minutes", perr)
+			return
 		}
 		if participants := query.Get("participants"); participants != "" {
 			req.Participants = strings.Split(participants, ",")
 		}
-		if intervalStr := query.Get("interval_minutes"); intervalStr != "" {
-			req.IntervalMinutes, _ = strconv.Atoi(intervalStr)
+		if req.IntervalMinutes, perr = parseIntParam(query, "interval_minutes"); perr != nil {
+			writeBadParamError(w, "interval_minutes", perr)
+			return
 		}
 	}
 
@@ -180,9 +215,8 @@ func (s *Server) handleAvailability(w http.ResponseWriter, r *http.Request) {
 
 	result, err := s.nylasClient.GetAvailability(ctx, domainReq)
 	if err != nil {
-		writeJSON(w, http.StatusInternalServerError, map[string]string{
-			"error": "Failed to get availability: " + err.Error(),
-		})
+		writeUpstreamError(w, http.StatusInternalServerError,
+			"Failed to get availability — please try again", err)
 		return
 	}
 
@@ -204,7 +238,7 @@ func (s *Server) handleAvailability(w http.ResponseWriter, r *http.Request) {
 // handleFreeBusy returns free/busy information for participants.
 func (s *Server) handleFreeBusy(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodGet && r.Method != http.MethodPost {
-		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		writeError(w, http.StatusMethodNotAllowed, "Method not allowed")
 		return
 	}
 
@@ -238,13 +272,17 @@ func (s *Server) handleFreeBusy(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 	} else {
-		// Parse from query params for GET
+		// Parse from query params for GET (see availability handler for
+		// rationale on validating instead of swallowing parse errors).
 		query := r.URL.Query()
-		if startStr := query.Get("start_time"); startStr != "" {
-			req.StartTime, _ = strconv.ParseInt(startStr, 10, 64)
+		var perr error
+		if req.StartTime, perr = parseInt64Param(query, "start_time"); perr != nil {
+			writeBadParamError(w, "start_time", perr)
+			return
 		}
-		if endStr := query.Get("end_time"); endStr != "" {
-			req.EndTime, _ = strconv.ParseInt(endStr, 10, 64)
+		if req.EndTime, perr = parseInt64Param(query, "end_time"); perr != nil {
+			writeBadParamError(w, "end_time", perr)
+			return
 		}
 		if emails := query.Get("emails"); emails != "" {
 			req.Emails = strings.Split(emails, ",")
@@ -287,9 +325,8 @@ func (s *Server) handleFreeBusy(w http.ResponseWriter, r *http.Request) {
 
 	result, err := s.nylasClient.GetFreeBusy(ctx, grantID, domainReq)
 	if err != nil {
-		writeJSON(w, http.StatusInternalServerError, map[string]string{
-			"error": "Failed to get free/busy: " + err.Error(),
-		})
+		writeUpstreamError(w, http.StatusInternalServerError,
+			"Failed to get free/busy — please try again", err)
 		return
 	}
 
@@ -361,12 +398,15 @@ func (s *Server) handleConflicts(w http.ResponseWriter, r *http.Request) {
 	}
 
 	// Parse time range
-	var startTime, endTime int64
-	if startStr := query.Get("start_time"); startStr != "" {
-		startTime, _ = strconv.ParseInt(startStr, 10, 64)
+	startTime, perr := parseInt64Param(query, "start_time")
+	if perr != nil {
+		writeBadParamError(w, "start_time", perr)
+		return
 	}
-	if endStr := query.Get("end_time"); endStr != "" {
-		endTime, _ = strconv.ParseInt(endStr, 10, 64)
+	endTime, perr := parseInt64Param(query, "end_time")
+	if perr != nil {
+		writeBadParamError(w, "end_time", perr)
+		return
 	}
 
 	// Default to current week
@@ -392,9 +432,9 @@ func (s *Server) handleConflicts(w http.ResponseWriter, r *http.Request) {
 
 	result, err := s.nylasClient.GetEventsWithCursor(ctx, grantID, calendarID, params)
 	if err != nil {
-		writeJSON(w, http.StatusInternalServerError, map[string]string{
-			"error": "Failed to fetch events: " + err.Error(),
-		})
+		writeUpstreamError(w, http.StatusInternalServerError,
+			"Failed to fetch events — please try again", err,
+			"calendarID", calendarID)
 		return
 	}
 
diff --git a/internal/air/handlers_availability_test.go b/internal/air/handlers_availability_test.go
index 16386d7..8680bc8 100644
--- a/internal/air/handlers_availability_test.go
+++ b/internal/air/handlers_availability_test.go
@@ -6,12 +6,203 @@ import (
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
+// TestParseInt64Param pins the contract that empty values are treated as
+// "not provided" (zero, no error) but malformed values surface a clear
+// error — the previous handler-level `_ = strconv.ParseInt(...)` form
+// silently coerced both into zero, which masked client bugs.
+func TestParseInt64Param(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		name    string
+		value   string
+		want    int64
+		wantErr bool
+	}{
+		{"empty is zero, no error", "", 0, false},
+		{"valid integer", "1700000000", 1700000000, false},
+		{"negative valid", "-42", -42, false},
+		{"non-numeric", "tomorrow", 0, true},
+		{"trailing junk", "12abc", 0, true},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			q := url.Values{}
+			if tc.value != "" {
+				q.Set("k", tc.value)
+			}
+			got, err := parseInt64Param(q, "k")
+			if tc.wantErr {
+				assert.Error(t, err)
+				assert.Contains(t, err.Error(), "k")
+			} else {
+				require.NoError(t, err)
+				assert.Equal(t, tc.want, got)
+			}
+		})
+	}
+}
+
+// TestHandleAvailability_BadIntegerParams verifies the regression: bad
+// query params now produce 400 Bad Request instead of being silently
+// substituted by the "next 7 days" default. We use a fully configured
+// server (mock client + a default grant) so the request reaches the
+// param-validation stage instead of bouncing on requireConfig.
+func TestHandleAvailability_BadIntegerParams(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		name string
+		url  string
+	}{
+		{"bad start_time", "/api/availability?start_time=tomorrow"},
+		{"bad end_time", "/api/availability?end_time=never"},
+		{"bad duration_minutes", "/api/availability?duration_minutes=halfhour"},
+		{"bad interval_minutes", "/api/availability?interval_minutes=fifteenish"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			s, _, _ := newCachedTestServer(t)
+			req := httptest.NewRequest(http.MethodGet, tc.url, nil)
+			w := httptest.NewRecorder()
+			s.handleAvailability(w, req)
+			assert.Equal(t, http.StatusBadRequest, w.Code, "body=%s", w.Body.String())
+		})
+	}
+}
+
+func TestHandleFreeBusy_BadIntegerParams(t *testing.T) {
+	t.Parallel()
+	s, _, _ := newCachedTestServer(t)
+	req := httptest.NewRequest(http.MethodGet, "/api/calendars/freebusy?start_time=oops", nil)
+	w := httptest.NewRecorder()
+	s.handleFreeBusy(w, req)
+	assert.Equal(t, http.StatusBadRequest, w.Code, "body=%s", w.Body.String())
+}
+
+// TestHandleConflicts_BadIntegerParams covers the parity gap left by the
+// air-i003 review-pass: handleAvailability and handleFreeBusy got
+// parseInt64Param-based validation AND BadIntegerParams tests, but
+// handleConflicts only got the validation. A future refactor that
+// re-introduces `_, _ = strconv.ParseInt` here would silently fall
+// through to the default "current week" window with no test failure.
+func TestHandleConflicts_BadIntegerParams(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		name string
+		url  string
+	}{
+		{"bad start_time", "/api/calendar/conflicts?start_time=tomorrow"},
+		{"bad end_time", "/api/calendar/conflicts?end_time=never"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			s, _, _ := newCachedTestServer(t)
+			req := httptest.NewRequest(http.MethodGet, tc.url, nil)
+			w := httptest.NewRecorder()
+			s.handleConflicts(w, req)
+			assert.Equal(t, http.StatusBadRequest, w.Code, "body=%s", w.Body.String())
+		})
+	}
+}
+
+// TestHandleAvailability_BadParams_DoesNotEchoRawValue pins the privacy
+// contract on the query-param error path. `parseInt64Param` builds
+//
+//	fmt.Errorf("invalid %s: %q is not a valid integer", key, raw)
+//
+// and the handler hands that error string straight to the client via
+// `writeError(w, http.StatusBadRequest, perr.Error())`. The %q-encoded
+// `raw` is the attacker's input echoed back into a JSON response —
+// reflective surface that contradicts the writeUpstreamError
+// redaction discipline this PR introduced one file over.
+//
+// EXPECTED FAILURE today: the response body contains the literal raw
+// query value. After the fix the body should be a generic message
+// (e.g., "invalid start_time") and the raw value should appear only in
+// slog attrs.
+func TestHandleAvailability_BadParams_DoesNotEchoRawValue(t *testing.T) {
+	t.Parallel()
+	const sentinel = "tomorrow-XYZ-canary"
+	s, _, _ := newCachedTestServer(t)
+	req := httptest.NewRequest(http.MethodGet,
+		"/api/availability?start_time="+sentinel, nil)
+	w := httptest.NewRecorder()
+	s.handleAvailability(w, req)
+	assert.Equal(t, http.StatusBadRequest, w.Code)
+	assert.NotContains(t, w.Body.String(), sentinel,
+		"response must not reflect raw query value back to client")
+}
+
+func TestHandleFreeBusy_BadParams_DoesNotEchoRawValue(t *testing.T) {
+	t.Parallel()
+	const sentinel = "never-XYZ-canary"
+	s, _, _ := newCachedTestServer(t)
+	req := httptest.NewRequest(http.MethodGet,
+		"/api/calendars/freebusy?start_time="+sentinel, nil)
+	w := httptest.NewRecorder()
+	s.handleFreeBusy(w, req)
+	assert.Equal(t, http.StatusBadRequest, w.Code)
+	assert.NotContains(t, w.Body.String(), sentinel,
+		"response must not reflect raw query value back to client")
+}
+
+func TestHandleConflicts_BadParams_DoesNotEchoRawValue(t *testing.T) {
+	t.Parallel()
+	const sentinel = "yesterday-XYZ-canary"
+	s, _, _ := newCachedTestServer(t)
+	req := httptest.NewRequest(http.MethodGet,
+		"/api/calendar/conflicts?start_time="+sentinel, nil)
+	w := httptest.NewRecorder()
+	s.handleConflicts(w, req)
+	assert.Equal(t, http.StatusBadRequest, w.Code)
+	assert.NotContains(t, w.Body.String(), sentinel,
+		"response must not reflect raw query value back to client")
+}
+
+// TestHandleAvailability_BadDurationMinutes_DoesNotEchoRawValue closes
+// the parity gap in the privacy sweep. Today the sweep covers
+// start_time/end_time but not duration_minutes/interval_minutes —
+// handlers_availability.go:160-169 routes all four through the same
+// writeBadParamError helper, so a regression that inlines
+// `writeError(perr.Error())` at one of the inner branches would escape
+// the existing tests. Lock-down: same code path, same canary.
+func TestHandleAvailability_BadDurationMinutes_DoesNotEchoRawValue(t *testing.T) {
+	t.Parallel()
+	const sentinel = "halfhour-XYZ-duration-canary"
+	s, _, _ := newCachedTestServer(t)
+	req := httptest.NewRequest(http.MethodGet,
+		"/api/availability?duration_minutes="+sentinel, nil)
+	w := httptest.NewRecorder()
+	s.handleAvailability(w, req)
+	assert.Equal(t, http.StatusBadRequest, w.Code)
+	assert.NotContains(t, w.Body.String(), sentinel,
+		"duration_minutes raw value must not be reflected back to the client")
+}
+
+func TestHandleAvailability_BadIntervalMinutes_DoesNotEchoRawValue(t *testing.T) {
+	t.Parallel()
+	const sentinel = "fifteenish-XYZ-interval-canary"
+	s, _, _ := newCachedTestServer(t)
+	// IntervalMinutes is parsed AFTER start/end/duration/participants;
+	// supply valid values for those so we reach the interval branch.
+	req := httptest.NewRequest(http.MethodGet,
+		"/api/availability?start_time=1700000000&end_time=1700100000&duration_minutes=30&interval_minutes="+sentinel, nil)
+	w := httptest.NewRecorder()
+	s.handleAvailability(w, req)
+	assert.Equal(t, http.StatusBadRequest, w.Code)
+	assert.NotContains(t, w.Body.String(), sentinel,
+		"interval_minutes raw value must not be reflected back to the client")
+}
+
 // Test handler types
 func TestAvailabilityRequest_Fields(t *testing.T) {
 	req := AvailabilityRequest{
diff --git a/internal/air/handlers_bundles.go b/internal/air/handlers_bundles.go
index acf3530..d27292b 100644
--- a/internal/air/handlers_bundles.go
+++ b/internal/air/handlers_bundles.go
@@ -2,6 +2,7 @@ package air
 
 import (
 	"encoding/json"
+	"log/slog"
 	"net/http"
 	"regexp"
 	"strconv"
@@ -323,7 +324,8 @@ func (s *Server) handleUpdateBundle(w http.ResponseWriter, r *http.Request) {
 
 	for i, rule := range bundle.Rules {
 		if err := validateBundleRule(rule); err != nil {
-			http.Error(w, "Invalid regex in rule "+strconv.Itoa(i)+": "+err.Error(), http.StatusBadRequest)
+			slog.Warn("invalid bundle rule regex", "rule_index", i, "err", err)
+			http.Error(w, "Invalid regex in rule "+strconv.Itoa(i), http.StatusBadRequest)
 			return
 		}
 	}
diff --git a/internal/air/handlers_email.go b/internal/air/handlers_email.go
index b3d011d..18311fc 100644
--- a/internal/air/handlers_email.go
+++ b/internal/air/handlers_email.go
@@ -1,12 +1,9 @@
 package air
 
 import (
-	"context"
-	"errors"
-	"net"
+	"log/slog"
 	"net/http"
 	"strings"
-	"time"
 
 	"github.com/nylas/cli/internal/air/cache"
 	"github.com/nylas/cli/internal/domain"
@@ -123,20 +120,28 @@ func (s *Server) handleListEmails(w http.ResponseWriter, r *http.Request) {
 				return
 			}
 		}
-		writeJSON(w, http.StatusInternalServerError, map[string]string{
-			"error": "Failed to fetch emails: " + err.Error(),
-		})
+		writeUpstreamError(w, http.StatusInternalServerError,
+			"Failed to fetch emails — please try again", err,
+			"account", redactEmail(accountEmail))
 		return
 	}
 
-	// Cache the results
+	// Cache the results. Cache write failures must not fail the request
+	// (the user already has the data), but a silently-wedged cache will
+	// drift further from server state on every refresh, so we log the
+	// first put error per request to keep the failure debuggable.
 	if s.cacheAvailable() {
-		_ = s.withEmailStore(accountEmail, func(store *cache.EmailStore) error {
+		if cacheErr := s.withEmailStore(accountEmail, func(store *cache.EmailStore) error {
+			var firstErr error
 			for i := range result.Data {
-				_ = store.Put(domainMessageToCached(&result.Data[i]))
+				if putErr := store.Put(domainMessageToCached(&result.Data[i])); putErr != nil && firstErr == nil {
+					firstErr = putErr
+				}
 			}
-			return nil
-		})
+			return firstErr
+		}); cacheErr != nil {
+			slog.Warn("email list cache fill failed", "account", redactEmail(accountEmail), "err", cacheErr)
+		}
 	}
 
 	// Convert to response format
@@ -158,7 +163,7 @@ func (s *Server) handleEmailByID(w http.ResponseWriter, r *http.Request) {
 	path := strings.TrimPrefix(r.URL.Path, "/api/emails/")
 	parts := strings.Split(path, "/")
 	if len(parts) == 0 || parts[0] == "" {
-		http.Error(w, "Email ID required", http.StatusBadRequest)
+		writeError(w, http.StatusBadRequest, "Email ID required")
 		return
 	}
 	emailID := parts[0]
@@ -169,6 +174,13 @@ func (s *Server) handleEmailByID(w http.ResponseWriter, r *http.Request) {
 		s.handleEmailInvite(w, r, emailID)
 		return
 	}
+	// Sub-resource: /api/emails/{id}/rsvp accepts {status: yes|no|maybe}
+	// and forwards to the Nylas send-rsvp endpoint after resolving the
+	// invite's iCalendar UID to a Nylas event.
+	if len(parts) > 1 && parts[1] == "rsvp" {
+		s.handleEmailRSVP(w, r, emailID)
+		return
+	}
 
 	switch r.Method {
 	case http.MethodGet:
@@ -178,7 +190,7 @@ func (s *Server) handleEmailByID(w http.ResponseWriter, r *http.Request) {
 	case http.MethodDelete:
 		s.handleDeleteEmail(w, r, emailID)
 	default:
-		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		writeError(w, http.StatusMethodNotAllowed, "Method not allowed")
 	}
 }
 
@@ -238,17 +250,25 @@ func (s *Server) handleGetEmail(w http.ResponseWriter, r *http.Request, emailID
 				return
 			}
 		}
-		writeJSON(w, http.StatusInternalServerError, map[string]string{
-			"error": "Failed to fetch email: " + err.Error(),
-		})
+		writeUpstreamError(w, http.StatusInternalServerError,
+			"Failed to fetch email — please try again", err,
+			"emailID", emailID, "account", redactEmail(accountEmail))
 		return
 	}
 
-	// Cache the result
+	// Cache the result. A wedged single-message cache silently drifts
+	// from server state on every fetch otherwise; mirror the
+	// handleListEmails:Cache fill failed log so support can diagnose
+	// from production logs without changing the user-facing 200.
 	if s.cacheAvailable() {
-		_ = s.withEmailStore(accountEmail, func(store *cache.EmailStore) error {
+		if err := s.withEmailStore(accountEmail, func(store *cache.EmailStore) error {
 			return store.Put(domainMessageToCached(msg))
-		})
+		}); err != nil {
+			slog.Warn("get-email cache fill failed",
+				"emailID", emailID,
+				"account", redactEmail(accountEmail),
+				"err", err)
+		}
 	}
 
 	writeJSON(w, http.StatusOK, emailToResponse(*msg, true))
@@ -285,13 +305,24 @@ func (s *Server) handleUpdateEmail(w http.ResponseWriter, r *http.Request, email
 				Message: "Email update queued until connection is restored",
 			})
 			return
+		} else {
+			// Offline AND the queue is broken. Falling through to the live
+			// API call is a best-effort retry (IsOnline() can be stale),
+			// but the queue failure itself must not be invisible — a
+			// silently-wedged queue will drop user actions repeatedly.
+			slog.Warn("offline enqueue failed, attempting live API call",
+				"emailID", emailID,
+				"account", redactEmail(accountEmail),
+				"err", err,
+			)
 		}
 	}
 
 	_, err := s.nylasClient.UpdateMessage(ctx, grantID, emailID, updateReq)
 	if err != nil {
 		if s.shouldQueueEmailAction(err) {
-			if queueErr := s.enqueueMessageUpdate(grantID, accountEmail, emailID, updateReq); queueErr == nil {
+			queueErr := s.enqueueMessageUpdate(grantID, accountEmail, emailID, updateReq)
+			if queueErr == nil {
 				s.SetOnline(false)
 				s.updateCachedEmail(accountEmail, emailID, req.Unread, req.Starred, req.Folders)
 				writeJSON(w, http.StatusOK, UpdateEmailResponse{
@@ -300,10 +331,27 @@ func (s *Server) handleUpdateEmail(w http.ResponseWriter, r *http.Request, email
 				})
 				return
 			}
+			// Queue write failed under a known-transient upstream error —
+			// the user is about to see a 500, but they also lost the
+			// fallback path that would have stashed their action. Log so
+			// the queue health regression is debuggable.
+			slog.Error("queue enqueue after transient API error failed",
+				"emailID", emailID,
+				"account", redactEmail(accountEmail),
+				"apiErr", err,
+				"queueErr", queueErr,
+			)
 		}
+		// UpdateEmailResponse envelope — frontend reads `error`. Raw err
+		// is logged, generic message goes to the user.
+		slog.Error("Failed to update email",
+			"err", err,
+			"emailID", emailID,
+			"account", redactEmail(accountEmail),
+		)
 		writeJSON(w, http.StatusInternalServerError, UpdateEmailResponse{
 			Success: false,
-			Error:   "Failed to update email: " + err.Error(),
+			Error:   "Failed to update email — please try again",
 		})
 		return
 	}
@@ -336,6 +384,17 @@ func (s *Server) handleDeleteEmail(w http.ResponseWriter, r *http.Request, email
 				Message: "Email delete queued until connection is restored",
 			})
 			return
+		} else {
+			// Offline AND the queue is broken. Falling through to the live
+			// API call is a best-effort retry (IsOnline() can be stale),
+			// but the queue failure itself must not be invisible — a
+			// silently-wedged queue will drop user actions repeatedly.
+			// Mirrors handleUpdateEmail's offline-enqueue log.
+			slog.Warn("offline enqueue failed, attempting live API call",
+				"emailID", emailID,
+				"account", redactEmail(accountEmail),
+				"err", err,
+			)
 		}
 	}
 
@@ -350,11 +409,27 @@ func (s *Server) handleDeleteEmail(w http.ResponseWriter, r *http.Request, email
 					Message: "Email delete queued until connection is restored",
 				})
 				return
+			} else {
+				// Queue write failed under a known-transient upstream
+				// error. The user is about to see a 500 AND lost the
+				// fallback path. Co-log apiErr + queueErr so the
+				// double-failure is debuggable. Mirrors handleUpdateEmail.
+				slog.Error("queue enqueue after transient API error failed",
+					"emailID", emailID,
+					"account", redactEmail(accountEmail),
+					"apiErr", err,
+					"queueErr", queueErr,
+				)
 			}
 		}
+		slog.Error("Failed to delete email",
+			"err", err,
+			"emailID", emailID,
+			"account", redactEmail(accountEmail),
+		)
 		writeJSON(w, http.StatusInternalServerError, UpdateEmailResponse{
 			Success: false,
-			Error:   "Failed to delete email: " + err.Error(),
+			Error:   "Failed to delete email — please try again",
 		})
 		return
 	}
@@ -405,70 +480,6 @@ func cachedEmailsToResponse(cached []*cache.CachedEmail, limit int) EmailsRespon
 	return resp
 }
 
-func (s *Server) shouldQueueEmailAction(err error) bool {
-	if !s.offlineQueueEnabled() {
-		return false
-	}
-	if !s.IsOnline() {
-		return true
-	}
-	var netErr net.Error
-	return errors.As(err, &netErr) || errors.Is(err, context.DeadlineExceeded)
-}
-
-func (s *Server) offlineQueueEnabled() bool {
-	return s.offlineQueueConfigured()
-}
-
-func (s *Server) enqueueMessageUpdate(grantID, accountEmail, emailID string, updateReq *domain.UpdateMessageRequest) error {
-	if accountEmail == "" || !s.offlineQueueEnabled() {
-		return errors.New("offline queue unavailable")
-	}
-
-	return s.withOfflineQueue(accountEmail, func(queue *cache.OfflineQueue) error {
-		return queue.Enqueue(cache.ActionUpdateMessage, emailID, cache.UpdateMessagePayload{
-			GrantID: grantID,
-			EmailID: emailID,
-			Unread:  updateReq.Unread,
-			Starred: updateReq.Starred,
-			Folders: updateReq.Folders,
-		})
-	})
-}
-
-func (s *Server) enqueueMessageDelete(grantID, accountEmail, emailID string) error {
-	if accountEmail == "" || !s.offlineQueueEnabled() {
-		return errors.New("offline queue unavailable")
-	}
-
-	return s.withOfflineQueue(accountEmail, func(queue *cache.OfflineQueue) error {
-		return queue.Enqueue(cache.ActionDelete, emailID, cache.DeleteMessagePayload{
-			GrantID: grantID,
-			EmailID: emailID,
-		})
-	})
-}
-
-func (s *Server) updateCachedEmail(accountEmail, emailID string, unread, starred *bool, folders []string) {
-	if accountEmail == "" || !s.cacheAvailable() {
-		return
-	}
-
-	_ = s.withEmailStore(accountEmail, func(store *cache.EmailStore) error {
-		return store.UpdateMessage(emailID, unread, starred, folders)
-	})
-}
-
-func (s *Server) deleteCachedEmail(accountEmail, emailID string) {
-	if accountEmail == "" || !s.cacheAvailable() {
-		return
-	}
-
-	_ = s.withEmailStore(accountEmail, func(store *cache.EmailStore) error {
-		return store.Delete(emailID)
-	})
-}
-
 // emailToResponse converts a domain message to an API response.
 func emailToResponse(m domain.Message, includeBody bool) EmailResponse {
 	resp := EmailResponse{
@@ -547,225 +558,3 @@ func cachedEmailToResponse(e *cache.CachedEmail) EmailResponse {
 		Folders: []string{e.FolderID},
 	}
 }
-
-// demoEmails returns demo email data spread across multiple folders so the
-// sidebar (Inbox / Sent / Drafts / Archive / Trash) actually shows different
-// content per folder. Includes one calendar-invite (.ics) email so the
-// calendar-invite card UI has something to render.
-func demoEmails() []EmailResponse {
-	now := time.Now()
-	return []EmailResponse{
-		// Inbox
-		{
-			ID:      "demo-email-001",
-			Subject: "Q4 Product Roadmap Review",
-			Snippet: "Hi team, I've attached the updated roadmap for Q4...",
-			Body:    "<p>Hi team,</p><p>I've attached the updated roadmap for Q4. Please review the timeline changes and let me know if you have any concerns.</p>",
-			From:    []EmailParticipantResponse{{Name: "Sarah Chen", Email: "sarah.chen@company.com"}},
-			To:      []EmailParticipantResponse{{Name: "Team", Email: "team@company.com"}},
-			Date:    now.Add(-2 * time.Minute).Unix(),
-			Unread:  true,
-			Starred: true,
-			Folders: []string{"inbox"},
-			Attachments: []AttachmentResponse{
-				{ID: "att-001", Filename: "Q4_Roadmap_v2.pdf", ContentType: "application/pdf", Size: 2516582},
-			},
-		},
-		{
-			ID:      "demo-email-002",
-			Subject: "[nylas/cli] PR #142: Add focus time feature",
-			Snippet: "mergify[bot] merged 1 commit into main...",
-			From:    []EmailParticipantResponse{{Name: "GitHub", Email: "notifications@github.com"}},
-			To:      []EmailParticipantResponse{{Name: "You", Email: "you@example.com"}},
-			Date:    now.Add(-15 * time.Minute).Unix(),
-			Unread:  true,
-			Starred: false,
-			Folders: []string{"inbox"},
-		},
-		{
-			ID:      "demo-email-003",
-			Subject: "Re: Meeting Tomorrow",
-			Snippet: "That works for me. I'll send a calendar invite...",
-			From:    []EmailParticipantResponse{{Name: "Alex Johnson", Email: "demo@example.com"}},
-			To:      []EmailParticipantResponse{{Name: "You", Email: "you@example.com"}},
-			Date:    now.Add(-1 * time.Hour).Unix(),
-			Unread:  false,
-			Starred: false,
-			Folders: []string{"inbox"},
-		},
-		{
-			ID:      "demo-email-004",
-			Subject: "Your December invoice is ready",
-			Snippet: "Your invoice for December 2024 is now available...",
-			From:    []EmailParticipantResponse{{Name: "Stripe", Email: "billing@stripe.com"}},
-			To:      []EmailParticipantResponse{{Name: "You", Email: "you@example.com"}},
-			Date:    now.Add(-3 * time.Hour).Unix(),
-			Unread:  false,
-			Starred: true,
-			Folders: []string{"inbox"},
-		},
-		{
-			ID:      "demo-email-005",
-			Subject: "This week in design: AI tools reshaping...",
-			Snippet: "The latest trends, tools, and inspiration...",
-			From:    []EmailParticipantResponse{{Name: "Design Weekly", Email: "newsletter@designweekly.com"}},
-			To:      []EmailParticipantResponse{{Name: "You", Email: "you@example.com"}},
-			Date:    now.Add(-5 * time.Hour).Unix(),
-			Unread:  false,
-			Starred: false,
-			Folders: []string{"inbox"},
-		},
-		// Calendar invite (with .ics attachment)
-		{
-			ID:      "demo-email-invite-001",
-			Subject: "Event Invitation: Quarterly Sync",
-			Snippet: "You have received a calendar invitation: Quarterly Sync",
-			Body:    "<p>You have received a calendar invitation: <strong>Quarterly Sync</strong></p><p>Please let me know if this time works.</p>",
-			From:    []EmailParticipantResponse{{Name: "Priya Patel", Email: "priya@partner.example"}},
-			To:      []EmailParticipantResponse{{Name: "You", Email: "you@example.com"}},
-			Date:    now.Add(-30 * time.Minute).Unix(),
-			Unread:  true,
-			Starred: false,
-			Folders: []string{"inbox"},
-			Attachments: []AttachmentResponse{
-				{
-					ID:          "att-invite-001",
-					Filename:    "invite.ics",
-					ContentType: "text/calendar",
-					Size:        1024,
-				},
-			},
-		},
-		// Sent — explicitly more than one so we can prove the filter works.
-		{
-			ID:      "demo-email-sent-001",
-			Subject: "Re: Q4 Product Roadmap Review",
-			Snippet: "Thanks Sarah, here are my comments on the roadmap...",
-			Body:    "<p>Thanks Sarah,</p><p>Here are my comments on the roadmap. Looks good overall — happy to discuss the Q4 priorities live.</p>",
-			From:    []EmailParticipantResponse{{Name: "You", Email: "you@example.com"}},
-			To:      []EmailParticipantResponse{{Name: "Sarah Chen", Email: "sarah.chen@company.com"}},
-			Date:    now.Add(-1 * time.Hour).Unix(),
-			Folders: []string{"sent"},
-		},
-		{
-			ID:      "demo-email-sent-002",
-			Subject: "Pricing follow-up",
-			Snippet: "Hi Mike, sending the updated pricing sheet...",
-			Body:    "<p>Hi Mike,</p><p>Sending the updated pricing sheet as discussed. Let me know if you need any changes.</p>",
-			From:    []EmailParticipantResponse{{Name: "You", Email: "you@example.com"}},
-			To:      []EmailParticipantResponse{{Name: "Mike Johnson", Email: "mike@customer.example"}},
-			Date:    now.Add(-3 * time.Hour).Unix(),
-			Folders: []string{"sent"},
-		},
-		{
-			ID:      "demo-email-sent-003",
-			Subject: "Welcome to the team!",
-			Snippet: "Excited to have you joining us next Monday...",
-			Body:    "<p>Excited to have you joining us next Monday! Here's the on-boarding checklist.</p>",
-			From:    []EmailParticipantResponse{{Name: "You", Email: "you@example.com"}},
-			To:      []EmailParticipantResponse{{Name: "Jamie Lee", Email: "jamie@newhire.example"}},
-			Date:    now.Add(-1 * 24 * time.Hour).Unix(),
-			Folders: []string{"sent"},
-		},
-		// Drafts
-		{
-			ID:      "demo-email-draft-001",
-			Subject: "Draft: Proposal for Acme",
-			Snippet: "Hi Acme team, here's the rough proposal...",
-			Body:    "<p>Hi Acme team,</p><p>Here's the rough proposal — still working through the timeline section.</p>",
-			From:    []EmailParticipantResponse{{Name: "You", Email: "you@example.com"}},
-			To:      []EmailParticipantResponse{{Name: "Acme Procurement", Email: "buyers@acme.example"}},
-			Date:    now.Add(-4 * time.Hour).Unix(),
-			Folders: []string{"drafts"},
-		},
-		// Archive
-		{
-			ID:      "demo-email-archive-001",
-			Subject: "Confirmation: Subscription renewed",
-			Snippet: "Your annual subscription has been renewed...",
-			Body:    "<p>Your annual subscription has been renewed for another year.</p>",
-			From:    []EmailParticipantResponse{{Name: "Acme Billing", Email: "billing@acme.example"}},
-			To:      []EmailParticipantResponse{{Name: "You", Email: "you@example.com"}},
-			Date:    now.Add(-30 * 24 * time.Hour).Unix(),
-			Folders: []string{"archive"},
-		},
-		// Trash
-		{
-			ID:      "demo-email-trash-001",
-			Subject: "URGENT: Winning offer (don't miss out)",
-			Snippet: "You've been pre-selected for an exclusive offer...",
-			Body:    "<p>You've been pre-selected.</p>",
-			From:    []EmailParticipantResponse{{Name: "Promo Bot", Email: "deals@spammy.example"}},
-			To:      []EmailParticipantResponse{{Name: "You", Email: "you@example.com"}},
-			Date:    now.Add(-7 * 24 * time.Hour).Unix(),
-			Folders: []string{"trash"},
-		},
-	}
-}
-
-// filterDemoEmails applies folder/unread/starred filters to a demo email
-// list. Folder matching is case-insensitive against email.Folders entries
-// and against well-known aliases (e.g., "SENT" → "sent", "Sent Items"
-// → "sent"). Empty folder string means "no folder filter."
-func filterDemoEmails(emails []EmailResponse, folder string, onlyUnread, onlyStarred bool) []EmailResponse {
-	target := normalizeDemoFolder(folder)
-	out := make([]EmailResponse, 0, len(emails))
-	for _, e := range emails {
-		if onlyUnread && !e.Unread {
-			continue
-		}
-		if onlyStarred && !e.Starred {
-			continue
-		}
-		if target != "" && !demoEmailIsInFolder(e, target) {
-			continue
-		}
-		out = append(out, e)
-	}
-	return out
-}
-
-// normalizeDemoFolder turns a UI-supplied folder identifier (e.g., the
-// system-folder ID "SENT", the Microsoft display name "Sent Items", or the
-// canonical "sent") into the lowercase canonical name used in demoEmails.
-func normalizeDemoFolder(folder string) string {
-	f := strings.ToLower(strings.TrimSpace(folder))
-	switch f {
-	case "":
-		return ""
-	case "inbox":
-		return "inbox"
-	case "sent", "sent items", "sent mail":
-		return "sent"
-	case "drafts", "draft":
-		return "drafts"
-	case "archive", "all", "all mail":
-		return "archive"
-	case "trash", "deleted items", "deleted":
-		return "trash"
-	case "spam", "junk", "junk email":
-		return "spam"
-	case "starred":
-		return "starred"
-	default:
-		return f
-	}
-}
-
-// demoEmailIsInFolder reports whether the email is in `target` (already
-// canonicalised). Special-cases "starred" since starring is a flag, not a
-// folder. "all" never filters anything out.
-func demoEmailIsInFolder(e EmailResponse, target string) bool {
-	if target == "starred" {
-		return e.Starred
-	}
-	if target == "all" {
-		return true
-	}
-	for _, f := range e.Folders {
-		if strings.EqualFold(f, target) {
-			return true
-		}
-	}
-	return false
-}
diff --git a/internal/air/handlers_email_cache_runtime_test.go b/internal/air/handlers_email_cache_runtime_test.go
index 3da3838..7ef9967 100644
--- a/internal/air/handlers_email_cache_runtime_test.go
+++ b/internal/air/handlers_email_cache_runtime_test.go
@@ -636,10 +636,11 @@ func TestProcessOfflineQueues_UsesQueuedGrantID(t *testing.T) {
 				t.Helper()
 				unread := false
 				starred := true
+				folders := []string{"archive"}
 				if err := server.enqueueMessageUpdate("grant-123", accountEmail, "email-2", &domain.UpdateMessageRequest{
 					Unread:  &unread,
 					Starred: &starred,
-					Folders: []string{"archive"},
+					Folders: folders,
 				}); err != nil {
 					t.Fatalf("enqueue update: %v", err)
 				}
diff --git a/internal/air/handlers_email_demo.go b/internal/air/handlers_email_demo.go
new file mode 100644
index 0000000..b4d2720
--- /dev/null
+++ b/internal/air/handlers_email_demo.go
@@ -0,0 +1,237 @@
+package air
+
+import (
+	"strings"
+	"time"
+)
+
+// demoEmails returns demo email data spread across multiple folders so the
+// sidebar (Inbox / Sent / Drafts / Archive / Trash) actually shows different
+// content per folder. Includes one calendar-invite (.ics) email so the
+// calendar-invite card UI has something to render.
+func demoEmails() []EmailResponse {
+	now := time.Now()
+	return []EmailResponse{
+		// Inbox
+		{
+			ID:      "demo-email-001",
+			Subject: "Q4 Product Roadmap Review",
+			Snippet: "Hi team, I've attached the updated roadmap for Q4...",
+			Body:    "<p>Hi team,</p><p>I've attached the updated roadmap for Q4. Please review the timeline changes and let me know if you have any concerns.</p>",
+			From:    []EmailParticipantResponse{{Name: "Sarah Chen", Email: "sarah.chen@company.com"}},
+			To:      []EmailParticipantResponse{{Name: "Team", Email: "team@company.com"}},
+			Date:    now.Add(-2 * time.Minute).Unix(),
+			Unread:  true,
+			Starred: true,
+			Folders: []string{"inbox"},
+			Attachments: []AttachmentResponse{
+				{ID: "att-001", Filename: "Q4_Roadmap_v2.pdf", ContentType: "application/pdf", Size: 2516582},
+			},
+		},
+		{
+			ID:      "demo-email-002",
+			Subject: "[nylas/cli] PR #142: Add focus time feature",
+			Snippet: "mergify[bot] merged 1 commit into main...",
+			From:    []EmailParticipantResponse{{Name: "GitHub", Email: "notifications@github.com"}},
+			To:      []EmailParticipantResponse{{Name: "You", Email: "you@example.com"}},
+			Date:    now.Add(-15 * time.Minute).Unix(),
+			Unread:  true,
+			Starred: false,
+			Folders: []string{"inbox"},
+		},
+		{
+			ID:      "demo-email-003",
+			Subject: "Re: Meeting Tomorrow",
+			Snippet: "That works for me. I'll send a calendar invite...",
+			From:    []EmailParticipantResponse{{Name: "Alex Johnson", Email: "demo@example.com"}},
+			To:      []EmailParticipantResponse{{Name: "You", Email: "you@example.com"}},
+			Date:    now.Add(-1 * time.Hour).Unix(),
+			Unread:  false,
+			Starred: false,
+			Folders: []string{"inbox"},
+		},
+		{
+			ID:      "demo-email-004",
+			Subject: "Your December invoice is ready",
+			Snippet: "Your invoice for December 2024 is now available...",
+			From:    []EmailParticipantResponse{{Name: "Stripe", Email: "billing@stripe.com"}},
+			To:      []EmailParticipantResponse{{Name: "You", Email: "you@example.com"}},
+			Date:    now.Add(-3 * time.Hour).Unix(),
+			Unread:  false,
+			Starred: true,
+			Folders: []string{"inbox"},
+		},
+		{
+			ID:      "demo-email-005",
+			Subject: "This week in design: AI tools reshaping...",
+			Snippet: "The latest trends, tools, and inspiration...",
+			From:    []EmailParticipantResponse{{Name: "Design Weekly", Email: "newsletter@designweekly.com"}},
+			To:      []EmailParticipantResponse{{Name: "You", Email: "you@example.com"}},
+			Date:    now.Add(-5 * time.Hour).Unix(),
+			Unread:  false,
+			Starred: false,
+			Folders: []string{"inbox"},
+		},
+		// Calendar invite (with .ics attachment)
+		{
+			ID:      "demo-email-invite-001",
+			Subject: "Event Invitation: Quarterly Sync",
+			Snippet: "You have received a calendar invitation: Quarterly Sync",
+			Body:    "<p>You have received a calendar invitation: <strong>Quarterly Sync</strong></p><p>Please let me know if this time works.</p>",
+			From:    []EmailParticipantResponse{{Name: "Priya Patel", Email: "priya@partner.example"}},
+			To:      []EmailParticipantResponse{{Name: "You", Email: "you@example.com"}},
+			Date:    now.Add(-30 * time.Minute).Unix(),
+			Unread:  true,
+			Starred: false,
+			Folders: []string{"inbox"},
+			Attachments: []AttachmentResponse{
+				{
+					ID:          "att-invite-001",
+					Filename:    "invite.ics",
+					ContentType: "text/calendar",
+					Size:        1024,
+				},
+			},
+		},
+		// Sent — explicitly more than one so we can prove the filter works.
+		{
+			ID:      "demo-email-sent-001",
+			Subject: "Re: Q4 Product Roadmap Review",
+			Snippet: "Thanks Sarah, here are my comments on the roadmap...",
+			Body:    "<p>Thanks Sarah,</p><p>Here are my comments on the roadmap. Looks good overall — happy to discuss the Q4 priorities live.</p>",
+			From:    []EmailParticipantResponse{{Name: "You", Email: "you@example.com"}},
+			To:      []EmailParticipantResponse{{Name: "Sarah Chen", Email: "sarah.chen@company.com"}},
+			Date:    now.Add(-1 * time.Hour).Unix(),
+			Folders: []string{"sent"},
+		},
+		{
+			ID:      "demo-email-sent-002",
+			Subject: "Pricing follow-up",
+			Snippet: "Hi Mike, sending the updated pricing sheet...",
+			Body:    "<p>Hi Mike,</p><p>Sending the updated pricing sheet as discussed. Let me know if you need any changes.</p>",
+			From:    []EmailParticipantResponse{{Name: "You", Email: "you@example.com"}},
+			To:      []EmailParticipantResponse{{Name: "Mike Johnson", Email: "mike@customer.example"}},
+			Date:    now.Add(-3 * time.Hour).Unix(),
+			Folders: []string{"sent"},
+		},
+		{
+			ID:      "demo-email-sent-003",
+			Subject: "Welcome to the team!",
+			Snippet: "Excited to have you joining us next Monday...",
+			Body:    "<p>Excited to have you joining us next Monday! Here's the on-boarding checklist.</p>",
+			From:    []EmailParticipantResponse{{Name: "You", Email: "you@example.com"}},
+			To:      []EmailParticipantResponse{{Name: "Jamie Lee", Email: "jamie@newhire.example"}},
+			Date:    now.Add(-1 * 24 * time.Hour).Unix(),
+			Folders: []string{"sent"},
+		},
+		// Drafts
+		{
+			ID:      "demo-email-draft-001",
+			Subject: "Draft: Proposal for Acme",
+			Snippet: "Hi Acme team, here's the rough proposal...",
+			Body:    "<p>Hi Acme team,</p><p>Here's the rough proposal — still working through the timeline section.</p>",
+			From:    []EmailParticipantResponse{{Name: "You", Email: "you@example.com"}},
+			To:      []EmailParticipantResponse{{Name: "Acme Procurement", Email: "buyers@acme.example"}},
+			Date:    now.Add(-4 * time.Hour).Unix(),
+			Folders: []string{"drafts"},
+		},
+		// Archive
+		{
+			ID:      "demo-email-archive-001",
+			Subject: "Confirmation: Subscription renewed",
+			Snippet: "Your annual subscription has been renewed...",
+			Body:    "<p>Your annual subscription has been renewed for another year.</p>",
+			From:    []EmailParticipantResponse{{Name: "Acme Billing", Email: "billing@acme.example"}},
+			To:      []EmailParticipantResponse{{Name: "You", Email: "you@example.com"}},
+			Date:    now.Add(-30 * 24 * time.Hour).Unix(),
+			Folders: []string{"archive"},
+		},
+		// Trash
+		{
+			ID:      "demo-email-trash-001",
+			Subject: "URGENT: Winning offer (don't miss out)",
+			Snippet: "You've been pre-selected for an exclusive offer...",
+			Body:    "<p>You've been pre-selected.</p>",
+			From:    []EmailParticipantResponse{{Name: "Promo Bot", Email: "deals@spammy.example"}},
+			To:      []EmailParticipantResponse{{Name: "You", Email: "you@example.com"}},
+			Date:    now.Add(-7 * 24 * time.Hour).Unix(),
+			Folders: []string{"trash"},
+		},
+	}
+}
+
+// filterDemoEmails applies folder/unread/starred filters to a demo email
+// list. Folder matching is case-insensitive against email.Folders entries
+// and against well-known aliases (e.g., "SENT" → "sent", "Sent Items"
+// → "sent"). Empty folder string means "no folder filter."
+func filterDemoEmails(emails []EmailResponse, folder string, onlyUnread, onlyStarred bool) []EmailResponse {
+	target := normalizeDemoFolder(folder)
+	out := make([]EmailResponse, 0, len(emails))
+	for _, e := range emails {
+		if onlyUnread && !e.Unread {
+			continue
+		}
+		if onlyStarred && !e.Starred {
+			continue
+		}
+		if target != "" && !demoEmailIsInFolder(e, target) {
+			continue
+		}
+		out = append(out, e)
+	}
+	return out
+}
+
+// normalizeDemoFolder turns a UI-supplied folder identifier (e.g., the
+// system-folder ID "SENT", the Microsoft display name "Sent Items", or the
+// canonical "sent") into the lowercase canonical name used in demoEmails.
+//
+// "all" and "all mail" route to the dedicated "all" target rather than
+// collapsing into "archive": Gmail's "All Mail" view shows every
+// message regardless of folder, and demoEmailIsInFolder's `target ==
+// "all"` branch matches that semantic. Aliasing them to "archive"
+// instead would surface only the single demo email tagged with the
+// archive folder, which is wrong end-user behavior.
+func normalizeDemoFolder(folder string) string {
+	f := strings.ToLower(strings.TrimSpace(folder))
+	switch f {
+	case "":
+		return ""
+	case "inbox":
+		return "inbox"
+	case "sent", "sent items", "sent mail":
+		return "sent"
+	case "drafts", "draft":
+		return "drafts"
+	case "archive":
+		return "archive"
+	case "all", "all mail":
+		return "all"
+	case "trash", "deleted items", "deleted":
+		return "trash"
+	case "spam", "junk", "junk email":
+		return "spam"
+	case "starred":
+		return "starred"
+	default:
+		return f
+	}
+}
+
+// demoEmailIsInFolder reports whether the email is in `target` (already
+// canonicalised). Special-cases "starred" since starring is a flag, not a
+// folder. "all" never filters anything out.
+func demoEmailIsInFolder(e EmailResponse, target string) bool {
+	if target == "starred" {
+		return e.Starred
+	}
+	if target == "all" {
+		return true
+	}
+	for _, f := range e.Folders {
+		if strings.EqualFold(f, target) {
+			return true
+		}
+	}
+	return false
+}
diff --git a/internal/air/handlers_email_invite.go b/internal/air/handlers_email_invite.go
index eb028e6..7e056c1 100644
--- a/internal/air/handlers_email_invite.go
+++ b/internal/air/handlers_email_invite.go
@@ -3,7 +3,9 @@ package air
 import (
 	"context"
 	"errors"
+	"fmt"
 	"io"
+	"log/slog"
 	"net/http"
 	"strings"
 	"time"
@@ -23,6 +25,7 @@ type CalendarInviteResponse struct {
 	HasInvite       bool             `json:"has_invite"`
 	AttachmentID    string           `json:"attachment_id,omitempty"`
 	Filename        string           `json:"filename,omitempty"`
+	ICalUID         string           `json:"ical_uid,omitempty"` // VEVENT UID; lets the RSVP endpoint resolve a Nylas event ID
 	Title           string           `json:"title,omitempty"`
 	Location        string           `json:"location,omitempty"`
 	Description     string           `json:"description,omitempty"`
@@ -50,14 +53,20 @@ type InviteAttendee struct {
 	IsOrganizer bool   `json:"is_organizer,omitempty"`
 }
 
+// errInviteFetchFailed flags a transient upstream failure on the second
+// raw_mime fetch (the fallback after attachment download fails). Callers
+// distinguish it from "the email simply has no invite" so they can choose
+// between silent degrade (preview card) and 502 (RSVP — the user is
+// actively trying to do something and deserves an actionable error).
+var errInviteFetchFailed = errors.New("invite: failed to fetch raw_mime")
+
 // handleEmailInvite returns parsed iCalendar invite data for an email.
-// Resolution order:
-//  1. attachments[] entry with text/calendar or .ics filename — Microsoft,
-//     custom senders typically arrive this way.
-//  2. inline text/calendar part inside raw_mime (Gmail's invitation
-//     shape — the ICS rides as a multipart/alternative leaf).
-//
-// Returns has_invite=false when neither path yields a calendar payload.
+// Returns has_invite=false when neither attachments[] nor raw_mime yields
+// a calendar payload — the frontend silently degrades to the regular
+// email render in that case. Transient raw_mime fetch failures are also
+// silently degraded here so a flaky upstream doesn't break the inbox
+// view; the RSVP endpoint surfaces the same condition as 502 because the
+// user is actively trying to act on the invite.
 func (s *Server) handleEmailInvite(w http.ResponseWriter, r *http.Request, emailID string) {
 	if !requireMethod(w, r, http.MethodGet) {
 		return
@@ -76,19 +85,42 @@ func (s *Server) handleEmailInvite(w http.ResponseWriter, r *http.Request, email
 	ctx, cancel := s.withTimeout(r)
 	defer cancel()
 
-	msg, err := s.nylasClient.GetMessage(ctx, grantID, emailID)
+	resp, err := s.resolveEmailInvite(ctx, grantID, emailID)
 	if err != nil {
-		writeError(w, http.StatusInternalServerError, "Failed to fetch email: "+err.Error())
+		// Preserve the legacy "preview card silently disappears" UX even
+		// when raw_mime can't be fetched. Only the initial GetMessage
+		// failure (a hard error) reaches here.
+		if errors.Is(err, errInviteFetchFailed) {
+			writeJSON(w, http.StatusOK, CalendarInviteResponse{HasInvite: false})
+			return
+		}
+		writeUpstreamError(w, http.StatusInternalServerError,
+			"Failed to fetch email — please try again", err,
+			"emailID", emailID)
 		return
 	}
+	writeJSON(w, http.StatusOK, resp)
+}
+
+// resolveEmailInvite parses a message's iCalendar invite, if any.
+// Resolution order:
+//  1. attachments[] with text/calendar or .ics (Microsoft/custom senders).
+//  2. inline text/calendar in raw_mime (Gmail's multipart/alternative shape).
+//
+// Returns HasInvite=false on no-invite. Non-nil error only on initial
+// GetMessage failure — attachment-download and raw_mime errors are swallowed.
+func (s *Server) resolveEmailInvite(ctx context.Context, grantID, emailID string) (CalendarInviteResponse, error) {
+	msg, err := s.nylasClient.GetMessage(ctx, grantID, emailID)
+	if err != nil {
+		return CalendarInviteResponse{}, err
+	}
 
 	att := findCalendarAttachment(msg.Attachments)
 	if att != nil {
 		if parsed, ok := s.tryParseAttachmentInvite(ctx, grantID, emailID, att); ok {
-			writeJSON(w, http.StatusOK, parsed)
-			return
+			return parsed, nil
 		}
-		// Download or parse failed. Don't surface a 5xx — Nylas
+		// Download or parse failed. Don't surface as an error — Nylas
 		// frequently returns synthetic attachment IDs (v0:base64(...):...)
 		// that look like real attachments but cannot be downloaded.
 		// Falling through to the raw_mime walker recovers the calendar
@@ -97,22 +129,28 @@ func (s *Server) handleEmailInvite(w http.ResponseWriter, r *http.Request, email
 
 	// Fetch raw MIME and look for a text/calendar part — both Gmail's
 	// inline-multipart shape AND Nylas's "synthetic attachment that
-	// can't be downloaded" case land here.
+	// can't be downloaded" case land here. A network error on this call
+	// is *transient* and distinguishable from "email has no invite", so
+	// we surface it as errInviteFetchFailed: callers in actionable paths
+	// (RSVP) can return 502, while the preview path silently degrades.
 	full, err := s.nylasClient.GetMessageWithFields(ctx, grantID, emailID, "raw_mime")
-	if err != nil || full == nil || full.RawMIME == "" {
-		writeJSON(w, http.StatusOK, CalendarInviteResponse{HasInvite: false})
-		return
+	if err != nil {
+		// Double-wrap so callers can errors.Is against errInviteFetchFailed
+		// (the sentinel) AND unwrap the underlying transport error for
+		// logging. Go 1.20+ supports multiple %w in a single Errorf.
+		return CalendarInviteResponse{}, fmt.Errorf("%w: %w", errInviteFetchFailed, err)
+	}
+	if full == nil || full.RawMIME == "" {
+		return CalendarInviteResponse{HasInvite: false}, nil
 	}
 	parts := findInlineCalendarParts(full.RawMIME)
 	if len(parts) == 0 {
-		writeJSON(w, http.StatusOK, CalendarInviteResponse{HasInvite: false})
-		return
+		return CalendarInviteResponse{HasInvite: false}, nil
 	}
 
 	parsed, err := parseICS(parts[0].Body)
 	if err != nil {
-		writeJSON(w, http.StatusOK, CalendarInviteResponse{HasInvite: false})
-		return
+		return CalendarInviteResponse{HasInvite: false}, nil
 	}
 	parsed.HasInvite = true
 	// If we had a Nylas attachment entry (even an undownloadable
@@ -133,28 +171,33 @@ func (s *Server) handleEmailInvite(w http.ResponseWriter, r *http.Request, email
 	if parsed.Method == "" && parts[0].Method != "" {
 		parsed.Method = parts[0].Method
 	}
-	writeJSON(w, http.StatusOK, parsed)
+	return parsed, nil
 }
 
-// tryParseAttachmentInvite attempts the legacy path: download an ICS
-// attachment via the Nylas attachments endpoint and parse it. Returns
-// ok=false on any failure so the caller can fall back to raw_mime.
-// Errors are intentionally swallowed: we don't want 5xxs for transient
-// download problems when the calendar payload is recoverable from MIME.
+// tryParseAttachmentInvite downloads and parses an ICS attachment.
+// Returns ok=false on any failure so the caller falls back to raw_mime;
+// each failure logs at slog.Debug for diagnosability.
 func (s *Server) tryParseAttachmentInvite(ctx context.Context, grantID, emailID string, att *domain.Attachment) (CalendarInviteResponse, bool) {
 	body, err := s.nylasClient.DownloadAttachment(ctx, grantID, emailID, att.ID)
 	if err != nil {
+		slog.Debug("invite attachment download failed",
+			"attachment_id", att.ID, "filename", att.Filename, "err", err)
 		return CalendarInviteResponse{}, false
 	}
 	defer func() { _ = body.Close() }()
 
 	raw, err := io.ReadAll(io.LimitReader(body, maxICSBytes+1))
 	if err != nil || len(raw) > maxICSBytes {
+		slog.Debug("invite attachment read failed or oversized",
+			"attachment_id", att.ID, "filename", att.Filename,
+			"size", len(raw), "max", maxICSBytes, "err", err)
 		return CalendarInviteResponse{}, false
 	}
 
 	parsed, err := parseICS(string(raw))
 	if err != nil {
+		slog.Debug("invite attachment ICS parse failed",
+			"attachment_id", att.ID, "filename", att.Filename, "err", err)
 		return CalendarInviteResponse{}, false
 	}
 	parsed.HasInvite = true
@@ -227,6 +270,7 @@ func demoInviteFor(emailID string) CalendarInviteResponse {
 		HasInvite:       true,
 		AttachmentID:    "att-invite-001",
 		Filename:        "invite.ics",
+		ICalUID:         "demo-invite-001@nylas.example",
 		Title:           "Quarterly Sync",
 		Location:        "Conference Room A / Online",
 		Description:     "Quarterly review with the partner team.",
diff --git a/internal/air/handlers_email_invite_handler_test.go b/internal/air/handlers_email_invite_handler_test.go
index 3275ba5..33d3f76 100644
--- a/internal/air/handlers_email_invite_handler_test.go
+++ b/internal/air/handlers_email_invite_handler_test.go
@@ -307,3 +307,27 @@ func TestParseICS_CancelMethod(t *testing.T) {
 		t.Errorf("Status=%q, want CANCELLED", resp.Status)
 	}
 }
+
+// TestParseICS_ClampsOversizedUID pins the UID-length cap. A hostile
+// inviter could craft a multi-MB UID; without the clamp we'd round-trip
+// it into the Nylas ical_uid query parameter and form a giant URL. The
+// prefix is kept (so the lookup can still succeed for legitimate long
+// UIDs that happen to share a prefix) but the byte budget is bounded.
+func TestParseICS_ClampsOversizedUID(t *testing.T) {
+	huge := strings.Repeat("a", 64*1024) // 64KB UID
+	body := "BEGIN:VCALENDAR\r\nVERSION:2.0\r\nPRODID:-//T//EN\r\nMETHOD:REQUEST\r\n" +
+		"BEGIN:VEVENT\r\nUID:" + huge + "\r\nSUMMARY:OversizedUID\r\n" +
+		"DTSTART:20260501T140000Z\r\nDTEND:20260501T150000Z\r\n" +
+		"END:VEVENT\r\nEND:VCALENDAR\r\n"
+
+	resp, err := parseICS(body)
+	if err != nil {
+		t.Fatalf("parseICS: %v", err)
+	}
+	if got := len(resp.ICalUID); got > 1024 {
+		t.Errorf("ICalUID len=%d, want <=1024 after clamp", got)
+	}
+	if !strings.HasPrefix(huge, resp.ICalUID) {
+		t.Errorf("ICalUID=%q does not look like a prefix of the input", resp.ICalUID)
+	}
+}
diff --git a/internal/air/handlers_email_invite_parse.go b/internal/air/handlers_email_invite_parse.go
index 8aec508..bca7386 100644
--- a/internal/air/handlers_email_invite_parse.go
+++ b/internal/air/handlers_email_invite_parse.go
@@ -1,12 +1,18 @@
 package air
 
 import (
-	"errors"
 	"strings"
 
 	ical "github.com/arran4/golang-ical"
 )
 
+// maxICalUIDBytes caps the iCalendar UID we will round-trip into Nylas
+// query parameters. RFC 5545 doesn't define a maximum, but a hostile
+// inviter could craft a multi-MB UID — URL-encoded that becomes a giant
+// query string. 1KB comfortably covers Outlook's 200-char defaults and
+// Google's 100-byte UIDs while clamping the worst case.
+const maxICalUIDBytes = 1024
+
 // parseICS parses an iCalendar payload and returns the first VEVENT in a
 // shape the Air invite card understands. Backed by golang-ical so we
 // inherit RFC 5545 line-folding, TZID resolution, ATTENDEE parsing, and
@@ -59,6 +65,16 @@ func calendarMethod(cal *ical.Calendar) string {
 func mapVEvent(ev *ical.VEvent) CalendarInviteResponse {
 	var resp CalendarInviteResponse
 
+	if p := ev.GetProperty(ical.ComponentPropertyUniqueId); p != nil {
+		uid := strings.TrimSpace(p.Value)
+		// Clamp pathological UIDs. A UID we cannot trust is preferable to
+		// dropping the invite, so keep the prefix and let the downstream
+		// ical_uid filter still find the event.
+		if len(uid) > maxICalUIDBytes {
+			uid = uid[:maxICalUIDBytes]
+		}
+		resp.ICalUID = uid
+	}
 	if p := ev.GetProperty(ical.ComponentPropertySummary); p != nil {
 		resp.Title = p.Value
 	}
@@ -193,7 +209,3 @@ func firstParam(params map[string][]string, key string) string {
 	}
 	return ""
 }
-
-// Sanity check that errNoUsableEvent is wired — a regression where the
-// parser silently ignored bad input would let the UI render a blank card.
-var _ = errors.New
diff --git a/internal/air/handlers_email_invite_silent_failure_test.go b/internal/air/handlers_email_invite_silent_failure_test.go
new file mode 100644
index 0000000..1e3fd1e
--- /dev/null
+++ b/internal/air/handlers_email_invite_silent_failure_test.go
@@ -0,0 +1,172 @@
+package air
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/nylas/cli/internal/domain"
+	"github.com/stretchr/testify/assert"
+)
+
+// TestHandleEmailInvite_RealAttachmentDownloadFailure_LogsFailure pins
+// the silent-failure gap in tryParseAttachmentInvite
+// (handlers_email_invite.go:188-191). When DownloadAttachment fails on
+// a real (non-synthetic) attachment ID — e.g., a transient Nylas 5xx,
+// disk-full while streaming, decryption error — the function returns
+// (CalendarInviteResponse{}, false) with no log. The handler then
+// falls through to raw_mime, which is the right behavior for the user
+// (the invite card might still render via the inline path) but means
+// support cannot diagnose "RSVP card never appears for X.ics" without
+// knowing which leg of the parser failed.
+//
+// EXPECTED FAILURE today: handlers_email_invite.go:189-191 returns
+// silently. After the fix an slog Debug or Warn entry should record
+// the attachment ID and the underlying download error so a wedged
+// attachments endpoint shows up in production logs.
+func TestHandleEmailInvite_RealAttachmentDownloadFailure_LogsFailure(t *testing.T) {
+	// No t.Parallel — captureSlog mutates process-global slog default.
+	server, client, _ := newCachedTestServer(t)
+
+	const realAttID = "real-att-canary-DOWNLOAD-XYZ"
+	const downloadErrSentinel = "nylas-503-download-canary-7777"
+	client.GetMessageFunc = func(_ context.Context, _, msgID string) (*domain.Message, error) {
+		return &domain.Message{
+			ID:      msgID,
+			Subject: "Calendar invite",
+			Attachments: []domain.Attachment{
+				{ID: realAttID, Filename: "invite.ics", ContentType: "text/calendar"},
+			},
+		}, nil
+	}
+	client.DownloadAttachmentFunc = func(context.Context, string, string, string) (io.ReadCloser, error) {
+		return nil, errors.New(downloadErrSentinel)
+	}
+	// raw_mime fallback exists but does not contain a calendar part —
+	// confirms the handler completes (200 has_invite=false) while still
+	// expecting the download leg to have left a log breadcrumb.
+	client.GetMessageWithFieldsFunc = func(_ context.Context, _ string, msgID, _ string) (*domain.Message, error) {
+		return &domain.Message{ID: msgID, RawMIME: ""}, nil
+	}
+
+	logs := captureSlog(t)
+
+	r := httptest.NewRequest(http.MethodGet, "/api/emails/email-1/invite", http.NoBody)
+	w := httptest.NewRecorder()
+	server.handleEmailInvite(w, r, "email-1")
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s — silent fall-through must still produce a 200",
+			w.Code, w.Body.String())
+	}
+
+	got := logs.String()
+	assert.Contains(t, got, realAttID,
+		"slog must record the failed attachment ID for diagnosability; got %q", got)
+	assert.Contains(t, got, downloadErrSentinel,
+		"slog must record the underlying download error so transient Nylas "+
+			"failures are diagnosable; got %q", got)
+}
+
+// TestHandleEmailInvite_OversizedAttachment_LogsFailure pins the silent
+// drop at handlers_email_invite.go:194-197 — when the streamed body
+// exceeds maxICSBytes (or io.ReadAll returns an error), the function
+// silently returns false. An attacker-controlled multi-MB ICS would
+// land here with no record at all. Also covers the legitimate case
+// where Nylas (rarely) ships a misencoded attachment that streams much
+// larger than reported.
+//
+// EXPECTED FAILURE today: silent return. After the fix an slog Warn
+// should record the attID + filename so oversize-DOS attempts and
+// runaway attachments are visible.
+func TestHandleEmailInvite_OversizedAttachment_LogsFailure(t *testing.T) {
+	// No t.Parallel — captureSlog mutates process-global slog default.
+	server, client, _ := newCachedTestServer(t)
+
+	const fatAttID = "fat-att-canary-OVERSIZE-XYZ"
+	client.GetMessageFunc = func(_ context.Context, _, msgID string) (*domain.Message, error) {
+		return &domain.Message{
+			ID: msgID,
+			Attachments: []domain.Attachment{
+				{ID: fatAttID, Filename: "huge-invite.ics", ContentType: "text/calendar", Size: 1},
+			},
+		}, nil
+	}
+	// 1MB+1 of 'A' — exceeds maxICSBytes (1<<20 in handlers_email_invite.go),
+	// so the io.LimitReader read returns len(raw) == maxICSBytes+1, which
+	// trips the oversized-payload swallow at line ~194-197.
+	huge := strings.Repeat("A", (1<<20)+1)
+	client.DownloadAttachmentFunc = func(context.Context, string, string, string) (io.ReadCloser, error) {
+		return io.NopCloser(strings.NewReader(huge)), nil
+	}
+	client.GetMessageWithFieldsFunc = func(_ context.Context, _ string, msgID, _ string) (*domain.Message, error) {
+		return &domain.Message{ID: msgID, RawMIME: ""}, nil
+	}
+
+	logs := captureSlog(t)
+
+	r := httptest.NewRequest(http.MethodGet, "/api/emails/email-1/invite", http.NoBody)
+	w := httptest.NewRecorder()
+	server.handleEmailInvite(w, r, "email-1")
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s — silent fall-through must still produce a 200",
+			w.Code, w.Body.String())
+	}
+
+	got := logs.String()
+	assert.Contains(t, got, fatAttID,
+		"slog must record the oversize attachment ID — currently silent at "+
+			"handlers_email_invite.go:194-197; got %q", got)
+}
+
+// TestHandleEmailInvite_MalformedICS_LogsFailure pins the third silent
+// drop in tryParseAttachmentInvite (handlers_email_invite.go:199-202):
+// parseICS errors are swallowed entirely. A malformed calendar payload
+// should be visible to support, even if the user-facing path falls
+// through to raw_mime.
+//
+// EXPECTED FAILURE today: parseICS error returned without log. After
+// the fix an slog Debug entry should fire with the attachment ID and
+// the parse error so misencoded ICS payloads are diagnosable.
+func TestHandleEmailInvite_MalformedICS_LogsFailure(t *testing.T) {
+	// No t.Parallel — captureSlog mutates process-global slog default.
+	server, client, _ := newCachedTestServer(t)
+
+	const badICSAttID = "bad-ics-att-canary-PARSE-XYZ"
+	client.GetMessageFunc = func(_ context.Context, _, msgID string) (*domain.Message, error) {
+		return &domain.Message{
+			ID: msgID,
+			Attachments: []domain.Attachment{
+				{ID: badICSAttID, Filename: "broken.ics", ContentType: "text/calendar"},
+			},
+		}, nil
+	}
+	client.DownloadAttachmentFunc = func(context.Context, string, string, string) (io.ReadCloser, error) {
+		// Not a valid VCALENDAR — parseICS will error.
+		return io.NopCloser(strings.NewReader("THIS IS NOT VALID ICS PAYLOAD")), nil
+	}
+	client.GetMessageWithFieldsFunc = func(_ context.Context, _ string, msgID, _ string) (*domain.Message, error) {
+		return &domain.Message{ID: msgID, RawMIME: ""}, nil
+	}
+
+	logs := captureSlog(t)
+
+	r := httptest.NewRequest(http.MethodGet, "/api/emails/email-1/invite", http.NoBody)
+	w := httptest.NewRecorder()
+	server.handleEmailInvite(w, r, "email-1")
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s — silent fall-through must still produce a 200",
+			w.Code, w.Body.String())
+	}
+
+	got := logs.String()
+	assert.Contains(t, got, badICSAttID,
+		"slog must record the malformed-ICS attachment ID — currently silent at "+
+			"handlers_email_invite.go:199-202; got %q", got)
+}
diff --git a/internal/air/handlers_email_offline.go b/internal/air/handlers_email_offline.go
new file mode 100644
index 0000000..e012de7
--- /dev/null
+++ b/internal/air/handlers_email_offline.go
@@ -0,0 +1,83 @@
+package air
+
+import (
+	"context"
+	"errors"
+	"log/slog"
+	"net"
+
+	"github.com/nylas/cli/internal/air/cache"
+	"github.com/nylas/cli/internal/domain"
+)
+
+// shouldQueueEmailAction reports whether an upstream API failure should
+// route through the offline queue. The queue must be enabled (cache is
+// configured AND queueing is opted in), and the failure has to look like
+// a transient network/timeout problem — application errors (4xx) flow
+// straight back to the caller.
+func (s *Server) shouldQueueEmailAction(err error) bool {
+	if !s.offlineQueueEnabled() {
+		return false
+	}
+	if !s.IsOnline() {
+		return true
+	}
+	var netErr net.Error
+	return errors.As(err, &netErr) || errors.Is(err, context.DeadlineExceeded)
+}
+
+func (s *Server) enqueueMessageUpdate(grantID, accountEmail, emailID string, updateReq *domain.UpdateMessageRequest) error {
+	if accountEmail == "" || !s.offlineQueueEnabled() {
+		return errors.New("offline queue unavailable")
+	}
+
+	return s.withOfflineQueue(accountEmail, func(queue *cache.OfflineQueue) error {
+		return queue.Enqueue(cache.ActionUpdateMessage, emailID, cache.UpdateMessagePayload{
+			GrantID: grantID,
+			EmailID: emailID,
+			Unread:  updateReq.Unread,
+			Starred: updateReq.Starred,
+			Folders: updateReq.Folders,
+		})
+	})
+}
+
+func (s *Server) enqueueMessageDelete(grantID, accountEmail, emailID string) error {
+	if accountEmail == "" || !s.offlineQueueEnabled() {
+		return errors.New("offline queue unavailable")
+	}
+
+	return s.withOfflineQueue(accountEmail, func(queue *cache.OfflineQueue) error {
+		return queue.Enqueue(cache.ActionDelete, emailID, cache.DeleteMessagePayload{
+			GrantID: grantID,
+			EmailID: emailID,
+		})
+	})
+}
+
+// updateCachedEmail mirrors a remote update into the local cache.
+// Cache write failures are logged but never bubbled — the live update
+// already succeeded. folders nil = leave alone; non-nil = set.
+func (s *Server) updateCachedEmail(accountEmail, emailID string, unread, starred *bool, folders []string) {
+	if accountEmail == "" || !s.cacheAvailable() {
+		return
+	}
+
+	if err := s.withEmailStore(accountEmail, func(store *cache.EmailStore) error {
+		return store.UpdateMessage(emailID, unread, starred, folders)
+	}); err != nil {
+		slog.Warn("cache update failed", "emailID", emailID, "account", redactEmail(accountEmail), "err", err)
+	}
+}
+
+func (s *Server) deleteCachedEmail(accountEmail, emailID string) {
+	if accountEmail == "" || !s.cacheAvailable() {
+		return
+	}
+
+	if err := s.withEmailStore(accountEmail, func(store *cache.EmailStore) error {
+		return store.Delete(emailID)
+	}); err != nil {
+		slog.Warn("cache delete failed", "emailID", emailID, "account", redactEmail(accountEmail), "err", err)
+	}
+}
diff --git a/internal/air/handlers_email_offline_replay_test.go b/internal/air/handlers_email_offline_replay_test.go
new file mode 100644
index 0000000..edaf0a1
--- /dev/null
+++ b/internal/air/handlers_email_offline_replay_test.go
@@ -0,0 +1,100 @@
+package air
+
+import (
+	"context"
+	"testing"
+
+	"github.com/nylas/cli/internal/domain"
+)
+
+// TestProcessOfflineQueues_PreservesEmptyFoldersIntent locks down the
+// payload-shape contract that motivates the nil-vs-empty distinction on
+// `[]string` Folders. The Gmail-archive intent is encoded as a non-nil
+// empty slice ([]string{}) — distinct from "leave folders alone" (nil).
+// A regression that re-introduced `omitempty` on cache.UpdateMessagePayload
+// would silently drop the empty slice on the queue's JSON round-trip,
+// replaying as nil and reverting every offline-archived message: UI says
+// archived, server unchanged.
+//
+// This test enqueues an empty-Folders update, drains the queue, and
+// asserts the captured request still has Folders as a non-nil empty
+// slice. Should pass today — the find that motivated it is the absence
+// of coverage, not a live bug.
+func TestProcessOfflineQueues_PreservesEmptyFoldersIntent(t *testing.T) {
+	t.Parallel()
+
+	server, client, accountEmail := newCachedTestServer(t)
+	server.SetOnline(false)
+
+	var captured *domain.UpdateMessageRequest
+	client.UpdateMessageFunc = func(_ context.Context, _, _ string, req *domain.UpdateMessageRequest) (*domain.Message, error) {
+		// Snapshot the request so SetOnline(true)'s replay write is
+		// observable after the fact. Mock writes to LastGrantID etc.
+		// are not enough — those don't capture Folders.
+		captured = req
+		return &domain.Message{ID: "email-archive"}, nil
+	}
+
+	if err := server.enqueueMessageUpdate("grant-123", accountEmail, "email-archive", &domain.UpdateMessageRequest{
+		Folders: []string{},
+	}); err != nil {
+		t.Fatalf("enqueue update: %v", err)
+	}
+
+	server.SetOnline(true) // triggers processOfflineQueues synchronously
+
+	if !client.UpdateMessageCalled {
+		t.Fatal("expected UpdateMessage to be replayed when going back online")
+	}
+	if captured == nil {
+		t.Fatal("UpdateMessage was called but request was not captured")
+	}
+	if captured.Folders == nil {
+		t.Fatal("replayed Folders is nil; want non-nil empty slice (Gmail archive intent)")
+	}
+	if len(captured.Folders) != 0 {
+		t.Errorf("replayed Folders = %v, want empty slice (Gmail archive intent)",
+			captured.Folders)
+	}
+}
+
+// TestProcessOfflineQueues_PreservesNilFoldersIntent is the symmetric
+// lock-down: nil Folders ("leave folders alone", e.g. mark-as-read
+// without touching folders) must replay as nil, not as []string{}.
+// Confusing the two on either side of the queue corrupts the user's
+// intent: a "mark unread" enqueued offline must not also clear the
+// folder list when it eventually replays.
+func TestProcessOfflineQueues_PreservesNilFoldersIntent(t *testing.T) {
+	t.Parallel()
+
+	server, client, accountEmail := newCachedTestServer(t)
+	server.SetOnline(false)
+
+	var captured *domain.UpdateMessageRequest
+	client.UpdateMessageFunc = func(_ context.Context, _, _ string, req *domain.UpdateMessageRequest) (*domain.Message, error) {
+		captured = req
+		return &domain.Message{ID: "email-mark-read"}, nil
+	}
+
+	unread := false
+	if err := server.enqueueMessageUpdate("grant-123", accountEmail, "email-mark-read", &domain.UpdateMessageRequest{
+		Unread: &unread,
+		// Folders intentionally omitted — caller's intent is "do not
+		// touch folders," and the queue must not invent one on replay.
+	}); err != nil {
+		t.Fatalf("enqueue update: %v", err)
+	}
+
+	server.SetOnline(true)
+
+	if !client.UpdateMessageCalled {
+		t.Fatal("expected UpdateMessage to be replayed when going back online")
+	}
+	if captured == nil {
+		t.Fatal("UpdateMessage was called but request was not captured")
+	}
+	if captured.Folders != nil {
+		t.Errorf("replayed Folders = %v (non-nil), want nil (leave-alone intent)",
+			captured.Folders)
+	}
+}
diff --git a/internal/air/handlers_email_offline_test.go b/internal/air/handlers_email_offline_test.go
new file mode 100644
index 0000000..c5c23b9
--- /dev/null
+++ b/internal/air/handlers_email_offline_test.go
@@ -0,0 +1,493 @@
+package air
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/nylas/cli/internal/air/cache"
+	"github.com/nylas/cli/internal/domain"
+)
+
+// TestHandleListEmails_APIErrorFallsBackToCache pins the server-online,
+// upstream-failed cache fallback. The handler is expected to return
+// cached results with HasMore:false (so the UI doesn't try to paginate
+// past the snapshot) instead of surfacing a 500. This was an untested
+// branch — without coverage a future refactor of the cache fallback
+// loop could silently leave the UI dead in the water on transient
+// Nylas outages even though the cache is healthy.
+func TestHandleListEmails_APIErrorFallsBackToCache(t *testing.T) {
+	t.Parallel()
+
+	server, client, accountEmail := newCachedTestServer(t)
+	putCachedEmail(t, server, accountEmail, &cache.CachedEmail{
+		ID:        "cached-1",
+		FolderID:  "inbox",
+		Subject:   "Cached when API is down",
+		FromName:  "Cache",
+		FromEmail: "cache@example.com",
+		Date:      time.Now(),
+		CachedAt:  time.Now(),
+	})
+
+	// Single-message cache won't satisfy the "full page" short-circuit
+	// when a folder filter is applied (the threshold is len >= limit),
+	// so we hit the API path. Force the API to fail with a transient
+	// error — handler must serve the stale cache rather than 500.
+	apiCalled := false
+	client.GetMessagesWithParamsFunc = func(_ context.Context, _ string, _ *domain.MessageQueryParams) ([]domain.Message, error) {
+		apiCalled = true
+		return nil, errors.New("nylas 503 service unavailable")
+	}
+
+	req := httptest.NewRequest(http.MethodGet, "/api/emails?folder=inbox", nil)
+	w := httptest.NewRecorder()
+	server.handleListEmails(w, req)
+
+	if !apiCalled {
+		t.Fatal("expected the API to be called once before falling back to cache")
+	}
+	if w.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s, want 200 (cache fallback)", w.Code, w.Body.String())
+	}
+	var resp EmailsResponse
+	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if len(resp.Emails) != 1 || resp.Emails[0].ID != "cached-1" {
+		t.Errorf("response emails=%+v, want single cached-1", resp.Emails)
+	}
+	// HasMore must be false — paginating past the cache snapshot would
+	// hit the same broken upstream and confuse the user.
+	if resp.HasMore {
+		t.Errorf("HasMore=true on cache fallback; expected false to prevent retry-paginate")
+	}
+}
+
+// TestHandleUpdateEmail_OnlineTransientErrorQueuesAction pins the
+// transient-error branch in handleUpdateEmail. When the API call
+// returns a network-shaped error AND the offline queue is configured,
+// the handler must enqueue the action, flip server state to offline,
+// and return a 200 "queued" envelope — not a 500.
+func TestHandleUpdateEmail_OnlineTransientErrorQueuesAction(t *testing.T) {
+	t.Parallel()
+
+	server, client, _ := newCachedTestServer(t)
+	// Force a transient error type that shouldQueueEmailAction recognises.
+	client.UpdateMessageFunc = func(context.Context, string, string, *domain.UpdateMessageRequest) (*domain.Message, error) {
+		return nil, &transientNetErr{}
+	}
+
+	req := httptest.NewRequest(http.MethodPut, "/api/emails/email-1",
+		strings.NewReader(`{"unread":false}`))
+	req.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+	server.handleUpdateEmail(w, req, "email-1")
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s, want 200 (transient error must queue, not 500)", w.Code, w.Body.String())
+	}
+	var resp UpdateEmailResponse
+	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if !resp.Success || !strings.Contains(resp.Message, "queued") {
+		t.Errorf("response=%+v, want Success:true with 'queued' in message", resp)
+	}
+	// Server should now be marked offline so subsequent calls take the
+	// fast offline-first path instead of round-tripping the broken API.
+	if server.IsOnline() {
+		t.Error("expected SetOnline(false) after transient API error, got isOnline=true")
+	}
+}
+
+// TestHandleUpdateEmail_OfflineButQueueFails_FallsThroughToAPI pins
+// the rare case where the server is offline AND the offline queue
+// itself is broken. The handler should still attempt the live API
+// call (it might succeed — IsOnline can be stale) rather than dropping
+// the user's action silently.
+func TestHandleUpdateEmail_OfflineButQueueFails_FallsThroughToAPI(t *testing.T) {
+	t.Parallel()
+
+	server, client, _ := newCachedTestServer(t)
+	server.SetOnline(false)
+	// Disable the offline queue so enqueueMessageUpdate fails. With no
+	// account-email lookup possible the helper short-circuits with an
+	// "offline queue unavailable" error.
+	server.offlineQueues = nil
+	server.cacheSettings.OfflineQueueEnabled = false
+
+	apiCalled := false
+	client.UpdateMessageFunc = func(context.Context, string, string, *domain.UpdateMessageRequest) (*domain.Message, error) {
+		apiCalled = true
+		return &domain.Message{ID: "email-1"}, nil
+	}
+
+	req := httptest.NewRequest(http.MethodPut, "/api/emails/email-1",
+		strings.NewReader(`{"unread":true}`))
+	req.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+	server.handleUpdateEmail(w, req, "email-1")
+
+	if !apiCalled {
+		t.Error("expected handler to attempt live API call when queue is unavailable")
+	}
+	if w.Code != http.StatusOK {
+		t.Errorf("status=%d body=%s, want 200 (live retry succeeded)", w.Code, w.Body.String())
+	}
+}
+
+// TestShouldQueueEmailAction pins the predicate that gates whether
+// upstream errors enter the offline queue. Without direct coverage,
+// regressions in the net.Error / context.DeadlineExceeded matching
+// are invisible — the only signal would be "archives queue properly
+// most of the time."
+func TestShouldQueueEmailAction(t *testing.T) {
+	t.Parallel()
+
+	server, _, _ := newCachedTestServer(t)
+
+	cases := []struct {
+		name    string
+		err     error
+		online  bool
+		enabled bool
+		want    bool
+	}{
+		{
+			name:    "offline + queue enabled → queue",
+			err:     errors.New("any error"),
+			online:  false,
+			enabled: true,
+			want:    true,
+		},
+		{
+			name:    "online + transient net.Error → queue",
+			err:     &transientNetErr{},
+			online:  true,
+			enabled: true,
+			want:    true,
+		},
+		{
+			name:    "online + context deadline exceeded → queue",
+			err:     context.DeadlineExceeded,
+			online:  true,
+			enabled: true,
+			want:    true,
+		},
+		{
+			name:    "online + plain error (4xx-shaped) → don't queue",
+			err:     errors.New("nylas 401 unauthorized"),
+			online:  true,
+			enabled: true,
+			want:    false,
+		},
+		{
+			name:    "queue disabled → never queue",
+			err:     &transientNetErr{},
+			online:  false,
+			enabled: false,
+			want:    false,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			// shouldQueueEmailAction is a method on *Server, not pure —
+			// reset state between cases. Each subtest is sequential so
+			// the shared server is safe.
+			server.SetOnline(tc.online)
+			server.cacheSettings.OfflineQueueEnabled = tc.enabled
+			got := server.shouldQueueEmailAction(tc.err)
+			if got != tc.want {
+				t.Errorf("shouldQueueEmailAction(%v) [online=%v enabled=%v] = %v, want %v",
+					tc.err, tc.online, tc.enabled, got, tc.want)
+			}
+		})
+	}
+}
+
+// TestNormalizeDemoFolder pins the alias map for demo-mode folder
+// filtering. Without coverage, "Sent Items" → "sent" silently breaks
+// when a future refactor inlines the switch into demoEmailIsInFolder.
+func TestNormalizeDemoFolder(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		input string
+		want  string
+	}{
+		{"", ""},
+		{"inbox", "inbox"},
+		{"INBOX", "inbox"},
+		{" inbox ", "inbox"},
+		{"sent", "sent"},
+		{"Sent Items", "sent"}, // Microsoft display name
+		{"Sent Mail", "sent"},  // Gmail display name
+		{"drafts", "drafts"},
+		{"Draft", "drafts"},
+		{"archive", "archive"},
+		{"All Mail", "all"}, // Gmail "All Mail" routes to the "show everything" target
+		{"all", "all"},
+		{"trash", "trash"},
+		{"Deleted Items", "trash"}, // Microsoft
+		{"Deleted", "trash"},
+		{"spam", "spam"},
+		{"Junk", "spam"},
+		{"Junk Email", "spam"}, // Outlook
+		{"starred", "starred"},
+		{"unknown-folder", "unknown-folder"}, // pass-through, lowercased
+	}
+	for _, tc := range cases {
+		t.Run(tc.input, func(t *testing.T) {
+			got := normalizeDemoFolder(tc.input)
+			if got != tc.want {
+				t.Errorf("normalizeDemoFolder(%q) = %q, want %q", tc.input, got, tc.want)
+			}
+		})
+	}
+}
+
+// TestDemoEmailIsInFolder_AllAliasMatchesEverything pins the special
+// "all" branch — a UI-supplied "all" target should match every demo
+// email regardless of its folders[].
+func TestDemoEmailIsInFolder_AllAliasMatchesEverything(t *testing.T) {
+	t.Parallel()
+
+	cases := []EmailResponse{
+		{Folders: []string{"inbox"}},
+		{Folders: []string{"sent"}},
+		{Folders: []string{"trash"}},
+		{Folders: nil},
+		{Folders: []string{}},
+	}
+	for i, e := range cases {
+		if !demoEmailIsInFolder(e, "all") {
+			t.Errorf("case %d: demoEmailIsInFolder(%+v, \"all\") = false, want true", i, e)
+		}
+	}
+}
+
+// TestFilterDemoEmails_FolderAllReturnsEverything exercises the same
+// "all means everything" intent end-to-end through the call chain a UI
+// request actually takes:
+//
+//	filterDemoEmails(emails, "all", false, false)
+//	  → normalizeDemoFolder("all")        // canonicalises folder string
+//	  → demoEmailIsInFolder(e, target)    // matches against e.Folders
+//
+// `demoEmailIsInFolder` has a dedicated `if target == "all" { return
+// true }` branch (handlers_email_demo.go:219), but
+// `normalizeDemoFolder` collapses "all" into "archive" via the alias
+// case `"archive", "all", "all mail"`. The branch is therefore
+// unreachable from the UI path, and `filterDemoEmails(emails, "all",
+// ...)` returns only emails whose Folders[] contains "archive" — one
+// email — instead of all 13.
+//
+// EXPECTED FAILURE today: assertion expects len(filtered) ==
+// len(demoEmails()), got 1. After the fix (drop "all"/"all mail" from
+// the archive aliases — or remove the dead branch and update
+// TestNormalizeDemoFolder) this test passes.
+func TestFilterDemoEmails_FolderAllReturnsEverything(t *testing.T) {
+	t.Parallel()
+
+	all := demoEmails()
+	got := filterDemoEmails(all, "all", false, false)
+
+	if len(got) != len(all) {
+		t.Errorf("filterDemoEmails(_, \"all\") returned %d email(s), want %d (every demo email)",
+			len(got), len(all))
+	}
+}
+
+// TestHandleGetEmail_CachedBodyServedWhenAPIWouldFail pins the user-
+// visible promise: "when Nylas is down but the cache holds the email,
+// I can still read it." The handler's cache-first short-circuit
+// returns the cached body before ever calling GetMessage, so the API
+// stub here exists as a fail-loud guard — if a refactor were to
+// reorder the lookups so the API call fires first AND fails, the
+// stub would record it AND the response would still need to deliver
+// the body (via the fallback at handlers_email.go ~241).
+func TestHandleGetEmail_CachedBodyServedWhenAPIWouldFail(t *testing.T) {
+	t.Parallel()
+
+	server, client, accountEmail := newCachedTestServer(t)
+	putCachedEmail(t, server, accountEmail, &cache.CachedEmail{
+		ID:        "email-1",
+		FolderID:  "inbox",
+		Subject:   "Cached body survives outage",
+		FromName:  "Cache",
+		FromEmail: "cache@example.com",
+		BodyHTML:  "<p>cached body</p>",
+		Date:      time.Now(),
+		CachedAt:  time.Now(),
+	})
+	// API failure stub: in the documented flow this never fires (the
+	// cache hit short-circuits first), but we leave it wired so any
+	// refactor that bypasses the cache-first lookup will land in a
+	// 500 instead of silently masking the regression.
+	client.GetMessageFunc = func(context.Context, string, string) (*domain.Message, error) {
+		return nil, errors.New("nylas 503 service unavailable")
+	}
+
+	req := httptest.NewRequest(http.MethodGet, "/api/emails/email-1", nil)
+	w := httptest.NewRecorder()
+	server.handleGetEmail(w, req, "email-1")
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s, want 200 (cached body must be served)", w.Code, w.Body.String())
+	}
+	var resp EmailResponse
+	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if resp.ID != "email-1" {
+		t.Errorf("response id=%q, want email-1", resp.ID)
+	}
+	if resp.Body != "<p>cached body</p>" {
+		t.Errorf("response body=%q, want full cached BodyHTML — the cached-email response must include Body, not just metadata", resp.Body)
+	}
+}
+
+// TestHandleGetEmail_APIErrorWhenNotCached_Returns500 covers the
+// other end of the same branch: cache empty, API fails. The user
+// sees a generic 500 (no upstream-error leakage) rather than a stuck
+// loading state. Pins both the user-visible code AND the privacy
+// contract that we don't echo Nylas's raw error string back.
+func TestHandleGetEmail_APIErrorWhenNotCached_Returns500(t *testing.T) {
+	t.Parallel()
+
+	server, client, _ := newCachedTestServer(t)
+	client.GetMessageFunc = func(context.Context, string, string) (*domain.Message, error) {
+		// Include identifying noise in the upstream error so we can
+		// assert the handler doesn't echo it back.
+		return nil, errors.New("nylas 503: grant_id=secret-grant-12345 endpoint=/messages/email-1")
+	}
+
+	req := httptest.NewRequest(http.MethodGet, "/api/emails/uncached-id", nil)
+	w := httptest.NewRecorder()
+	server.handleGetEmail(w, req, "uncached-id")
+
+	if w.Code != http.StatusInternalServerError {
+		t.Fatalf("status=%d body=%s, want 500", w.Code, w.Body.String())
+	}
+	body := w.Body.String()
+	if strings.Contains(body, "secret-grant-12345") || strings.Contains(body, "/messages/") {
+		t.Errorf("response leaked upstream error details: %s", body)
+	}
+}
+
+// TestHandleDeleteEmail_OfflineButQueueFails_FallsThroughToAPI pins
+// that an offline server with a broken queue still attempts the live
+// API call. Without this fallthrough a misconfigured cache silently
+// swallows every delete the user issues — invisible data loss.
+func TestHandleDeleteEmail_OfflineButQueueFails_FallsThroughToAPI(t *testing.T) {
+	t.Parallel()
+
+	server, client, _ := newCachedTestServer(t)
+	server.SetOnline(false)
+	// Disable queueing so enqueueMessageDelete fails closed.
+	server.cacheSettings.OfflineQueueEnabled = false
+
+	apiCalled := false
+	client.DeleteMessageFunc = func(context.Context, string, string) error {
+		apiCalled = true
+		return nil
+	}
+
+	req := httptest.NewRequest(http.MethodDelete, "/api/emails/email-1", nil)
+	w := httptest.NewRecorder()
+	server.handleDeleteEmail(w, req, "email-1")
+
+	if !apiCalled {
+		t.Error("expected handler to attempt live DeleteMessage when queue is unavailable")
+	}
+	if w.Code != http.StatusOK {
+		t.Errorf("status=%d body=%s, want 200 (live retry succeeded)", w.Code, w.Body.String())
+	}
+}
+
+// TestHandleDeleteEmail_OnlineTransientErrorQueuesAction pins the
+// online-transient-error path for delete: API errors with a
+// queue-eligible error AND the queue is healthy → enqueue and return
+// 200. Mirrors the update-side test so a future refactor can't
+// accidentally diverge the two flows.
+func TestHandleDeleteEmail_OnlineTransientErrorQueuesAction(t *testing.T) {
+	t.Parallel()
+
+	server, client, _ := newCachedTestServer(t)
+	client.DeleteMessageFunc = func(context.Context, string, string) error {
+		return &transientNetErr{}
+	}
+
+	req := httptest.NewRequest(http.MethodDelete, "/api/emails/email-1", nil)
+	w := httptest.NewRecorder()
+	server.handleDeleteEmail(w, req, "email-1")
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s, want 200 (transient error must queue)", w.Code, w.Body.String())
+	}
+	var resp UpdateEmailResponse
+	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if !resp.Success || !strings.Contains(resp.Message, "queued") {
+		t.Errorf("response=%+v, want Success:true with 'queued' in message", resp)
+	}
+	if server.IsOnline() {
+		t.Error("expected SetOnline(false) after transient API error, got isOnline=true")
+	}
+}
+
+// TestHandleDeleteEmail_OnlineTransientErrorQueueFails_Returns500
+// pins the worst-case for delete: API errors with a transient AND the
+// queue write itself fails. The user must see a 500 rather than a
+// silently-dropped delete. Delete is irreversible — silent loss of
+// the user's intent here is the most damaging branch in the package.
+func TestHandleDeleteEmail_OnlineTransientErrorQueueFails_Returns500(t *testing.T) {
+	t.Parallel()
+
+	server, client, _ := newCachedTestServer(t)
+	client.DeleteMessageFunc = func(context.Context, string, string) error {
+		return &transientNetErr{}
+	}
+	// Disable the queue so enqueueMessageDelete fails inside the
+	// shouldQueueEmailAction branch.
+	server.cacheSettings.OfflineQueueEnabled = false
+
+	req := httptest.NewRequest(http.MethodDelete, "/api/emails/email-1", nil)
+	w := httptest.NewRecorder()
+	server.handleDeleteEmail(w, req, "email-1")
+
+	if w.Code != http.StatusInternalServerError {
+		t.Fatalf("status=%d body=%s, want 500 (queue-write-fails branch)", w.Code, w.Body.String())
+	}
+	var resp UpdateEmailResponse
+	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if resp.Success {
+		t.Errorf("response Success=true on double-failure, expected false")
+	}
+	if resp.Error == "" {
+		t.Error("response Error should describe the failure, got empty")
+	}
+}
+
+// transientNetErr implements net.Error with Timeout()=true so the
+// handler classifies it as "queue this and try again later" rather
+// than a permanent 4xx.
+type transientNetErr struct{}
+
+func (transientNetErr) Error() string   { return "simulated transient network error" }
+func (transientNetErr) Timeout() bool   { return true }
+func (transientNetErr) Temporary() bool { return true }
+
+// Compile-time assertion: transientNetErr satisfies net.Error.
+var _ net.Error = transientNetErr{}
diff --git a/internal/air/handlers_email_rsvp.go b/internal/air/handlers_email_rsvp.go
new file mode 100644
index 0000000..dcc76b4
--- /dev/null
+++ b/internal/air/handlers_email_rsvp.go
@@ -0,0 +1,238 @@
+package air
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"strings"
+
+	"github.com/nylas/cli/internal/domain"
+)
+
+// rsvpCommentMaxBytes caps the free-form RSVP comment forwarded to Nylas.
+// 1MB JSON body limits already protect against DoS, but a UI-meaningful
+// cap surfaces a friendlier error and prevents accidentally pasting an
+// entire email body into the comment field.
+const rsvpCommentMaxBytes = 1024
+
+// rsvpRequest is the JSON body accepted by POST /api/emails/{id}/rsvp.
+// Mirrors the shape the CLI's `nylas calendar events rsvp` command uses
+// so frontend and CLI converge on the same vocabulary.
+type rsvpRequest struct {
+	Status  string `json:"status"`
+	Comment string `json:"comment,omitempty"`
+}
+
+// rsvpResponse is the success body — small on purpose so the frontend
+// can update local state (button highlight, attendee count) without a
+// follow-up fetch.
+type rsvpResponse struct {
+	Status     string `json:"status"`
+	EventID    string `json:"event_id"`
+	CalendarID string `json:"calendar_id"`
+}
+
+// validRSVPStatuses pins the Nylas v3 send-rsvp vocabulary.
+// "noreply" exists in the API but isn't a meaningful UI choice — the
+// user just doesn't click anything — so we don't accept it here.
+var validRSVPStatuses = map[string]struct{}{
+	"yes":   {},
+	"no":    {},
+	"maybe": {},
+}
+
+// errEventNotImported: the invite UID hasn't been ingested by the Nylas
+// calendar importer yet — surface as 404 with a "try again" hint.
+var errEventNotImported = errors.New("invite has not been imported into your calendar yet")
+
+// errNoWritableCalendar: grant has only read-only calendars (e.g. a
+// "Holidays" subscription) — surface as 422, retry won't help.
+var errNoWritableCalendar = errors.New("no writable calendar available")
+
+// handleEmailRSVP forwards the user's RSVP choice to Nylas.
+//
+// Security invariant: never trust a client-supplied event ID — always
+// re-resolve via the email's VEVENT UID. Otherwise a forged frontend
+// could RSVP to arbitrary events on the user's behalf.
+func (s *Server) handleEmailRSVP(w http.ResponseWriter, r *http.Request, emailID string) {
+	if !requireMethod(w, r, http.MethodPost) {
+		return
+	}
+
+	var body rsvpRequest
+	if err := json.NewDecoder(limitedBody(w, r)).Decode(&body); err != nil {
+		slog.Warn("RSVP request body decode failed", "emailID", emailID, "err", err)
+		var maxErr *http.MaxBytesError
+		if errors.As(err, &maxErr) {
+			writeError(w, http.StatusRequestEntityTooLarge, "Request body too large")
+			return
+		}
+		writeError(w, http.StatusBadRequest, "Invalid request body")
+		return
+	}
+	status := strings.ToLower(strings.TrimSpace(body.Status))
+	if _, ok := validRSVPStatuses[status]; !ok {
+		writeError(w, http.StatusBadRequest, "status must be one of: yes, no, maybe")
+		return
+	}
+	body.Comment = strings.TrimSpace(body.Comment)
+	if len(body.Comment) > rsvpCommentMaxBytes {
+		writeError(w, http.StatusBadRequest, fmt.Sprintf("comment must be %d bytes or fewer", rsvpCommentMaxBytes))
+		return
+	}
+
+	if s.demoMode {
+		writeJSON(w, http.StatusOK, rsvpResponse{
+			Status:     status,
+			EventID:    "demo-event-001",
+			CalendarID: "primary",
+		})
+		return
+	}
+
+	grantID := s.withAuthGrant(w, nil)
+	if grantID == "" {
+		return
+	}
+
+	ctx, cancel := s.withTimeout(r)
+	defer cancel()
+
+	invite, err := s.resolveEmailInvite(ctx, grantID, emailID)
+	if err != nil {
+		// Both initial GetMessage failure and the raw_mime fallback land
+		// here — both are transient. 502 lets the frontend offer a retry.
+		slog.Error("RSVP failed to fetch email", "emailID", emailID, "err", err)
+		writeError(w, http.StatusBadGateway, "Failed to fetch email — please try again")
+		return
+	}
+	if !invite.HasInvite {
+		writeError(w, http.StatusNotFound, "This email does not contain a calendar invitation")
+		return
+	}
+	if strings.EqualFold(invite.Method, "CANCEL") || strings.EqualFold(invite.Status, "CANCELLED") {
+		writeError(w, http.StatusConflict, "This event has been cancelled — RSVP is no longer accepted")
+		return
+	}
+	if invite.ICalUID == "" {
+		// Some Microsoft senders ship invites without a UID.
+		writeError(w, http.StatusUnprocessableEntity, "Invite has no UID — open the event in your calendar to RSVP")
+		return
+	}
+
+	// Search ALL writable calendars: invites often land in non-primary ones
+	// (work + personal under one Google account, shared team calendars).
+	calendarID, eventID, err := s.findInviteEventAcrossCalendars(ctx, grantID, invite.ICalUID)
+	if err != nil {
+		if errors.Is(err, errEventNotImported) {
+			writeError(w, http.StatusNotFound, err.Error())
+			return
+		}
+		// "No writable calendar" is a config-shaped failure (only
+		// read-only subscriptions on this grant). Retrying won't help —
+		// surface a 422 with a clear message so the user knows where to
+		// look instead of being told to retry forever.
+		if errors.Is(err, errNoWritableCalendar) {
+			writeError(w, http.StatusUnprocessableEntity,
+				"No writable calendar on this account — RSVP requires a calendar you can edit")
+			return
+		}
+		slog.Error("RSVP calendar lookup failed", "emailID", emailID, "icalUID", invite.ICalUID, "err", err)
+		writeError(w, http.StatusBadGateway, "Failed to look up event — please try again")
+		return
+	}
+
+	rsvpReq := &domain.SendRSVPRequest{Status: status, Comment: body.Comment}
+	if err := s.nylasClient.SendRSVP(ctx, grantID, calendarID, eventID, rsvpReq); err != nil {
+		slog.Error("RSVP send failed",
+			"emailID", emailID,
+			"calendarID", calendarID,
+			"eventID", eventID,
+			"status", status,
+			"err", err,
+		)
+		writeError(w, http.StatusBadGateway, "Failed to send RSVP — please try again")
+		return
+	}
+
+	writeJSON(w, http.StatusOK, rsvpResponse{
+		Status:     status,
+		EventID:    eventID,
+		CalendarID: calendarID,
+	})
+}
+
+// findInviteEventAcrossCalendars searches every writable calendar
+// (primary first) for an event matching icalUID. Returns
+// errEventNotImported when no calendar contains the UID. A single
+// calendar erroring doesn't kill the search — the next might hold it.
+func (s *Server) findInviteEventAcrossCalendars(ctx context.Context, grantID, icalUID string) (string, string, error) {
+	calendars, err := s.nylasClient.GetCalendars(ctx, grantID)
+	if err != nil {
+		return "", "", fmt.Errorf("failed to list calendars: %w", err)
+	}
+	if len(calendars) == 0 {
+		return "", "", errors.New("no calendars found for this account")
+	}
+
+	writable := writableCalendars(calendars)
+	if len(writable) == 0 {
+		return "", "", errNoWritableCalendar
+	}
+
+	var lastLookupErr error
+	for _, c := range writable {
+		eventID, err := s.findEventByICalUID(ctx, grantID, c.ID, icalUID)
+		if err == nil {
+			return c.ID, eventID, nil
+		}
+		if !errors.Is(err, errEventNotImported) {
+			slog.Warn("RSVP per-calendar lookup failed",
+				"calendarID", c.ID,
+				"icalUID", icalUID,
+				"err", err,
+			)
+			lastLookupErr = err
+		}
+	}
+
+	if lastLookupErr != nil {
+		return "", "", fmt.Errorf("failed to look up event: %w", lastLookupErr)
+	}
+	return "", "", errEventNotImported
+}
+
+// writableCalendars returns writable calendars, primary first.
+func writableCalendars(calendars []domain.Calendar) []domain.Calendar {
+	out := make([]domain.Calendar, 0, len(calendars))
+	for _, c := range calendars {
+		if c.IsPrimary && !c.ReadOnly {
+			out = append(out, c)
+		}
+	}
+	for _, c := range calendars {
+		if !c.IsPrimary && !c.ReadOnly {
+			out = append(out, c)
+		}
+	}
+	return out
+}
+
+// findEventByICalUID resolves a UID via Nylas v3's `ical_uid` filter.
+// Returns errEventNotImported when no event matches.
+func (s *Server) findEventByICalUID(ctx context.Context, grantID, calendarID, icalUID string) (string, error) {
+	resp, err := s.nylasClient.GetEventsWithCursor(ctx, grantID, calendarID, &domain.EventQueryParams{
+		ICalUID: icalUID,
+		Limit:   1,
+	})
+	if err != nil {
+		return "", err
+	}
+	if resp == nil || len(resp.Data) == 0 {
+		return "", errEventNotImported
+	}
+	return resp.Data[0].ID, nil
+}
diff --git a/internal/air/handlers_email_rsvp_edge_cases_test.go b/internal/air/handlers_email_rsvp_edge_cases_test.go
new file mode 100644
index 0000000..6fa2e6b
--- /dev/null
+++ b/internal/air/handlers_email_rsvp_edge_cases_test.go
@@ -0,0 +1,307 @@
+package air
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/nylas/cli/internal/domain"
+)
+
+// statusCancelledOnlyMIME pins the case where METHOD is REQUEST (so the
+// invite is "live") but the VEVENT carries STATUS:CANCELLED. The handler
+// must still 409 — accepting an RSVP on a cancelled event would create
+// a confusing diverging UI state.
+const statusCancelledOnlyMIME = "Content-Type: multipart/alternative; boundary=\"B\"\r\n" +
+	"\r\n--B\r\n" +
+	"Content-Type: text/calendar; charset=UTF-8; method=REQUEST\r\n\r\n" +
+	"BEGIN:VCALENDAR\r\nVERSION:2.0\r\nPRODID:-//T//EN\r\nMETHOD:REQUEST\r\n" +
+	"BEGIN:VEVENT\r\nUID:status-cancelled-uid@example.com\r\nSUMMARY:CancelledStatusOnly\r\n" +
+	"DTSTART:20260501T140000Z\r\nDTEND:20260501T150000Z\r\n" +
+	"STATUS:CANCELLED\r\n" +
+	"END:VEVENT\r\nEND:VCALENDAR\r\n" +
+	"--B--\r\n"
+
+// TestHandleEmailRSVP_StatusCancelledOnly_Rejected covers the case where
+// only STATUS:CANCELLED (no METHOD:CANCEL) marks the event as dead.
+// Without this branch the 409 guard would only fire on Outlook-style
+// cancellations and silently accept Google's status-only path.
+func TestHandleEmailRSVP_StatusCancelledOnly_Rejected(t *testing.T) {
+	t.Parallel()
+	server, mock := rsvpHappyPathMock(t, statusCancelledOnlyMIME)
+
+	calledRSVP := false
+	mock.SendRSVPFunc = func(context.Context, string, string, string, *domain.SendRSVPRequest) error {
+		calledRSVP = true
+		return nil
+	}
+
+	w := postRSVP(t, server, "email-1", `{"status":"yes"}`)
+	if w.Code != http.StatusConflict {
+		t.Errorf("status=%d body=%s, want 409 (cancelled)", w.Code, w.Body.String())
+	}
+	if calledRSVP {
+		t.Error("SendRSVP was called for STATUS:CANCELLED event — guard is missing")
+	}
+}
+
+// TestHandleEmailRSVP_GetCalendarsError pins the upstream-failure path
+// for the calendars listing. The handler should NOT report "no calendars
+// found" (which would mislead the user) — it must surface 502 so the
+// frontend offers a retry.
+func TestHandleEmailRSVP_GetCalendarsError(t *testing.T) {
+	t.Parallel()
+	server, mock := rsvpHappyPathMock(t, rsvpInviteMIME)
+	mock.GetCalendarsFunc = func(context.Context, string) ([]domain.Calendar, error) {
+		return nil, errors.New("nylas listing failed: 503")
+	}
+
+	w := postRSVP(t, server, "email-1", `{"status":"yes"}`)
+	if w.Code != http.StatusBadGateway {
+		t.Errorf("status=%d body=%s, want 502 on calendar listing failure", w.Code, w.Body.String())
+	}
+}
+
+// TestHandleEmailRSVP_NoCalendars covers the zero-calendar branch.
+// If Nylas returns an empty calendars list (no error), the handler
+// should not silently RSVP to an empty calendarID — it must 502.
+func TestHandleEmailRSVP_NoCalendars(t *testing.T) {
+	t.Parallel()
+	server, mock := rsvpHappyPathMock(t, rsvpInviteMIME)
+	mock.GetCalendarsFunc = func(context.Context, string) ([]domain.Calendar, error) {
+		return []domain.Calendar{}, nil
+	}
+
+	w := postRSVP(t, server, "email-1", `{"status":"yes"}`)
+	if w.Code != http.StatusBadGateway {
+		t.Errorf("status=%d body=%s, want 502 (no calendars)", w.Code, w.Body.String())
+	}
+}
+
+// TestHandleEmailRSVP_MissingDefaultGrant exercises the auth path: when
+// no default grant is configured, withAuthGrant writes a 400 envelope
+// and the handler returns without calling Nylas. Without this test, a
+// future refactor could break the "select an account first" UX.
+func TestHandleEmailRSVP_MissingDefaultGrant(t *testing.T) {
+	t.Parallel()
+	server, mock, _ := newCachedTestServer(t)
+
+	// Strip the default grant so requireDefaultGrant fails closed.
+	if err := server.grantStore.ClearGrants(); err != nil {
+		t.Fatalf("clear grants: %v", err)
+	}
+
+	calledNylas := false
+	mock.SendRSVPFunc = func(context.Context, string, string, string, *domain.SendRSVPRequest) error {
+		calledNylas = true
+		return nil
+	}
+
+	w := postRSVP(t, server, "email-1", `{"status":"yes"}`)
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("status=%d body=%s, want 400 (no default grant)", w.Code, w.Body.String())
+	}
+	if calledNylas {
+		t.Error("SendRSVP called without a default grant — auth gate failed")
+	}
+}
+
+// TestHandleEmailRSVP_DemoMode_RejectsInvalidStatus pins that body
+// validation runs BEFORE the demo-mode short-circuit, so a hostile or
+// stale frontend can't get a green-path RSVP response with garbage data.
+func TestHandleEmailRSVP_DemoMode_RejectsInvalidStatus(t *testing.T) {
+	t.Parallel()
+	server, _, _ := newCachedTestServer(t)
+	server.demoMode = true
+
+	w := postRSVP(t, server, "any-email", `{"status":"bogus"}`)
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("status=%d body=%s, want 400 even in demo mode", w.Code, w.Body.String())
+	}
+}
+
+// TestHandleEmailRSVP_DemoMode_PinsLiteralEventID pins the demo response
+// shape. The frontend reads event_id back to highlight the active button,
+// so a regression in the demo literal would silently break the demo UX.
+func TestHandleEmailRSVP_DemoMode_PinsLiteralEventID(t *testing.T) {
+	t.Parallel()
+	server, _, _ := newCachedTestServer(t)
+	server.demoMode = true
+
+	w := postRSVP(t, server, "any-email", `{"status":"maybe"}`)
+	if w.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s", w.Code, w.Body.String())
+	}
+	var got rsvpResponse
+	if err := json.Unmarshal(w.Body.Bytes(), &got); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if got.EventID != "demo-event-001" || got.CalendarID != "primary" || got.Status != "maybe" {
+		t.Errorf("demo response=%+v, want {Status:maybe, EventID:demo-event-001, CalendarID:primary}", got)
+	}
+}
+
+// TestHandleEmailRSVP_OversizedComment pins the comment-length cap.
+// Without this guard a single user could submit megabytes of comment
+// text against an organiser's RSVP — the LimitedBody (1MB) bound is too
+// permissive, so we cap at the UI-meaningful rsvpCommentMaxBytes.
+//
+// Boundary cases are also pinned: exactly rsvpCommentMaxBytes is OK,
+// rsvpCommentMaxBytes+1 is rejected. This keeps the cap interpretation
+// frozen against an off-by-one refactor.
+func TestHandleEmailRSVP_OversizedComment(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		name      string
+		size      int
+		wantCode  int
+		wantCalls bool
+	}{
+		{name: "at cap", size: rsvpCommentMaxBytes, wantCode: http.StatusOK, wantCalls: true},
+		{name: "one over cap", size: rsvpCommentMaxBytes + 1, wantCode: http.StatusBadRequest, wantCalls: false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			server, mock := rsvpHappyPathMock(t, rsvpInviteMIME)
+			calledRSVP := false
+			mock.SendRSVPFunc = func(context.Context, string, string, string, *domain.SendRSVPRequest) error {
+				calledRSVP = true
+				return nil
+			}
+			body := `{"status":"yes","comment":"` + strings.Repeat("x", tc.size) + `"}`
+			w := postRSVP(t, server, "email-1", body)
+			if w.Code != tc.wantCode {
+				t.Errorf("status=%d body=%s, want %d", w.Code, w.Body.String(), tc.wantCode)
+			}
+			if calledRSVP != tc.wantCalls {
+				t.Errorf("SendRSVP called=%v, want %v", calledRSVP, tc.wantCalls)
+			}
+		})
+	}
+}
+
+// TestHandleEmailRSVP_TrimsCommentBeforeLengthCheck pins that surrounding
+// whitespace is stripped before the comment cap is applied. Without this,
+// a user pasting from a WYSIWYG editor (which often includes trailing
+// newline/space) could trip the limit on a message they perceive as
+// short. Also pins that the trimmed form is what gets forwarded — the
+// Nylas organiser shouldn't see "  yes please   " in their notification.
+func TestHandleEmailRSVP_TrimsCommentBeforeLengthCheck(t *testing.T) {
+	t.Parallel()
+	server, mock := rsvpHappyPathMock(t, rsvpInviteMIME)
+
+	var got string
+	mock.SendRSVPFunc = func(_ context.Context, _, _, _ string, req *domain.SendRSVPRequest) error {
+		got = req.Comment
+		return nil
+	}
+	body := `{"status":"yes","comment":"  see you there  \n"}`
+	w := postRSVP(t, server, "email-1", body)
+	if w.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s", w.Code, w.Body.String())
+	}
+	if got != "see you there" {
+		t.Errorf("forwarded comment=%q, want %q (trimmed)", got, "see you there")
+	}
+}
+
+// TestHandleEmailRSVP_OversizedBodyReturns413 pins that a request body
+// exceeding the 1MB MaxRequestBodySize cap returns 413 (RequestEntityTooLarge),
+// not 400 (BadRequest). Without this distinction, clients can't tell
+// "your JSON is malformed" (caller bug) from "your payload is too big"
+// (caller can shrink and retry).
+func TestHandleEmailRSVP_OversizedBodyReturns413(t *testing.T) {
+	t.Parallel()
+	server, _ := rsvpHappyPathMock(t, rsvpInviteMIME)
+
+	// 2MB body — well past the 1MB MaxRequestBodySize cap.
+	huge := strings.Repeat("a", 2<<20)
+	body := `{"status":"yes","comment":"` + huge + `"}`
+	w := postRSVP(t, server, "email-1", body)
+	if w.Code != http.StatusRequestEntityTooLarge {
+		t.Errorf("status=%d body=%s, want 413 on >1MB body", w.Code, w.Body.String())
+	}
+}
+
+// TestHandleEmailRSVP_BodyParseErrorIsGeneric pins the privacy contract:
+// the JSON-decode error must NOT echo the raw bytes back to the client.
+// (Localhost-only mitigates blast radius, but echoing the input weakens
+// defense-in-depth and complicates anti-XSS reasoning.)
+func TestHandleEmailRSVP_BodyParseErrorIsGeneric(t *testing.T) {
+	t.Parallel()
+	server, _ := rsvpHappyPathMock(t, rsvpInviteMIME)
+
+	probe := "<script>alert('xss')</script>"
+	w := postRSVP(t, server, "email-1", probe)
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("status=%d, want 400", w.Code)
+	}
+	if strings.Contains(w.Body.String(), probe) {
+		t.Errorf("error response echoed raw client bytes: %s", w.Body.String())
+	}
+}
+
+// TestHandleEmailRSVP_RouteDispatch wires the test through handleEmailByID
+// (the actual entry point bound to /api/emails/{id}/rsvp) instead of
+// calling handleEmailRSVP directly. This pins the path-splitting logic
+// in handlers_email.go so a future refactor of `parts[1] == "rsvp"`
+// can't silently break the route while every direct-call test still
+// passes.
+func TestHandleEmailRSVP_RouteDispatch(t *testing.T) {
+	t.Parallel()
+	server, mock := rsvpHappyPathMock(t, rsvpInviteMIME)
+
+	hit := false
+	mock.SendRSVPFunc = func(context.Context, string, string, string, *domain.SendRSVPRequest) error {
+		hit = true
+		return nil
+	}
+
+	w := httptest.NewRecorder()
+	r := httptest.NewRequest(http.MethodPost, "/api/emails/email-1/rsvp", strings.NewReader(`{"status":"yes"}`))
+	r.Header.Set("Content-Type", "application/json")
+	server.handleEmailByID(w, r)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s — route dispatch is broken", w.Code, w.Body.String())
+	}
+	if !hit {
+		t.Error("SendRSVP not called via /rsvp route — handleEmailByID failed to dispatch")
+	}
+}
+
+// (TestHandleEmailRSVP_LooksUpAcrossCalendars removed — duplicate of
+// TestHandleEmailRSVP_FindsEventInSecondaryCalendar in
+// handlers_email_rsvp_test.go, which has stricter assertions on the
+// ical_uid filter and uses reflect.DeepEqual for the walk order.)
+
+// TestHandleEmailRSVP_TransientCalendarLookupFailureSurfacedWhenAllMiss
+// pins that a non-errEventNotImported error from a per-calendar lookup
+// (e.g. Nylas 5xx) is surfaced as 502 when no other calendar resolves
+// the event. Without this, repeated "calendar not imported" 404s would
+// hide a real Nylas outage.
+func TestHandleEmailRSVP_TransientCalendarLookupFailureSurfacedWhenAllMiss(t *testing.T) {
+	t.Parallel()
+	server, mock := rsvpHappyPathMock(t, rsvpInviteMIME)
+	mock.GetCalendarsFunc = func(context.Context, string) ([]domain.Calendar, error) {
+		return []domain.Calendar{
+			{ID: "cal-primary", IsPrimary: true},
+		}, nil
+	}
+	mock.GetEventsWithCursorFunc = func(context.Context, string, string, *domain.EventQueryParams) (*domain.EventListResponse, error) {
+		return nil, errors.New("nylas events listing returned 503")
+	}
+
+	w := postRSVP(t, server, "email-1", `{"status":"yes"}`)
+	if w.Code != http.StatusBadGateway {
+		t.Errorf("status=%d body=%s, want 502 (transient lookup error)", w.Code, w.Body.String())
+	}
+	if strings.Contains(w.Body.String(), "503") {
+		t.Errorf("response leaked upstream status code: %s", w.Body.String())
+	}
+}
diff --git a/internal/air/handlers_email_rsvp_fixtures_test.go b/internal/air/handlers_email_rsvp_fixtures_test.go
new file mode 100644
index 0000000..0d65dbc
--- /dev/null
+++ b/internal/air/handlers_email_rsvp_fixtures_test.go
@@ -0,0 +1,97 @@
+package air
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	nylasmock "github.com/nylas/cli/internal/adapters/nylas"
+	"github.com/nylas/cli/internal/domain"
+)
+
+// Shared MIME fixtures and helpers for the RSVP handler test suites.
+// Lifted out of handlers_email_rsvp_test.go so the main test file stays
+// under the 600-line cap.
+
+// rsvpInviteMIME is a Gmail-style invite shaped like the production
+// payload the RSVP path needs to handle: inline text/calendar with a
+// stable UID we can resolve to a Nylas event.
+const rsvpInviteMIME = "From: organizer@example.com\r\n" +
+	"To: user@example.com\r\n" +
+	"Subject: Event Invitation: Standup\r\n" +
+	"Content-Type: multipart/alternative; boundary=\"BOUNDARY1\"\r\n" +
+	"\r\n" +
+	"--BOUNDARY1\r\n" +
+	"Content-Type: text/calendar; charset=UTF-8; method=REQUEST\r\n" +
+	"\r\n" +
+	"BEGIN:VCALENDAR\r\nVERSION:2.0\r\nPRODID:-//Test//EN\r\n" +
+	"METHOD:REQUEST\r\n" +
+	"BEGIN:VEVENT\r\nUID:rsvp-event-uid@example.com\r\nSUMMARY:Standup\r\n" +
+	"DTSTART:20260501T140000Z\r\nDTEND:20260501T143000Z\r\n" +
+	"END:VEVENT\r\nEND:VCALENDAR\r\n" +
+	"--BOUNDARY1--\r\n"
+
+// cancelledInviteMIME exercises the METHOD:CANCEL guard.
+const cancelledInviteMIME = "Content-Type: multipart/alternative; boundary=\"B\"\r\n" +
+	"\r\n--B\r\n" +
+	"Content-Type: text/calendar; charset=UTF-8; method=CANCEL\r\n\r\n" +
+	"BEGIN:VCALENDAR\r\nVERSION:2.0\r\nPRODID:-//T//EN\r\nMETHOD:CANCEL\r\n" +
+	"BEGIN:VEVENT\r\nUID:cancelled-uid@example.com\r\nSUMMARY:Killed\r\n" +
+	"DTSTART:20260501T140000Z\r\nDTEND:20260501T150000Z\r\n" +
+	"STATUS:CANCELLED\r\n" +
+	"END:VEVENT\r\nEND:VCALENDAR\r\n" +
+	"--B--\r\n"
+
+// noUIDInviteMIME pins the "Microsoft sent us an invite without a UID"
+// edge case — handler should fail loudly, not silently RSVP to nothing.
+const noUIDInviteMIME = "Content-Type: multipart/alternative; boundary=\"B\"\r\n" +
+	"\r\n--B\r\n" +
+	"Content-Type: text/calendar; charset=UTF-8; method=REQUEST\r\n\r\n" +
+	"BEGIN:VCALENDAR\r\nVERSION:2.0\r\nPRODID:-//T//EN\r\nMETHOD:REQUEST\r\n" +
+	"BEGIN:VEVENT\r\nSUMMARY:UID-less\r\n" +
+	"DTSTART:20260501T140000Z\r\nDTEND:20260501T150000Z\r\n" +
+	"END:VEVENT\r\nEND:VCALENDAR\r\n" +
+	"--B--\r\n"
+
+// rsvpHappyPathMock returns a server + mock pre-wired for the standard
+// "everything works" path: the email exposes mime, the user has a primary
+// writable calendar, and the iCal UID resolves to a Nylas event.
+// Individual tests override fields on the mock to exercise failure modes.
+func rsvpHappyPathMock(t *testing.T, mime string) (*Server, *nylasmock.MockClient) {
+	t.Helper()
+	server, mock, _ := newCachedTestServer(t)
+
+	mock.GetMessageFunc = func(_ context.Context, _, messageID string) (*domain.Message, error) {
+		return &domain.Message{ID: messageID, Subject: "Event Invitation: Standup"}, nil
+	}
+	mock.GetMessageWithFieldsFunc = func(_ context.Context, _, messageID, _ string) (*domain.Message, error) {
+		return &domain.Message{ID: messageID, RawMIME: mime}, nil
+	}
+	mock.GetCalendarsFunc = func(context.Context, string) ([]domain.Calendar, error) {
+		return []domain.Calendar{
+			{ID: "cal-primary", Name: "Primary", IsPrimary: true, ReadOnly: false},
+		}, nil
+	}
+	mock.GetEventsWithCursorFunc = func(_ context.Context, _, _ string, params *domain.EventQueryParams) (*domain.EventListResponse, error) {
+		// Pin the contract: handler must filter by ical_uid, not scan
+		// the whole calendar — without this the lookup could return the
+		// first random event and we'd RSVP to the wrong meeting.
+		if params == nil || params.ICalUID == "" {
+			t.Errorf("GetEventsWithCursor called without ICalUID filter; params=%+v", params)
+		}
+		return &domain.EventListResponse{Data: []domain.Event{{ID: "evt-resolved-1"}}}, nil
+	}
+	return server, mock
+}
+
+// postRSVP sends a POST to the RSVP endpoint and returns the recorder.
+func postRSVP(t *testing.T, server *Server, emailID, body string) *httptest.ResponseRecorder {
+	t.Helper()
+	w := httptest.NewRecorder()
+	r := httptest.NewRequest(http.MethodPost, "/api/emails/"+emailID+"/rsvp", strings.NewReader(body))
+	r.Header.Set("Content-Type", "application/json")
+	server.handleEmailRSVP(w, r, emailID)
+	return w
+}
diff --git a/internal/air/handlers_email_rsvp_test.go b/internal/air/handlers_email_rsvp_test.go
new file mode 100644
index 0000000..dc6b2e1
--- /dev/null
+++ b/internal/air/handlers_email_rsvp_test.go
@@ -0,0 +1,542 @@
+package air
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/nylas/cli/internal/domain"
+)
+
+// MIME fixtures, rsvpHappyPathMock, and postRSVP live in
+// handlers_email_rsvp_fixtures_test.go (extracted to keep this file
+// under the 600-line ceiling).
+
+func TestHandleEmailRSVP_HappyPath(t *testing.T) {
+	t.Parallel()
+	server, mock := rsvpHappyPathMock(t, rsvpInviteMIME)
+
+	var sentReq *domain.SendRSVPRequest
+	var sentEventID, sentCalendarID string
+	mock.SendRSVPFunc = func(_ context.Context, grantID, calendarID, eventID string, req *domain.SendRSVPRequest) error {
+		if grantID != "grant-123" {
+			// Use Fatalf — the rest of this assertion block (event ID,
+			// calendar ID, request body) is meaningless if we ended up on
+			// the wrong grant. Loud-fail at the source so debugging
+			// points at the auth gate, not a downstream symptom.
+			t.Fatalf("grantID=%q, want grant-123", grantID)
+		}
+		sentEventID = eventID
+		sentCalendarID = calendarID
+		sentReq = req
+		return nil
+	}
+
+	w := postRSVP(t, server, "email-1", `{"status":"yes","comment":"see you there"}`)
+	if w.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s", w.Code, w.Body.String())
+	}
+	if sentEventID != "evt-resolved-1" {
+		t.Errorf("eventID=%q, want evt-resolved-1 (resolved by ical_uid)", sentEventID)
+	}
+	if sentCalendarID != "cal-primary" {
+		t.Errorf("calendarID=%q, want cal-primary", sentCalendarID)
+	}
+	if sentReq == nil || sentReq.Status != "yes" || sentReq.Comment != "see you there" {
+		t.Errorf("request=%+v, want {Status:yes, Comment:see you there}", sentReq)
+	}
+
+	var got rsvpResponse
+	if err := json.Unmarshal(w.Body.Bytes(), &got); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if got.Status != "yes" || got.EventID != "evt-resolved-1" || got.CalendarID != "cal-primary" {
+		t.Errorf("response=%+v", got)
+	}
+}
+
+func TestHandleEmailRSVP_MethodNotAllowed(t *testing.T) {
+	t.Parallel()
+	server, _ := rsvpHappyPathMock(t, rsvpInviteMIME)
+
+	w := httptest.NewRecorder()
+	r := httptest.NewRequest(http.MethodGet, "/api/emails/email-1/rsvp", http.NoBody)
+	server.handleEmailRSVP(w, r, "email-1")
+
+	if w.Code != http.StatusMethodNotAllowed {
+		t.Errorf("status=%d, want 405", w.Code)
+	}
+}
+
+func TestHandleEmailRSVP_InvalidStatus(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		name string
+		body string
+	}{
+		{"empty", `{"status":""}`},
+		{"unknown", `{"status":"sure"}`},
+		{"yes-with-typo", `{"status":"yess"}`},
+		{"noreply rejected", `{"status":"noreply"}`}, // valid in Nylas API but no UI affordance
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			server, _ := rsvpHappyPathMock(t, rsvpInviteMIME)
+			w := postRSVP(t, server, "email-1", tc.body)
+			if w.Code != http.StatusBadRequest {
+				t.Errorf("status=%d, want 400, body=%s", w.Code, w.Body.String())
+			}
+		})
+	}
+}
+
+// TestHandleEmailRSVP_StatusCaseInsensitive pins that yes/no/maybe in
+// any case (including with surrounding whitespace) all normalize to the
+// lowercase Nylas vocabulary before being forwarded. Without exercising
+// every branch a future refactor of the `strings.ToLower` chain could
+// silently regress one variant.
+func TestHandleEmailRSVP_StatusCaseInsensitive(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		name  string
+		input string
+		want  string
+	}{
+		{name: "uppercase yes", input: "YES", want: "yes"},
+		{name: "titlecase maybe", input: "Maybe", want: "maybe"},
+		{name: "uppercase no", input: "NO", want: "no"},
+		{name: "padded yes", input: "  yes  ", want: "yes"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			server, mock := rsvpHappyPathMock(t, rsvpInviteMIME)
+			var got string
+			mock.SendRSVPFunc = func(_ context.Context, _, _, _ string, req *domain.SendRSVPRequest) error {
+				got = req.Status
+				return nil
+			}
+			w := postRSVP(t, server, "email-1", `{"status":"`+tc.input+`"}`)
+			if w.Code != http.StatusOK {
+				t.Fatalf("status=%d body=%s", w.Code, w.Body.String())
+			}
+			if got != tc.want {
+				t.Errorf("forwarded status=%q, want %q", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestHandleEmailRSVP_InvalidJSONBody(t *testing.T) {
+	t.Parallel()
+	server, _ := rsvpHappyPathMock(t, rsvpInviteMIME)
+
+	w := postRSVP(t, server, "email-1", `not json at all`)
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("status=%d, want 400", w.Code)
+	}
+}
+
+func TestHandleEmailRSVP_NoInviteOnEmail(t *testing.T) {
+	t.Parallel()
+	server, mock := rsvpHappyPathMock(t, rsvpInviteMIME)
+
+	mock.GetMessageWithFieldsFunc = func(context.Context, string, string, string) (*domain.Message, error) {
+		return &domain.Message{RawMIME: "From: a@b.example\r\nSubject: Hi\r\n\r\nplain"}, nil
+	}
+
+	w := postRSVP(t, server, "email-1", `{"status":"yes"}`)
+	if w.Code != http.StatusNotFound {
+		t.Errorf("status=%d body=%s, want 404 (no calendar invitation)", w.Code, w.Body.String())
+	}
+}
+
+func TestHandleEmailRSVP_CancelledInviteRejected(t *testing.T) {
+	t.Parallel()
+	server, mock := rsvpHappyPathMock(t, cancelledInviteMIME)
+
+	calledRSVP := false
+	mock.SendRSVPFunc = func(context.Context, string, string, string, *domain.SendRSVPRequest) error {
+		calledRSVP = true
+		return nil
+	}
+
+	w := postRSVP(t, server, "email-1", `{"status":"yes"}`)
+	if w.Code != http.StatusConflict {
+		t.Errorf("status=%d body=%s, want 409 (cancelled)", w.Code, w.Body.String())
+	}
+	if calledRSVP {
+		t.Error("SendRSVP was called for a cancelled event — guard is missing")
+	}
+}
+
+func TestHandleEmailRSVP_MissingUIDRejected(t *testing.T) {
+	t.Parallel()
+	server, _ := rsvpHappyPathMock(t, noUIDInviteMIME)
+
+	w := postRSVP(t, server, "email-1", `{"status":"yes"}`)
+	if w.Code != http.StatusUnprocessableEntity {
+		t.Errorf("status=%d body=%s, want 422 (no UID)", w.Code, w.Body.String())
+	}
+}
+
+func TestHandleEmailRSVP_NoMatchingEvent(t *testing.T) {
+	t.Parallel()
+	server, mock := rsvpHappyPathMock(t, rsvpInviteMIME)
+
+	mock.GetEventsWithCursorFunc = func(context.Context, string, string, *domain.EventQueryParams) (*domain.EventListResponse, error) {
+		return &domain.EventListResponse{Data: nil}, nil
+	}
+
+	w := postRSVP(t, server, "email-1", `{"status":"yes"}`)
+	if w.Code != http.StatusNotFound {
+		t.Errorf("status=%d body=%s, want 404 (event not imported)", w.Code, w.Body.String())
+	}
+	if !strings.Contains(w.Body.String(), "imported") {
+		t.Errorf("error message should mention import lag, got %s", w.Body.String())
+	}
+}
+
+// TestHandleEmailRSVP_NoWritableCalendar pins the user-facing surface
+// for "this account has only read-only calendars". This is a
+// config-shaped failure — not transient — so the response must be 422
+// with a descriptive message, not a generic 502 that would invite a
+// useless retry. Asserting the message body too keeps a future refactor
+// from silently broadening the user-visible string.
+func TestHandleEmailRSVP_NoWritableCalendar(t *testing.T) {
+	t.Parallel()
+	server, mock := rsvpHappyPathMock(t, rsvpInviteMIME)
+
+	mock.GetCalendarsFunc = func(context.Context, string) ([]domain.Calendar, error) {
+		return []domain.Calendar{
+			{ID: "subscribed", Name: "US Holidays", IsPrimary: true, ReadOnly: true},
+		}, nil
+	}
+
+	w := postRSVP(t, server, "email-1", `{"status":"yes"}`)
+	if w.Code != http.StatusUnprocessableEntity {
+		t.Errorf("status=%d body=%s, want 422 (no writable calendar — config issue, not transient)", w.Code, w.Body.String())
+	}
+	if !strings.Contains(w.Body.String(), "writable") {
+		t.Errorf("response should mention 'writable' so users know what to fix; got %s", w.Body.String())
+	}
+}
+
+// TestHandleEmailRSVP_FindsEventInSecondaryCalendar pins the multi-calendar
+// search: when the invite landed in a writable calendar that ISN'T the
+// primary (work + personal account, shared team calendar, etc.), the
+// handler must keep looking instead of returning "not imported" off the
+// first calendar's empty result. Also pins the lookup ORDER — primary
+// must be queried first so we don't surprise users with a slower or
+// less-likely-to-match calendar getting priority.
+func TestHandleEmailRSVP_FindsEventInSecondaryCalendar(t *testing.T) {
+	t.Parallel()
+	server, mock := rsvpHappyPathMock(t, rsvpInviteMIME)
+
+	mock.GetCalendarsFunc = func(context.Context, string) ([]domain.Calendar, error) {
+		return []domain.Calendar{
+			{ID: "primary-cal", IsPrimary: true, ReadOnly: false},
+			{ID: "team-cal", IsPrimary: false, ReadOnly: false},
+		}, nil
+	}
+	// Record query order so we can pin "primary first, then secondaries"
+	// — the docstring on findInviteEventAcrossCalendars promises this and
+	// without an order assertion a future refactor could quietly invert it.
+	var queryOrder []string
+	mock.GetEventsWithCursorFunc = func(_ context.Context, _, calendarID string, params *domain.EventQueryParams) (*domain.EventListResponse, error) {
+		if params == nil || params.ICalUID == "" {
+			t.Errorf("ical_uid filter missing on calendar %q", calendarID)
+		}
+		queryOrder = append(queryOrder, calendarID)
+		if calendarID == "team-cal" {
+			return &domain.EventListResponse{Data: []domain.Event{{ID: "evt-team-1"}}}, nil
+		}
+		return &domain.EventListResponse{Data: nil}, nil
+	}
+
+	var sentCal, sentEvent string
+	mock.SendRSVPFunc = func(_ context.Context, _, calendarID, eventID string, _ *domain.SendRSVPRequest) error {
+		sentCal = calendarID
+		sentEvent = eventID
+		return nil
+	}
+
+	w := postRSVP(t, server, "email-1", `{"status":"yes"}`)
+	if w.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s, want 200 (event must resolve via secondary calendar)", w.Code, w.Body.String())
+	}
+	if sentCal != "team-cal" || sentEvent != "evt-team-1" {
+		t.Errorf("RSVP sent to (%q, %q), want (team-cal, evt-team-1)", sentCal, sentEvent)
+	}
+	wantOrder := []string{"primary-cal", "team-cal"}
+	if !reflect.DeepEqual(queryOrder, wantOrder) {
+		t.Errorf("calendar lookup order=%v, want %v (primary must be queried first)", queryOrder, wantOrder)
+	}
+}
+
+// TestHandleEmailRSVP_TransientErrorOnPrimaryFallsThroughToSecondary
+// pins the partial-failure walk: a flaky primary should NOT abort the
+// search if a later calendar holds the event. Without this test, a
+// future refactor could decide "tracked errors abort the loop" without
+// breaking any existing assertion.
+func TestHandleEmailRSVP_TransientErrorOnPrimaryFallsThroughToSecondary(t *testing.T) {
+	t.Parallel()
+	server, mock := rsvpHappyPathMock(t, rsvpInviteMIME)
+
+	mock.GetCalendarsFunc = func(context.Context, string) ([]domain.Calendar, error) {
+		return []domain.Calendar{
+			{ID: "primary-cal", IsPrimary: true, ReadOnly: false},
+			{ID: "team-cal", IsPrimary: false, ReadOnly: false},
+		}, nil
+	}
+	mock.GetEventsWithCursorFunc = func(_ context.Context, _, calendarID string, _ *domain.EventQueryParams) (*domain.EventListResponse, error) {
+		if calendarID == "primary-cal" {
+			// Transient blip — must NOT short-circuit the walk.
+			return nil, errors.New("upstream 503 service unavailable")
+		}
+		return &domain.EventListResponse{Data: []domain.Event{{ID: "evt-team-2"}}}, nil
+	}
+
+	var sentCal, sentEvent string
+	mock.SendRSVPFunc = func(_ context.Context, _, calendarID, eventID string, _ *domain.SendRSVPRequest) error {
+		sentCal = calendarID
+		sentEvent = eventID
+		return nil
+	}
+
+	w := postRSVP(t, server, "email-1", `{"status":"yes"}`)
+	if w.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s, want 200 (transient err on primary must fall through)", w.Code, w.Body.String())
+	}
+	if sentCal != "team-cal" || sentEvent != "evt-team-2" {
+		t.Errorf("RSVP sent to (%q, %q), want (team-cal, evt-team-2)", sentCal, sentEvent)
+	}
+}
+
+// TestHandleEmailRSVP_TransientLookupErrorSurfacedWhenAllFail pins that
+// when every writable calendar errors on the lookup, the handler returns
+// 502 (so the user can retry) — NOT 404. A transient Nylas blip on a
+// secondary calendar shouldn't be reported as "this invite doesn't
+// exist."
+func TestHandleEmailRSVP_TransientLookupErrorSurfacedWhenAllFail(t *testing.T) {
+	t.Parallel()
+	server, mock := rsvpHappyPathMock(t, rsvpInviteMIME)
+
+	mock.GetCalendarsFunc = func(context.Context, string) ([]domain.Calendar, error) {
+		return []domain.Calendar{
+			{ID: "cal-a", IsPrimary: true, ReadOnly: false},
+			{ID: "cal-b", IsPrimary: false, ReadOnly: false},
+		}, nil
+	}
+	mock.GetEventsWithCursorFunc = func(context.Context, string, string, *domain.EventQueryParams) (*domain.EventListResponse, error) {
+		return nil, errors.New("upstream 502")
+	}
+
+	w := postRSVP(t, server, "email-1", `{"status":"yes"}`)
+	if w.Code != http.StatusBadGateway {
+		t.Errorf("status=%d body=%s, want 502 (transient lookup error must not be 404)", w.Code, w.Body.String())
+	}
+}
+
+func TestHandleEmailRSVP_FallsBackToFirstWritableCalendar(t *testing.T) {
+	t.Parallel()
+	server, mock := rsvpHappyPathMock(t, rsvpInviteMIME)
+
+	mock.GetCalendarsFunc = func(context.Context, string) ([]domain.Calendar, error) {
+		// Primary is read-only (e.g. a "holidays" subscription marked
+		// primary by mistake) — handler should fall through to the next
+		// writable calendar instead of failing.
+		return []domain.Calendar{
+			{ID: "ro", IsPrimary: true, ReadOnly: true},
+			{ID: "writable", IsPrimary: false, ReadOnly: false},
+		}, nil
+	}
+
+	var seenCal string
+	mock.SendRSVPFunc = func(_ context.Context, _, calendarID, _ string, _ *domain.SendRSVPRequest) error {
+		seenCal = calendarID
+		return nil
+	}
+
+	w := postRSVP(t, server, "email-1", `{"status":"maybe"}`)
+	if w.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s", w.Code, w.Body.String())
+	}
+	if seenCal != "writable" {
+		t.Errorf("calendarID=%q, want fallback to writable", seenCal)
+	}
+}
+
+func TestHandleEmailRSVP_UpstreamSendRSVPError(t *testing.T) {
+	t.Parallel()
+	server, mock := rsvpHappyPathMock(t, rsvpInviteMIME)
+
+	mock.SendRSVPFunc = func(context.Context, string, string, string, *domain.SendRSVPRequest) error {
+		return errors.New("nylas API error: 503 service unavailable")
+	}
+
+	w := postRSVP(t, server, "email-1", `{"status":"no"}`)
+	if w.Code != http.StatusBadGateway {
+		t.Errorf("status=%d body=%s, want 502", w.Code, w.Body.String())
+	}
+}
+
+func TestHandleEmailRSVP_UpstreamGetMessageError(t *testing.T) {
+	t.Parallel()
+	server, mock := rsvpHappyPathMock(t, rsvpInviteMIME)
+
+	mock.GetMessageFunc = func(context.Context, string, string) (*domain.Message, error) {
+		return nil, errors.New("nylas API error: 500")
+	}
+
+	w := postRSVP(t, server, "email-1", `{"status":"yes"}`)
+	if w.Code != http.StatusBadGateway {
+		t.Errorf("status=%d body=%s, want 502", w.Code, w.Body.String())
+	}
+}
+
+// TestHandleEmailRSVP_RawMimeFetchFails pins the regression where a
+// transient raw_mime fetch failure was misclassified as "no invite" and
+// returned 404. Now it must propagate as 502 so the frontend can offer
+// a retry rather than telling the user the invite doesn't exist.
+func TestHandleEmailRSVP_RawMimeFetchFails(t *testing.T) {
+	t.Parallel()
+	server, mock := rsvpHappyPathMock(t, rsvpInviteMIME)
+
+	// GetMessage succeeds but exposes no parseable attachment, so the
+	// resolver MUST fall through to GetMessageWithFields. Make that fail
+	// with a transient-looking error.
+	mock.GetMessageFunc = func(_ context.Context, _, messageID string) (*domain.Message, error) {
+		return &domain.Message{ID: messageID, Subject: "Event Invitation"}, nil
+	}
+	mock.GetMessageWithFieldsFunc = func(context.Context, string, string, string) (*domain.Message, error) {
+		return nil, errors.New("upstream timeout: 504")
+	}
+
+	w := postRSVP(t, server, "email-1", `{"status":"yes"}`)
+	if w.Code != http.StatusBadGateway {
+		t.Errorf("status=%d body=%s, want 502 (raw_mime fetch failure should not be 404)", w.Code, w.Body.String())
+	}
+	if strings.Contains(w.Body.String(), "does not contain a calendar invitation") {
+		t.Errorf("raw_mime fetch failure must not be misreported as 'no invite'; body=%s", w.Body.String())
+	}
+}
+
+// TestHandleEmailInvite_RawMimeFetchSilentlyDegrades pins the inverse
+// for the preview endpoint: the same upstream failure should silently
+// return HasInvite:false (so the email view doesn't error out) rather
+// than crash the page with 500. Behavioural pair to the test above.
+func TestHandleEmailInvite_RawMimeFetchSilentlyDegrades(t *testing.T) {
+	t.Parallel()
+	server, mock, _ := newCachedTestServer(t)
+
+	mock.GetMessageFunc = func(_ context.Context, _, messageID string) (*domain.Message, error) {
+		return &domain.Message{ID: messageID, Subject: "Event Invitation"}, nil
+	}
+	mock.GetMessageWithFieldsFunc = func(context.Context, string, string, string) (*domain.Message, error) {
+		return nil, errors.New("upstream timeout: 504")
+	}
+
+	w := httptest.NewRecorder()
+	r := httptest.NewRequest(http.MethodGet, "/api/emails/email-1/invite", http.NoBody)
+	server.handleEmailInvite(w, r, "email-1")
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s, want 200 (silent degrade)", w.Code, w.Body.String())
+	}
+	var got CalendarInviteResponse
+	if err := json.Unmarshal(w.Body.Bytes(), &got); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if got.HasInvite {
+		t.Errorf("HasInvite=true on raw_mime fetch failure, want false; body=%s", w.Body.String())
+	}
+}
+
+func TestHandleEmailRSVP_DemoMode(t *testing.T) {
+	t.Parallel()
+	server, _, _ := newCachedTestServer(t)
+	server.demoMode = true
+
+	w := postRSVP(t, server, "any-email", `{"status":"yes"}`)
+	if w.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s", w.Code, w.Body.String())
+	}
+	var got rsvpResponse
+	if err := json.Unmarshal(w.Body.Bytes(), &got); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if got.Status != "yes" || got.EventID == "" {
+		t.Errorf("demo response=%+v", got)
+	}
+}
+
+func TestHandleEmailRSVP_AttachmentPathHasUID(t *testing.T) {
+	// When the email carries the ICS as a real attachment (Microsoft's
+	// shape), the parser should still surface the UID so RSVP works.
+	t.Parallel()
+	server, mock, _ := newCachedTestServer(t)
+
+	icsBody := "BEGIN:VCALENDAR\r\nVERSION:2.0\r\nPRODID:-//T//EN\r\nMETHOD:REQUEST\r\n" +
+		"BEGIN:VEVENT\r\nUID:attached-uid@example.com\r\nSUMMARY:Attached\r\n" +
+		"DTSTART:20260501T140000Z\r\nDTEND:20260501T150000Z\r\n" +
+		"END:VEVENT\r\nEND:VCALENDAR\r\n"
+
+	mock.GetMessageFunc = func(context.Context, string, string) (*domain.Message, error) {
+		return &domain.Message{
+			ID: "email-x",
+			Attachments: []domain.Attachment{
+				{ID: "att-1", Filename: "invite.ics", ContentType: "text/calendar"},
+			},
+		}, nil
+	}
+	mock.DownloadAttachmentFunc = func(context.Context, string, string, string) (io.ReadCloser, error) {
+		return io.NopCloser(strings.NewReader(icsBody)), nil
+	}
+	mock.GetCalendarsFunc = func(context.Context, string) ([]domain.Calendar, error) {
+		return []domain.Calendar{{ID: "primary", IsPrimary: true}}, nil
+	}
+	var seenUID string
+	mock.GetEventsWithCursorFunc = func(_ context.Context, _, _ string, params *domain.EventQueryParams) (*domain.EventListResponse, error) {
+		if params != nil {
+			seenUID = params.ICalUID
+		}
+		return &domain.EventListResponse{Data: []domain.Event{{ID: "evt-attached-1"}}}, nil
+	}
+	mock.SendRSVPFunc = func(context.Context, string, string, string, *domain.SendRSVPRequest) error {
+		return nil
+	}
+
+	w := postRSVP(t, server, "email-x", `{"status":"yes"}`)
+	if w.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s", w.Code, w.Body.String())
+	}
+	if seenUID != "attached-uid@example.com" {
+		t.Errorf("ical_uid passed to events lookup=%q, want attached-uid@example.com", seenUID)
+	}
+}
+
+// TestParseICS_SurfacesUID covers the parser change for the RSVP feature.
+// Without the UID the RSVP handler can't resolve a Nylas event ID.
+func TestParseICS_SurfacesUID(t *testing.T) {
+	body := "BEGIN:VCALENDAR\r\nVERSION:2.0\r\nPRODID:-//T//EN\r\nMETHOD:REQUEST\r\n" +
+		"BEGIN:VEVENT\r\nUID:my-uid@example.com\r\nSUMMARY:Standup\r\n" +
+		"DTSTART:20260501T140000Z\r\nDTEND:20260501T150000Z\r\n" +
+		"END:VEVENT\r\nEND:VCALENDAR\r\n"
+	got, err := parseICS(body)
+	if err != nil {
+		t.Fatalf("parseICS: %v", err)
+	}
+	if got.ICalUID != "my-uid@example.com" {
+		t.Errorf("ICalUID=%q, want my-uid@example.com", got.ICalUID)
+	}
+}
+
+// (postRSVP moved to handlers_email_rsvp_fixtures_test.go)
diff --git a/internal/air/handlers_email_silent_failure_test.go b/internal/air/handlers_email_silent_failure_test.go
new file mode 100644
index 0000000..e485760
--- /dev/null
+++ b/internal/air/handlers_email_silent_failure_test.go
@@ -0,0 +1,204 @@
+package air
+
+import (
+	"bytes"
+	"context"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/nylas/cli/internal/air/cache"
+	"github.com/nylas/cli/internal/domain"
+	"github.com/stretchr/testify/assert"
+)
+
+// captureSlog redirects slog.Default to a buffer for the duration of t.
+// Tests using it must not call t.Parallel() — slog.Default is process-global.
+func captureSlog(t *testing.T) *bytes.Buffer {
+	t.Helper()
+	buf := &bytes.Buffer{}
+	handler := slog.NewTextHandler(buf, &slog.HandlerOptions{Level: slog.LevelDebug})
+	prev := slog.Default()
+	slog.SetDefault(slog.New(handler))
+	t.Cleanup(func() { slog.SetDefault(prev) })
+	return buf
+}
+
+// TestHandleDeleteEmail_OfflineQueueFails_LogsFailure exposes the
+// observability divergence between the near-twin handlers
+// handleUpdateEmail and handleDeleteEmail. Both follow the same
+// shape:
+//
+//	if !s.IsOnline() {
+//	    if err := enqueue(...); err == nil { return queued-200 }
+//	    // err != nil: queue is broken, falling through to API
+//	}
+//	... live API call ...
+//
+// handleUpdateEmail logs the offline-enqueue failure at
+// handlers_email.go:305 ("offline enqueue failed, attempting live API
+// call"). handleDeleteEmail does not — the err return from
+// enqueueMessageDelete on line 372 is silently dropped (no else
+// clause). A queue health regression that affects both code paths is
+// debuggable for update and invisible for delete.
+//
+// EXPECTED FAILURE today: the slog buffer for the delete path is
+// empty (no warning emitted). After the fix it contains a warning
+// referencing the emailID. The fail-first message is the bug receipt.
+func TestHandleDeleteEmail_OfflineQueueFails_LogsFailure(t *testing.T) {
+	// No t.Parallel — captureSlog mutates the process-global default.
+	server, client, _ := newCachedTestServer(t)
+	server.SetOnline(false)
+	// Disable the offline queue so enqueueMessageDelete returns
+	// "offline queue unavailable" (handlers_email_offline.go:51).
+	server.cacheSettings.OfflineQueueEnabled = false
+
+	apiCalled := false
+	client.DeleteMessageFunc = func(context.Context, string, string) error {
+		apiCalled = true
+		return nil
+	}
+
+	const sentinelEmailID = "deletefail-canary-offline-XYZ"
+	logs := captureSlog(t)
+
+	req := httptest.NewRequest(http.MethodDelete, "/api/emails/"+sentinelEmailID, nil)
+	w := httptest.NewRecorder()
+	server.handleDeleteEmail(w, req, sentinelEmailID)
+
+	if !apiCalled {
+		t.Fatal("expected fall-through to live DeleteMessage when queue fails")
+	}
+	got := logs.String()
+	assert.Contains(t, got, sentinelEmailID,
+		"slog should record the offline-queue failure for emailID %q (parity with handleUpdateEmail line 305); got %q",
+		sentinelEmailID, got)
+}
+
+// TestHandleDeleteEmail_QueueWriteAfterTransientError_LogsQueueFailure
+// pins the second observability gap. When the live API errors with a
+// transient/queue-eligible error AND the offline queue write itself
+// fails, handleUpdateEmail logs both error contexts together at
+// handlers_email.go:330-335:
+//
+//	slog.Error("queue enqueue after transient API error failed",
+//	    "emailID", emailID, "apiErr", err, "queueErr", queueErr)
+//
+// handleDeleteEmail's mirror branch (handlers_email.go:384-393) has no
+// such log — only the catch-all "Failed to delete email" log fires
+// with `err = apiErr`, dropping the `queueErr` context entirely. The
+// double-failure mode is exactly when a queue health alert matters
+// most (the user is also about to see a 500), and it's exactly when
+// the divergence makes it invisible.
+//
+// EXPECTED FAILURE today: the slog buffer captures "Failed to delete
+// email" but does not record the queueErr substring "offline queue
+// unavailable". After the fix the queueErr is co-logged with apiErr.
+func TestHandleDeleteEmail_QueueWriteAfterTransientError_LogsQueueFailure(t *testing.T) {
+	// No t.Parallel — captureSlog mutates the process-global default.
+	server, client, _ := newCachedTestServer(t)
+	client.DeleteMessageFunc = func(context.Context, string, string) error {
+		return &transientNetErr{}
+	}
+	// To reach the inner queueErr branch we need shouldQueueEmailAction
+	// to say YES (queue is configured AND error looks transient) but
+	// the actual enqueue to fail. Achieved by replacing the grant
+	// store's grant with one whose Email is empty: withAuthGrant still
+	// resolves the default grant (ID-based), but
+	// `getAccountEmail(grantID)` returns "" because the grant's Email
+	// is blank, which trips enqueueMessageDelete's first guard:
+	// `if accountEmail == "" { return errors.New("offline queue unavailable") }`.
+	grantStore := server.grantStore.(*testGrantStore)
+	grantStore.grants = []domain.GrantInfo{{
+		ID:       "grant-123",
+		Email:    "", // ← the load-bearing empty
+		Provider: domain.ProviderGoogle,
+	}}
+	grantStore.defaultGrant = "grant-123"
+
+	const sentinelEmailID = "deletefail-canary-double-XYZ"
+	logs := captureSlog(t)
+
+	req := httptest.NewRequest(http.MethodDelete, "/api/emails/"+sentinelEmailID, nil)
+	w := httptest.NewRecorder()
+	server.handleDeleteEmail(w, req, sentinelEmailID)
+
+	if w.Code != http.StatusInternalServerError {
+		t.Fatalf("status=%d body=%s, want 500 (double-failure path)",
+			w.Code, w.Body.String())
+	}
+	got := logs.String()
+	// Sentinel from the queue-error message in handlers_email_offline.go:51.
+	const queueErrSentinel = "offline queue unavailable"
+	assert.Contains(t, got, queueErrSentinel,
+		"slog should record the queueErr context (parity with handleUpdateEmail lines 330-335); got %q",
+		got)
+	// Also assert the test's emailID appears so the log is correlatable
+	// to the failing request — same correlation handleUpdateEmail offers.
+	assert.Contains(t, got, sentinelEmailID,
+		"slog should record emailID for correlation; got %q", got)
+}
+
+// TestHandleGetEmail_CacheFillFailure_LogsFailure pins the parity gap
+// between handleListEmails (handlers_email.go:144 logs cache-fill
+// failures) and handleGetEmail (line 261-264 silently does
+// `_ = s.withEmailStore(...)`). The user-facing behavior is correct —
+// cache write failures must not break the response — but the silent
+// drop means a wedged single-message cache drifts further from server
+// state on every request, with no log to debug from.
+//
+// We force the write to fail by dropping the underlying SQLite emails
+// table after lazy-init: the lookup call returns "no such table" (no
+// cache hit, falls through), the live GetMessage succeeds, the
+// post-fetch Put then fails for the same reason. Today no log fires.
+// After the fix, slog should record the failure with the sentinel
+// emailID for support diagnosability.
+//
+// EXPECTED FAILURE today: the slog buffer for the cache-fill path is
+// silent. After the fix it contains a warning referencing the emailID
+// (parity with handleListEmails).
+func TestHandleGetEmail_CacheFillFailure_LogsFailure(t *testing.T) {
+	// No t.Parallel — captureSlog mutates the process-global default.
+	server, client, accountEmail := newCachedTestServer(t)
+
+	const sentinelEmailID = "cachefill-canary-XYZ"
+	client.GetMessageFunc = func(_ context.Context, _, msgID string) (*domain.Message, error) {
+		return &domain.Message{
+			ID:      msgID,
+			Subject: "Test message",
+			From:    []domain.EmailParticipant{{Email: "x@example.com"}},
+		}, nil
+	}
+
+	// Lazy-init the emails table by acquiring the store once, then
+	// drop it so the post-GetMessage Put fails with "no such table:
+	// emails". The handler-side `_ = s.withEmailStore(...)` swallows
+	// that error today.
+	if err := server.withEmailStore(accountEmail, func(_ *cache.EmailStore) error { return nil }); err != nil {
+		t.Fatalf("lazy-init emails store: %v", err)
+	}
+	db, err := server.cacheManager.GetDB(accountEmail)
+	if err != nil {
+		t.Fatalf("get db: %v", err)
+	}
+	if _, err := db.Exec("DROP TABLE IF EXISTS emails"); err != nil {
+		t.Fatalf("drop table: %v", err)
+	}
+
+	logs := captureSlog(t)
+
+	req := httptest.NewRequest(http.MethodGet, "/api/emails/"+sentinelEmailID, nil)
+	w := httptest.NewRecorder()
+	server.handleGetEmail(w, req, sentinelEmailID)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s, want 200 — user-facing response must not break on cache failure",
+			w.Code, w.Body.String())
+	}
+
+	got := logs.String()
+	assert.Contains(t, got, sentinelEmailID,
+		"slog should record the emailID for cache-fill failures (parity with handleListEmails:144); got %q",
+		got)
+}
diff --git a/internal/air/handlers_helpers.go b/internal/air/handlers_helpers.go
index 4b259b9..1ae84e1 100644
--- a/internal/air/handlers_helpers.go
+++ b/internal/air/handlers_helpers.go
@@ -3,7 +3,9 @@ package air
 import (
 	"context"
 	"encoding/json"
+	"log/slog"
 	"net/http"
+	"strings"
 	"time"
 )
 
@@ -29,19 +31,29 @@ func (s *Server) requireConfig(w http.ResponseWriter) bool {
 	return true
 }
 
-// parseJSONBody decodes a JSON request body into the provided destination.
-// Returns true if successful, false if not (error response already written).
-// Callers should return immediately when this returns false.
+// parseJSONBody decodes the request body into dest. Returns false on
+// error after writing a generic 400; the raw decoder error stays in slog
+// (it can quote request bytes — PII or attacker input).
 func parseJSONBody[T any](w http.ResponseWriter, r *http.Request, dest *T) bool {
 	if err := json.NewDecoder(limitedBody(w, r)).Decode(dest); err != nil {
-		writeJSON(w, http.StatusBadRequest, map[string]string{
-			"error": "Invalid request body: " + err.Error(),
-		})
+		slog.Warn("invalid JSON request body",
+			"err", err,
+			"path", r.URL.Path,
+			"method", r.Method,
+		)
+		writeError(w, http.StatusBadRequest, "Invalid request body")
 		return false
 	}
 	return true
 }
 
+// writeBadParamError writes a generic 400 ("invalid <key>") and logs the
+// raw parser error via slog (it formats the raw query value with %q).
+func writeBadParamError(w http.ResponseWriter, key string, perr error) {
+	slog.Warn("invalid query parameter", "key", key, "err", perr)
+	writeError(w, http.StatusBadRequest, "invalid "+key)
+}
+
 // handleDemoMode returns the demo response if in demo mode.
 // Returns true if demo mode is active (response already written), false otherwise.
 // Callers should return immediately when this returns true.
@@ -58,7 +70,7 @@ func (s *Server) handleDemoMode(w http.ResponseWriter, data any) bool {
 // Callers should return immediately when this returns false.
 func requireMethod(w http.ResponseWriter, r *http.Request, method string) bool {
 	if r.Method != method {
-		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		writeError(w, http.StatusMethodNotAllowed, "Method not allowed")
 		return false
 	}
 	return true
@@ -69,6 +81,31 @@ func writeError(w http.ResponseWriter, status int, message string) {
 	writeJSON(w, status, map[string]string{"error": message})
 }
 
+// writeUpstreamError writes msg to the client and logs the raw err via
+// slog. Use whenever an upstream error string could leak grant IDs,
+// endpoint paths, or response fragments. attrs are extra slog kv pairs.
+func writeUpstreamError(w http.ResponseWriter, status int, msg string, err error, attrs ...any) {
+	slog.Error(msg, append([]any{"err", err}, attrs...)...)
+	writeError(w, status, msg)
+}
+
+// redactEmail returns a log-safe rendering of an email address: the
+// local part is replaced with "***" so the domain remains debuggable
+// without writing the full address into log files. Empty input stays
+// empty so missing-account branches don't gain a misleading "***".
+//
+// Example: "alice@example.com" → "***@example.com".
+func redactEmail(email string) string {
+	if email == "" {
+		return ""
+	}
+	at := strings.LastIndex(email, "@")
+	if at <= 0 || at == len(email)-1 {
+		return "***"
+	}
+	return "***" + email[at:]
+}
+
 // withAuthGrant combines demo mode check, config check, and grant ID retrieval.
 // Returns the grant ID if all checks pass, or empty string if any check fails
 // (appropriate error response already written).
diff --git a/internal/air/handlers_helpers_test.go b/internal/air/handlers_helpers_test.go
index f9cceea..b03d6ef 100644
--- a/internal/air/handlers_helpers_test.go
+++ b/internal/air/handlers_helpers_test.go
@@ -284,3 +284,81 @@ func TestWriteError(t *testing.T) {
 		assert.Contains(t, body, "quotes")
 	})
 }
+
+// TestParseJSONBody_DoesNotLeakDecoderError pins the privacy contract on
+// the JSON-body intake helper. Today it returns
+//
+//	"Invalid request body: " + err.Error()
+//
+// to the client. encoding/json's decode errors fingerprint the request
+// — they include the Go struct field path, the wire type, and (for
+// UnmarshalTypeError) value fragments from the body. None of that
+// belongs in a browser toast or a customer-visible error envelope.
+//
+// The same writeUpstreamError discipline applied at six handler sites in
+// the air-i003 review-pass should apply here. Until parseJSONBody is
+// migrated, this test fails on the substring assertions and serves as
+// the bug receipt.
+//
+// EXPECTED FAILURE today: response body contains "cannot unmarshal" and
+// the field path. After the fix the body is a generic message and the
+// raw decoder error lives in slog only.
+func TestParseJSONBody_DoesNotLeakDecoderError(t *testing.T) {
+	t.Parallel()
+
+	body := strings.NewReader(`{"unread":"not-a-bool"}`)
+	req := httptest.NewRequest(http.MethodPost, "/x", body)
+	w := httptest.NewRecorder()
+
+	var dest struct {
+		Unread *bool `json:"unread"`
+	}
+	ok := parseJSONBody(w, req, &dest)
+
+	assert.False(t, ok, "parseJSONBody should reject malformed body")
+	assert.Equal(t, http.StatusBadRequest, w.Code)
+
+	got := w.Body.String()
+	// Substrings drawn from encoding/json's UnmarshalTypeError format.
+	// Any of them in the response body proves the decoder error leaked.
+	forbidden := []string{
+		"cannot unmarshal",
+		"Go struct field",
+		".unread",
+		"of type bool",
+	}
+	for _, s := range forbidden {
+		assert.NotContains(t, got, s,
+			"response body must not echo decoder detail %q; got %s", s, got)
+	}
+}
+
+// TestRedactEmail pins the local-part-only redaction. Six-line privacy
+// helper, exercised today only indirectly through slog calls — a
+// regression that returned the full address would only show up in logs
+// (which tests don't observe) until a customer report surfaced it.
+func TestRedactEmail(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		in   string
+		want string
+	}{
+		{"", ""},
+		{"alice@example.com", "***@example.com"},
+		{"a@b.example", "***@b.example"},
+		// LastIndex semantics: only the final @ is treated as the boundary.
+		{"user@inner@outer.example", "***@outer.example"},
+		// Degenerate inputs: no local part, no domain, no @ at all.
+		{"@example.com", "***"},
+		{"user@", "***"},
+		{"no-at-sign", "***"},
+		{"@", "***"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.in, func(t *testing.T) {
+			t.Parallel()
+			assert.Equal(t, tc.want, redactEmail(tc.in))
+		})
+	}
+}
diff --git a/internal/air/handlers_privacy_sweep_test.go b/internal/air/handlers_privacy_sweep_test.go
new file mode 100644
index 0000000..17affd2
--- /dev/null
+++ b/internal/air/handlers_privacy_sweep_test.go
@@ -0,0 +1,181 @@
+package air
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/nylas/cli/internal/domain"
+	"github.com/stretchr/testify/assert"
+)
+
+// upstreamErrorSentinel is a noise-laden upstream error string that
+// resembles real Nylas API failures: it carries grant identifiers,
+// endpoint paths, and token-shaped fragments. Each writeUpstreamError
+// site is supposed to redact this entirely from the response body and
+// log the raw err via slog only. Tests assert the response body does
+// not echo any of these substrings.
+const upstreamErrorSentinel = "nylas 503: grant_id=secret-grant-leak-XYZ refresh_token=ya29.zzCANARYzz endpoint=/v3/grants/g/leak"
+
+func bodyDoesNotLeakUpstream(t *testing.T, body string) {
+	t.Helper()
+	for _, fragment := range []string{
+		"secret-grant-leak-XYZ",
+		"ya29.zzCANARYzz",
+		"/v3/grants/g/leak",
+		"503",
+	} {
+		assert.NotContains(t, body, fragment,
+			"response body leaked upstream-error fragment %q; got %s",
+			fragment, body)
+	}
+}
+
+// TestHandleListEmails_APIError_NoCache_DoesNotLeakUpstream pins the
+// privacy contract on handlers_email.go:123 — the writeUpstreamError
+// site reached when the API call fails AND the cache fallback yields
+// nothing. The user gets a 500; the body must be a generic "please
+// try again" message; the upstream err lives in slog only.
+//
+// Lock-down: redaction is in place today. A regression that
+// re-introduced `err.Error()` interpolation would surface here.
+func TestHandleListEmails_APIError_NoCache_DoesNotLeakUpstream(t *testing.T) {
+	t.Parallel()
+	server, client, _ := newCachedTestServer(t)
+	// Mock routes GetMessagesWithCursor through GetMessagesWithParamsFunc
+	// (see mock_messages.go:32) — set the params variant so the cursor
+	// call still hits our error path.
+	client.GetMessagesWithParamsFunc = func(_ context.Context, _ string, _ *domain.MessageQueryParams) ([]domain.Message, error) {
+		return nil, errors.New(upstreamErrorSentinel)
+	}
+
+	req := httptest.NewRequest(http.MethodGet, "/api/emails?folder=inbox", nil)
+	w := httptest.NewRecorder()
+	server.handleListEmails(w, req)
+
+	if w.Code != http.StatusInternalServerError {
+		t.Fatalf("status=%d body=%s, want 500 (no cache → upstream error)",
+			w.Code, w.Body.String())
+	}
+	bodyDoesNotLeakUpstream(t, w.Body.String())
+}
+
+// TestHandleEmailInvite_APIError_DoesNotLeakUpstream pins the privacy
+// contract on handlers_email_invite.go:96 — the writeUpstreamError
+// site reached on the initial GetMessage failure (a hard error,
+// distinct from errInviteFetchFailed which yields a silent
+// HasInvite:false 200).
+func TestHandleEmailInvite_APIError_DoesNotLeakUpstream(t *testing.T) {
+	t.Parallel()
+	server, client, _ := newCachedTestServer(t)
+	client.GetMessageFunc = func(context.Context, string, string) (*domain.Message, error) {
+		return nil, errors.New(upstreamErrorSentinel)
+	}
+
+	req := httptest.NewRequest(http.MethodGet, "/api/emails/email-1/invite", nil)
+	w := httptest.NewRecorder()
+	server.handleEmailInvite(w, req, "email-1")
+
+	if w.Code != http.StatusInternalServerError {
+		t.Fatalf("status=%d body=%s, want 500 (upstream GetMessage failure)",
+			w.Code, w.Body.String())
+	}
+	bodyDoesNotLeakUpstream(t, w.Body.String())
+}
+
+// TestHandleAvailability_UpstreamError_DoesNotLeakUpstream pins
+// handlers_availability.go:226 — Nylas GetAvailability failure.
+func TestHandleAvailability_UpstreamError_DoesNotLeakUpstream(t *testing.T) {
+	t.Parallel()
+	server, client, _ := newCachedTestServer(t)
+	client.GetAvailabilityFunc = func(context.Context, *domain.AvailabilityRequest) (*domain.AvailabilityResponse, error) {
+		return nil, errors.New(upstreamErrorSentinel)
+	}
+
+	req := httptest.NewRequest(http.MethodGet,
+		"/api/availability?start_time=1700000000&end_time=1700100000&participants=alice@example.com",
+		nil)
+	w := httptest.NewRecorder()
+	server.handleAvailability(w, req)
+
+	if w.Code != http.StatusInternalServerError {
+		t.Fatalf("status=%d body=%s, want 500 (upstream GetAvailability failure)",
+			w.Code, w.Body.String())
+	}
+	bodyDoesNotLeakUpstream(t, w.Body.String())
+}
+
+// TestHandleFreeBusy_UpstreamError_DoesNotLeakUpstream pins
+// handlers_availability.go:336 — Nylas GetFreeBusy failure.
+func TestHandleFreeBusy_UpstreamError_DoesNotLeakUpstream(t *testing.T) {
+	t.Parallel()
+	server, client, _ := newCachedTestServer(t)
+	client.GetFreeBusyFunc = func(context.Context, string, *domain.FreeBusyRequest) (*domain.FreeBusyResponse, error) {
+		return nil, errors.New(upstreamErrorSentinel)
+	}
+
+	req := httptest.NewRequest(http.MethodGet,
+		"/api/calendars/freebusy?start_time=1700000000&end_time=1700100000&emails=alice@example.com",
+		nil)
+	w := httptest.NewRecorder()
+	server.handleFreeBusy(w, req)
+
+	if w.Code != http.StatusInternalServerError {
+		t.Fatalf("status=%d body=%s, want 500 (upstream GetFreeBusy failure)",
+			w.Code, w.Body.String())
+	}
+	bodyDoesNotLeakUpstream(t, w.Body.String())
+}
+
+// TestHandleConflicts_UpstreamError_DoesNotLeakUpstream pins
+// handlers_availability.go:443 — Nylas GetEventsWithCursor failure.
+func TestHandleConflicts_UpstreamError_DoesNotLeakUpstream(t *testing.T) {
+	t.Parallel()
+	server, client, _ := newCachedTestServer(t)
+	client.GetEventsWithCursorFunc = func(context.Context, string, string, *domain.EventQueryParams) (*domain.EventListResponse, error) {
+		return nil, errors.New(upstreamErrorSentinel)
+	}
+
+	req := httptest.NewRequest(http.MethodGet,
+		"/api/calendar/conflicts?start_time=1700000000&end_time=1700100000",
+		nil)
+	w := httptest.NewRecorder()
+	server.handleConflicts(w, req)
+
+	if w.Code != http.StatusInternalServerError {
+		t.Fatalf("status=%d body=%s, want 500 (upstream GetEventsWithCursor failure)",
+			w.Code, w.Body.String())
+	}
+	bodyDoesNotLeakUpstream(t, w.Body.String())
+}
+
+// TestHandleGetEmail_APIError_NoCache_DoesNotLeakUpstream pins the
+// privacy contract on handlers_email.go:253 — the writeUpstreamError
+// site reached when GetMessage fails AND the cache fallback yields
+// nothing (cache miss or cache disabled). The previous sweep covered
+// list/invite/availability/freebusy/conflicts but the single-message
+// fetch path was left out, so a regression that re-introduced
+// %v(err) interpolation here would not be caught.
+//
+// Lock-down: redaction is in place today. Mirrors the pattern of
+// TestHandleListEmails_APIError_NoCache_DoesNotLeakUpstream — same
+// helper, same sentinel.
+func TestHandleGetEmail_APIError_NoCache_DoesNotLeakUpstream(t *testing.T) {
+	t.Parallel()
+	server, client, _ := newCachedTestServer(t)
+	client.GetMessageFunc = func(context.Context, string, string) (*domain.Message, error) {
+		return nil, errors.New(upstreamErrorSentinel)
+	}
+
+	req := httptest.NewRequest(http.MethodGet, "/api/emails/email-1", nil)
+	w := httptest.NewRecorder()
+	server.handleGetEmail(w, req, "email-1")
+
+	if w.Code != http.StatusInternalServerError {
+		t.Fatalf("status=%d body=%s, want 500 (no cache → upstream error)",
+			w.Code, w.Body.String())
+	}
+	bodyDoesNotLeakUpstream(t, w.Body.String())
+}
diff --git a/internal/air/handlers_types.go b/internal/air/handlers_types.go
index 6a6902c..93d3fe2 100644
--- a/internal/air/handlers_types.go
+++ b/internal/air/handlers_types.go
@@ -115,6 +115,8 @@ type EmailsResponse struct {
 }
 
 // UpdateEmailRequest represents a request to update an email.
+// Folders: nil = leave alone; non-nil empty = Gmail archive
+// (json.Unmarshal preserves this; see domain.UpdateMessageRequest).
 type UpdateEmailRequest struct {
 	Unread  *bool    `json:"unread,omitempty"`
 	Starred *bool    `json:"starred,omitempty"`
diff --git a/internal/air/server_offline.go b/internal/air/server_offline.go
index a216200..bf39045 100644
--- a/internal/air/server_offline.go
+++ b/internal/air/server_offline.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"log/slog"
 
 	"github.com/nylas/cli/internal/air/cache"
 	"github.com/nylas/cli/internal/domain"
@@ -33,6 +34,11 @@ func (s *Server) processOfflineQueue(email string) {
 		grantID, err := s.resolveQueuedActionGrantID(email, action)
 		if err != nil {
 			if action.Attempts >= 3 {
+				slog.Error("offline action permanently dropped: grant unresolvable",
+					"type", action.Type,
+					"resource_id", action.ResourceID,
+					"attempts", action.Attempts,
+					"err", err.Error())
 				_ = s.removeOfflineAction(email, action.ID)
 			} else {
 				_ = s.markOfflineActionFailed(email, action.ID, err)
@@ -43,6 +49,11 @@ func (s *Server) processOfflineQueue(email string) {
 		err = s.processOfflineAction(ctx, grantID, action)
 		if err != nil {
 			if action.Attempts >= 3 {
+				slog.Error("offline action permanently dropped after 3 attempts",
+					"type", action.Type,
+					"resource_id", action.ResourceID,
+					"attempts", action.Attempts,
+					"last_error", err.Error())
 				_ = s.removeOfflineAction(email, action.ID)
 			} else {
 				_ = s.markOfflineActionFailed(email, action.ID, err)
diff --git a/internal/air/server_offline_silent_failure_test.go b/internal/air/server_offline_silent_failure_test.go
new file mode 100644
index 0000000..9b8082a
--- /dev/null
+++ b/internal/air/server_offline_silent_failure_test.go
@@ -0,0 +1,116 @@
+package air
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/nylas/cli/internal/domain"
+	"github.com/stretchr/testify/assert"
+)
+
+// TestProcessOfflineQueue_ActionDroppedAfter3Attempts_LogsFailure pins
+// the worst silent-failure mode in the offline replay loop:
+// server_offline.go:45-46 silently does
+//
+//	if action.Attempts >= 3 {
+//	    _ = s.removeOfflineAction(email, action.ID)
+//	}
+//
+// when an action has failed three times. The action is permanently
+// dropped — the user took an action offline, expected it to sync, and
+// will never know it didn't. There is no slog record, no metric, no
+// trace at all. Support cannot correlate "my offline archive
+// disappeared" reports to log lines because no log line was produced.
+//
+// EXPECTED FAILURE today: after four processOfflineQueue ticks the
+// action is gone from the queue but the slog buffer contains nothing
+// referencing the dropped emailID or the upstream-error sentinel.
+// After the fix an Error-level log entry should fire with the action's
+// resource_id and the last error captured during the attempts.
+func TestProcessOfflineQueue_ActionDroppedAfter3Attempts_LogsFailure(t *testing.T) {
+	// No t.Parallel — captureSlog mutates process-global slog default.
+	server, client, accountEmail := newCachedTestServer(t)
+
+	const sentinelEmailID = "drop-canary-3strike-XYZ"
+	const upstreamErrSentinel = "TRANSIENT-NYLAS-ERR-CANARY-555"
+	client.UpdateMessageFunc = func(_ context.Context, _, _ string, _ *domain.UpdateMessageRequest) (*domain.Message, error) {
+		return nil, errors.New(upstreamErrSentinel)
+	}
+
+	unread := false
+	if err := server.enqueueMessageUpdate("grant-123", accountEmail, sentinelEmailID, &domain.UpdateMessageRequest{
+		Unread: &unread,
+	}); err != nil {
+		t.Fatalf("enqueue: %v", err)
+	}
+
+	logs := captureSlog(t)
+
+	// Four ticks: the peek returns the action.Attempts value AFTER the
+	// previous markFailed wrote attempts+=1, so the sequence is
+	//   tick 1: peek attempts=0 → fail → markFailed → attempts=1
+	//   tick 2: peek attempts=1 → fail → markFailed → attempts=2
+	//   tick 3: peek attempts=2 → fail → markFailed → attempts=3
+	//   tick 4: peek attempts=3 → fail → 3>=3 → SILENT removeOfflineAction
+	for range 4 {
+		server.processOfflineQueue(accountEmail)
+	}
+
+	// Sanity-check: action really was dropped.
+	db, err := server.cacheManager.GetDB(accountEmail)
+	if err != nil {
+		t.Fatalf("get db: %v", err)
+	}
+	var count int
+	if err := db.QueryRow("SELECT COUNT(*) FROM offline_queue").Scan(&count); err != nil {
+		t.Fatalf("count: %v", err)
+	}
+	if count != 0 {
+		t.Fatalf("queue not drained: count=%d, want 0 (3-strike drop expected)", count)
+	}
+
+	got := logs.String()
+	assert.Contains(t, got, sentinelEmailID,
+		"slog must record the dropped action's resource_id for support diagnosis "+
+			"(server_offline.go:46 currently silent); got %q", got)
+	assert.Contains(t, got, upstreamErrSentinel,
+		"slog must record the upstream error context that drove the action "+
+			"to be permanently dropped; got %q", got)
+}
+
+// TestProcessOfflineQueue_PermanentResolveFailure_LogsFailure pins the
+// twin silent-drop site at server_offline.go:35-36: when the grant
+// referenced by a queued action can no longer be resolved (e.g., the
+// user disconnected the account while an offline action was sitting in
+// the queue), the same 3-strike silent removal applies. Today this
+// also fails closed with no observability.
+func TestProcessOfflineQueue_PermanentGrantResolveFailure_LogsFailure(t *testing.T) {
+	// No t.Parallel — captureSlog mutates process-global slog default.
+	server, _, accountEmail := newCachedTestServer(t)
+
+	const sentinelEmailID = "drop-canary-grant-resolve-XYZ"
+
+	unread := false
+	if err := server.enqueueMessageUpdate("grant-DISCONNECTED-123", accountEmail, sentinelEmailID, &domain.UpdateMessageRequest{
+		Unread: &unread,
+	}); err != nil {
+		t.Fatalf("enqueue: %v", err)
+	}
+
+	// Remove the grant after enqueue so resolveQueuedActionGrantID
+	// returns "queued grant <id> unavailable" on every tick.
+	store := server.grantStore.(*testGrantStore)
+	store.grants = nil
+
+	logs := captureSlog(t)
+
+	for range 4 {
+		server.processOfflineQueue(accountEmail)
+	}
+
+	got := logs.String()
+	assert.Contains(t, got, sentinelEmailID,
+		"slog must record the dropped action's resource_id when the grant "+
+			"can no longer be resolved (server_offline.go:36 currently silent); got %q", got)
+}
diff --git a/internal/air/server_stores.go b/internal/air/server_stores.go
index 6341ac1..b069706 100644
--- a/internal/air/server_stores.go
+++ b/internal/air/server_stores.go
@@ -29,7 +29,7 @@ func (s *Server) cacheAvailable() bool {
 	return s.cacheSettings != nil && s.cacheSettings.IsCacheEnabled() && s.hasCacheRuntime()
 }
 
-func (s *Server) offlineQueueConfigured() bool {
+func (s *Server) offlineQueueEnabled() bool {
 	return s.cacheSettings != nil && s.cacheSettings.Get().OfflineQueueEnabled && s.hasCacheRuntime()
 }
 
diff --git a/internal/air/server_template.go b/internal/air/server_template.go
index 29a2b44..025b49a 100644
--- a/internal/air/server_template.go
+++ b/internal/air/server_template.go
@@ -2,6 +2,7 @@ package air
 
 import (
 	"html/template"
+	"log/slog"
 	"net/http"
 	"sync"
 )
@@ -23,10 +24,13 @@ func (s *Server) handleIndex(w http.ResponseWriter, r *http.Request) {
 	// Build page data - use real data when available, fall back to mock
 	data := s.buildPageData()
 
-	// Render template
+	// Render template. Template errors can include data field paths and
+	// snippets of upstream content; log the raw error and return a
+	// generic message to the client.
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	if err := s.templates.ExecuteTemplate(w, "base", data); err != nil {
-		http.Error(w, "Template error: "+err.Error(), http.StatusInternalServerError)
+		slog.Error("template render failed", "template", "base", "err", err)
+		http.Error(w, "Failed to render page", http.StatusInternalServerError)
 	}
 }
 
diff --git a/internal/air/static/css/preview.css b/internal/air/static/css/preview.css
index 21aec9e..0f22aaf 100644
--- a/internal/air/static/css/preview.css
+++ b/internal/air/static/css/preview.css
@@ -591,6 +591,22 @@
             outline-offset: 1px;
         }
 
+        .calendar-invite-btn:disabled {
+            cursor: not-allowed;
+            opacity: 0.55;
+        }
+
+        /* Pulse the in-flight button so the user sees the click          */
+        /* registered while the RSVP round-trip is pending.               */
+        .calendar-invite-btn.is-loading {
+            animation: calendar-invite-pulse 1.1s ease-in-out infinite;
+        }
+
+        @keyframes calendar-invite-pulse {
+            0%, 100% { opacity: 0.55; }
+            50%      { opacity: 0.85; }
+        }
+
         /* Cancellation banner — shown when METHOD:CANCEL or            */
         /* STATUS:CANCELLED is present. Replaces the RSVP buttons so    */
         /* the user can't RSVP to a dead invitation.                    */
diff --git a/internal/air/static/js/app-core.js b/internal/air/static/js/app-core.js
index 94bc1d7..46440f5 100644
--- a/internal/air/static/js/app-core.js
+++ b/internal/air/static/js/app-core.js
@@ -2,10 +2,22 @@
  * App Core - Toast system, animations, view switching, and modal toggles
  */
         // Toast System with action button support
+        // Cap concurrent toasts so a burst of archive/RSVP/error events
+        // can't stack up, scroll the screen, or pile up Undo timers
+        // pointing at stale closures.
+        const TOAST_MAX_VISIBLE = 4;
+
         function showToast(type, title, message, options = null) {
             const container = document.getElementById('toastContainer');
             if (!container) return;
 
+            // Drop oldest toasts beyond the cap. Children are appended
+            // to the bottom of the container, so the FIRST child is the
+            // oldest — pop it before adding a new one.
+            while (container.children.length >= TOAST_MAX_VISIBLE && container.firstChild) {
+                container.removeChild(container.firstChild);
+            }
+
             const toast = document.createElement('div');
             toast.className = `toast ${type}`;
 
@@ -20,9 +32,14 @@
             messageDiv.className = 'toast-message';
             // Use textContent for XSS prevention - user data may be in title/message
             const strong = document.createElement('strong');
-            strong.textContent = title;
+            // Truncate user-supplied strings so a runaway upstream error
+            // (e.g. a 200kB HTML body parsed as JSON) can't blow up the UI.
+            const TOAST_MAX_TEXT = 200;
+            const safeTitle = String(title == null ? '' : title).slice(0, TOAST_MAX_TEXT);
+            const safeMessage = String(message == null ? '' : message).slice(0, TOAST_MAX_TEXT);
+            strong.textContent = safeTitle;
             messageDiv.appendChild(strong);
-            messageDiv.appendChild(document.createTextNode(' — ' + message));
+            messageDiv.appendChild(document.createTextNode(' — ' + safeMessage));
 
             toast.appendChild(iconSpan);
             toast.appendChild(messageDiv);
diff --git a/internal/air/static/js/bundles.js b/internal/air/static/js/bundles.js
index 1ff6124..fa27637 100644
--- a/internal/air/static/js/bundles.js
+++ b/internal/air/static/js/bundles.js
@@ -2,6 +2,15 @@
  * Email Bundles Module
  * Smart email categorization inspired by Shortwave/Google Inbox
  * Groups emails by type: newsletters, receipts, social, etc.
+ *
+ * STATUS: This module is NOT currently included by base.gohtml — the
+ * backend `/api/bundles*` routes ship and have integration tests, but
+ * the front-end UI is gated on a future sidebar redesign. The defensive
+ * cleanup in this file (fallback bundles when the API 5xx's, localStorage
+ * collapse persistence, no PUT-to-GET-only route) is kept intact so the
+ * module is ready to wire up via a single `<script>` include in
+ * base.gohtml when the redesign lands. Until then, treat changes here
+ * as exercising the defensive paths only — there is no live UX impact.
  */
 
 const Bundles = {
@@ -37,18 +46,68 @@ const Bundles = {
     },
 
     /**
-     * Load bundles from server
+     * Load bundles from server, then layer on per-user collapse state from
+     * localStorage. Collapse is a UI preference that doesn't need a server
+     * round-trip — keeping it client-side avoids the 405s the old code
+     * silently hit when it tried to PUT /api/bundles.
      */
     async loadBundles() {
         try {
             const response = await fetch('/api/bundles');
             if (response.ok) {
                 this.bundles = await response.json();
+            } else {
+                // fetch() does NOT throw on !response.ok (only on network
+                // failure), so a 5xx from /api/bundles previously left
+                // this.bundles as the empty initial value and the user
+                // saw no fallback grouping at all. Surface the defaults
+                // so the inbox is at least usable on partial outage.
+                console.warn('[bundles] /api/bundles returned', response.status, '- using defaults');
+                this.bundles = this.getDefaultBundles();
             }
         } catch (error) {
             console.error('Failed to load bundles:', error);
             this.bundles = this.getDefaultBundles();
         }
+        this.applyStoredCollapseState();
+    },
+
+    /**
+     * applyStoredCollapseState rehydrates bundle.collapsed from
+     * localStorage. Tolerates corrupt JSON (e.g. user editing the value
+     * in devtools) by falling through to the server-provided defaults.
+     */
+    applyStoredCollapseState() {
+        const map = this.readCollapseMap();
+        if (!map) return;
+        this.bundles.forEach((bundle) => {
+            if (Object.prototype.hasOwnProperty.call(map, bundle.id)) {
+                bundle.collapsed = !!map[bundle.id];
+            }
+        });
+    },
+
+    readCollapseMap() {
+        try {
+            const raw = localStorage.getItem('air.bundles.collapsed');
+            if (!raw) return null;
+            const parsed = JSON.parse(raw);
+            return parsed && typeof parsed === 'object' ? parsed : null;
+        } catch (_) {
+            return null;
+        }
+    },
+
+    writeCollapseState(bundleId, collapsed) {
+        const map = this.readCollapseMap() || {};
+        map[bundleId] = !!collapsed;
+        try {
+            localStorage.setItem('air.bundles.collapsed', JSON.stringify(map));
+        } catch (err) {
+            // Quota exceeded / storage disabled — non-fatal; the toggle
+            // still works for the current session.
+            console.warn('[bundles] could not persist collapse state:', err);
+        }
     },
 
     /**
@@ -204,25 +263,19 @@ const Bundles = {
     },
 
     /**
-     * Toggle bundle collapsed state
+     * Toggle bundle collapsed state and persist to localStorage so the
+     * preference survives a reload. The previous implementation tried to
+     * PUT /api/bundles, but that route only handles GET — every toggle
+     * silently produced a 405 (caught by `.catch` but never reported), so
+     * collapse state was effectively per-tab.
      * @param {string} bundleId - Bundle ID
      */
-    async toggleBundle(bundleId) {
+    toggleBundle(bundleId) {
         const bundle = this.bundles.find(b => b.id === bundleId);
         if (!bundle) return;
 
         bundle.collapsed = !bundle.collapsed;
-
-        try {
-            await fetch('/api/bundles', {
-                method: 'PUT',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify(bundle),
-            });
-        } catch (error) {
-            console.error('Failed to update bundle:', error);
-        }
-
+        this.writeCollapseState(bundle.id, bundle.collapsed);
         this.setupUI();
     },
 
diff --git a/internal/air/static/js/calendar-findtime.js b/internal/air/static/js/calendar-findtime.js
index 6832a27..f6a5e22 100644
--- a/internal/air/static/js/calendar-findtime.js
+++ b/internal/air/static/js/calendar-findtime.js
@@ -81,12 +81,25 @@ const FindTimeModal = {
 
         } catch (error) {
             console.error('Find time error:', error);
-            resultsContainer.innerHTML = `
-                <div class="error-state">
-                    <div class="error-icon">❌</div>
-                    <div class="error-message">${error.message || 'Failed to find available times'}</div>
-                </div>
-            `;
+            // Build the error UI with DOM nodes + textContent so an
+            // untrusted error.message (e.g. from a hostile network
+            // response) can never inject markup. Project rule from
+            // CLAUDE.md: prefer textContent over innerHTML for any
+            // non-static value.
+            resultsContainer.replaceChildren();
+            const wrap = document.createElement('div');
+            wrap.className = 'error-state';
+            const icon = document.createElement('div');
+            icon.className = 'error-icon';
+            icon.textContent = '❌';
+            const msg = document.createElement('div');
+            msg.className = 'error-message';
+            msg.textContent = (error && typeof error.message === 'string' && error.message)
+                ? error.message
+                : 'Failed to find available times';
+            wrap.appendChild(icon);
+            wrap.appendChild(msg);
+            resultsContainer.appendChild(wrap);
         } finally {
             if (searchBtn) {
                 searchBtn.disabled = false;
diff --git a/internal/air/static/js/email-actions.js b/internal/air/static/js/email-actions.js
index 7664f53..bc9ae1e 100644
--- a/internal/air/static/js/email-actions.js
+++ b/internal/air/static/js/email-actions.js
@@ -1,8 +1,32 @@
 /* Email Actions - User actions on emails */
 
+// Track archive/delete operations in flight so a rapid double-click
+// doesn't issue two API calls (each one sends a real Nylas request and,
+// for archive, a toast with its own Undo timer pointing at a stale
+// closure). The set is keyed by emailId; entries are removed when the
+// API call resolves.
+const inFlightDestructive = new Set();
+
+// Build an "empty state" panel via DOM construction so we never
+// re-introduce innerHTML to wipe the detail pane. textContent is
+// XSS-safe by construction; the helper keeps archive/delete consistent.
+function buildEmailDetailEmptyState(messageText) {
+    const empty = document.createElement('div');
+    empty.className = 'empty-state';
+    const msg = document.createElement('div');
+    msg.className = 'empty-message';
+    msg.textContent = messageText || 'Select an email to view';
+    empty.appendChild(msg);
+    return empty;
+}
+
 Object.assign(EmailListManager, {
 async optimisticUpdate(emailId, updateFn, apiCall, successMsg, rollbackFn) {
-    const operationId = `${emailId}-${Date.now()}`;
+    // crypto.randomUUID guarantees no collision on rapid double-fire
+    // (Date.now() resolution can repeat within a single millisecond).
+    const operationId = (typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function')
+        ? `${emailId}-${crypto.randomUUID()}`
+        : `${emailId}-${Date.now()}-${Math.random().toString(36).slice(2)}`;
     const email = this.emails.find(e => e.id === emailId);
     if (!email) return;
 
@@ -65,7 +89,7 @@ updateEmailInUI(emailId) {
             const span = document.createElement('span');
             span.className = 'starred';
             span.title = 'Starred';
-            span.innerHTML = '&#9733;';
+            span.textContent = '★'; // ★ — DOM-safe equivalent of &#9733;
             actionsEl.prepend(span);
         }
     } else if (!email.starred && starredEl) {
@@ -125,63 +149,203 @@ async toggleStar(emailId) {
 },
 
 async archiveEmail(emailId) {
+    // Guard against double-click. Each archive sends a real API call AND
+    // a toast with its own Undo timer; without this, a frustrated user
+    // tap-tapping the button would issue redundant requests and stack
+    // multiple Undo toasts whose closures point at stale state.
+    if (inFlightDestructive.has(emailId)) return false;
+
     const email = this.emails.find(e => e.id === emailId);
-    if (!email) return;
+    if (!email) return false;
+
+    // Resolve the archive payload differently per provider:
+    //   - Microsoft / IMAP / EWS: a real Archive folder exists; move there.
+    //   - Gmail: archive == remove the INBOX label, since labels are flat
+    //     and there is no destination folder.
+    // computeArchiveFolders returns null when neither path works (e.g. an
+    // exotic provider where the email isn't in INBOX and we have no
+    // Archive folder), in which case we surface a clear error.
+    const newFolders = this.computeArchiveFolders(email);
+    if (newFolders === null) {
+        if (typeof showToast === 'function') {
+            showToast('error', 'Archive unavailable', 'No archive target found for this account');
+        }
+        return false;
+    }
 
-    // Store original position for undo
+    // Snapshot enough state to roll back the optimistic UI on failure.
+    // Capture the index for splicing back, but rollback re-validates by
+    // emailId since applyFilter may reorder between remove and failure.
     const originalIndex = this.emails.indexOf(email);
     const originalEmail = { ...email };
+    const wasSelected = this.selectedEmailId === emailId;
 
-    // Optimistic removal - instant UI feedback
+    inFlightDestructive.add(emailId);
+
+    // Optimistic removal — instant UI feedback. We restore the email
+    // below if the API call fails, so the UI never lies for long.
     this.emails = this.emails.filter(e => e.id !== emailId);
     this.applyFilter();
     this.renderEmails();
 
-    // Clear detail pane if this was selected
-    if (this.selectedEmailId === emailId) {
+    // Clear detail pane if this was selected. We rebuild the empty
+    // state via DOM construction (textContent) instead of innerHTML so
+    // there's no template-injection surface even though the strings
+    // are currently literals.
+    if (wasSelected) {
         this.selectedEmailId = null;
         const detailPane = document.querySelector('.email-detail');
         if (detailPane) {
-            detailPane.innerHTML = '<div class="empty-state"><div class="empty-message">Select an email to view</div></div>';
+            detailPane.replaceChildren(buildEmailDetailEmptyState());
         }
     }
 
-    // Show toast with undo option
-    if (typeof showToast === 'function') {
-        showToast('success', 'Archived', 'Email moved to archive', {
-            action: 'Undo',
-            onAction: () => {
-                // Restore email
-                this.emails.splice(originalIndex, 0, originalEmail);
-                this.applyFilter();
-                this.renderEmails();
-                showToast('info', 'Restored', 'Email restored');
-            }
-        });
+    // restoreEmail re-inserts originalEmail and replays selection state
+    // so the list and detail pane stay consistent on rollback. Looking
+    // up by ID rather than splicing at the captured index protects
+    // against applyFilter() reordering between optimistic remove and
+    // failure — pin the row by identity, not position.
+    //
+    // Awaits selectEmail when restoring selection so that callers'
+    // promises don't resolve while the detail pane is still showing
+    // the empty state from the optimistic clear. selectEmail fetches
+    // the full body, and "rolled back" should mean "fully visible
+    // again", not "row is back but pane is empty".
+    const restoreEmail = async () => {
+        if (!this.emails.some(e => e.id === emailId)) {
+            const insertAt = Math.min(originalIndex, this.emails.length);
+            this.emails.splice(insertAt, 0, originalEmail);
+        }
+        this.applyFilter();
+        this.renderEmails();
+        if (wasSelected && typeof this.selectEmail === 'function') {
+            await this.selectEmail(emailId);
+        }
+    };
+
+    try {
+        await AirAPI.updateEmail(emailId, { folders: newFolders });
+
+        if (typeof showToast === 'function') {
+            showToast('success', 'Archived', 'Email moved to archive', {
+                action: 'Undo',
+                onAction: async () => {
+                    // Restore must succeed BEFORE we lie to the user that the
+                    // email is back. The previous version spliced + toasted
+                    // "Restored" unconditionally, so a failed restore PUT
+                    // showed a green-path toast while the email stayed
+                    // archived on the server — visible reality drifted from
+                    // server reality on the next refresh.
+                    //
+                    // Refuse to send an empty folders array on Undo: a
+                    // Gmail account that started without INBOX (rare but
+                    // possible — drafts/sent paths) would otherwise land
+                    // unfiled instead of restored. Surface a clear error
+                    // and let the user investigate manually.
+                    const restoreFolders = Array.isArray(originalEmail.folders) ? originalEmail.folders : [];
+                    if (restoreFolders.length === 0) {
+                        showToast('error', 'Restore unavailable', 'Original folder unknown — restore manually from archive');
+                        return;
+                    }
+                    try {
+                        await AirAPI.updateEmail(emailId, { folders: restoreFolders });
+                    } catch (err) {
+                        console.warn('[archive] undo failed for', emailId, err);
+                        showToast('error', 'Restore failed', 'Email is still archived — please try again');
+                        return;
+                    }
+                    await restoreEmail();
+                    showToast('info', 'Restored', 'Email restored');
+                }
+            });
+        }
+        return true;
+    } catch (err) {
+        console.warn('[archive] failed for', emailId, err);
+        // Roll back the optimistic removal — including the selection
+        // state — so list and detail pane stay consistent.
+        await restoreEmail();
+        if (typeof showToast === 'function') {
+            showToast('error', 'Archive failed', 'Could not archive — please try again');
+        }
+        return false;
+    } finally {
+        inFlightDestructive.delete(emailId);
     }
+},
 
-    // Note: Archive API call would go here if available
+// computeArchiveFolders works out the new folders array for an archive
+// action. Returns null when neither strategy applies, in which case the
+// caller surfaces a "no archive target" error to the user.
+computeArchiveFolders(email) {
+    const current = Array.isArray(email.folders) ? email.folders.slice() : [];
+
+    // Strategy 1 — provider exposes a typed Archive folder
+    // (Microsoft/IMAP/EWS). Match by system_folder only, NOT name —
+    // a user-created Gmail label literally named "Archive" must not be
+    // mistaken for the system destination. Gmail accounts surface
+    // "All Mail" as system_folder='all', not 'archive', so this branch
+    // does not fire for Gmail and Strategy 2 still applies.
+    //
+    // Doing this BEFORE the INBOX-removal filter is the fix for an IMAP/
+    // EWS account where folders=['INBOX'] (literal name): the old order
+    // stripped INBOX first and sent folders:[] upstream, moving the
+    // message out of every folder instead of into Archive.
+    const archiveByType = (this.folders || []).find(
+        f => (f.system_folder || '').toLowerCase() === 'archive'
+    );
+    if (archiveByType) {
+        return [archiveByType.id];
+    }
+
+    // Strategy 2 — Gmail: archive means "remove the INBOX label".
+    // Reached only when the account has no typed Archive folder, so
+    // user-created labels remain safe.
+    const filtered = current.filter(f => String(f).toUpperCase() !== 'INBOX');
+    if (filtered.length !== current.length) {
+        return filtered;
+    }
+
+    return null;
+},
+
+// findSystemFolder resolves a folder by its system_folder type. Falls back
+// to a name-based lookup so demo mode (which sometimes ships folders
+// without a populated system_folder) still works.
+findSystemFolder(type) {
+    if (!this.folders || !this.folders.length) return null;
+    const byType = this.folders.find(f => (f.system_folder || '').toLowerCase() === type);
+    if (byType) return byType;
+    return this.folders.find(f => (f.name || '').toLowerCase() === type) || null;
 },
 
 async deleteEmail(emailId) {
+    // Same in-flight guard as archive — each delete sends a real API
+    // call, and the user has no recourse if we fire two by accident.
+    if (inFlightDestructive.has(emailId)) return false;
+
     const email = this.emails.find(e => e.id === emailId);
-    if (!email) return;
+    if (!email) return false;
 
     // Store original for undo
     const originalIndex = this.emails.indexOf(email);
     const originalEmail = { ...email };
 
+    inFlightDestructive.add(emailId);
+
     // Optimistic removal - instant UI feedback
     this.emails = this.emails.filter(e => e.id !== emailId);
     this.applyFilter();
     this.renderEmails();
 
-    // Clear detail pane if this was selected
+    // Clear detail pane if this was selected. Use DOM construction so
+    // archive and delete share the same hardened empty-state path —
+    // bypassing innerHTML even though the message is currently a literal.
     if (this.selectedEmailId === emailId) {
         this.selectedEmailId = null;
         const detailPane = document.querySelector('.email-detail');
         if (detailPane) {
-            detailPane.innerHTML = '<div class="empty-state"><div class="empty-message">Select an email to view</div></div>';
+            detailPane.replaceChildren(buildEmailDetailEmptyState());
         }
     }
 
@@ -197,6 +361,7 @@ async deleteEmail(emailId) {
                 }
             });
         }
+        return true;
     } catch (error) {
         console.error('Failed to delete email:', error);
 
@@ -208,6 +373,9 @@ async deleteEmail(emailId) {
         if (typeof showToast === 'function') {
             showToast('error', 'Error', 'Failed to delete email');
         }
+        return false;
+    } finally {
+        inFlightDestructive.delete(emailId);
     }
 },
 
diff --git a/internal/air/static/js/email-helpers.js b/internal/air/static/js/email-helpers.js
index 4cf643b..e19525f 100644
--- a/internal/air/static/js/email-helpers.js
+++ b/internal/air/static/js/email-helpers.js
@@ -2,7 +2,6 @@
 
 // ====================================
 
-let currentEmailIndex = 0;
 let selectedEmails = new Set();
 
 // Virtual scrolling config
@@ -14,31 +13,49 @@ function getEmailItems() {
     return document.querySelectorAll('.email-item');
 }
 
+// Resolve the current keyboard cursor from the DOM rather than a module
+// global. The global drifted after archive/delete (the list shrinks but
+// the index doesn't), so arrow keys could target a removed element. The
+// keydown handler below already reads from DOM — these wrappers now
+// match its policy so all keyboard nav agrees on a single source of
+// truth.
+function currentEmailItemIndex(items) {
+    const list = items || getEmailItems();
+    for (let i = 0; i < list.length; i++) {
+        if (list[i].classList.contains('selected') || list[i].classList.contains('focused')) {
+            return i;
+        }
+    }
+    return -1;
+}
+
 // Select next email
 function selectNextEmail() {
     const emailItems = getEmailItems();
-    if (currentEmailIndex < emailItems.length - 1) {
-        emailItems[currentEmailIndex]?.classList.remove('selected');
-        currentEmailIndex++;
-        emailItems[currentEmailIndex].classList.add('selected');
-        emailItems[currentEmailIndex].scrollIntoView({ behavior: 'smooth', block: 'nearest' });
-        if (typeof announce === 'function') {
-            announce(`Email ${currentEmailIndex + 1} of ${emailItems.length}`);
-        }
+    if (emailItems.length === 0) return;
+    const current = currentEmailItemIndex(emailItems);
+    const next = current < 0 ? 0 : current + 1;
+    if (next >= emailItems.length) return;
+    if (current >= 0) emailItems[current]?.classList.remove('selected');
+    emailItems[next].classList.add('selected');
+    emailItems[next].scrollIntoView({ behavior: 'smooth', block: 'nearest' });
+    if (typeof announce === 'function') {
+        announce(`Email ${next + 1} of ${emailItems.length}`);
     }
 }
 
 // Select previous email
 function selectPrevEmail() {
     const emailItems = getEmailItems();
-    if (currentEmailIndex > 0) {
-        emailItems[currentEmailIndex]?.classList.remove('selected');
-        currentEmailIndex--;
-        emailItems[currentEmailIndex].classList.add('selected');
-        emailItems[currentEmailIndex].scrollIntoView({ behavior: 'smooth', block: 'nearest' });
-        if (typeof announce === 'function') {
-            announce(`Email ${currentEmailIndex + 1} of ${emailItems.length}`);
-        }
+    if (emailItems.length === 0) return;
+    const current = currentEmailItemIndex(emailItems);
+    const prev = current <= 0 ? -1 : current - 1;
+    if (prev < 0) return;
+    emailItems[current]?.classList.remove('selected');
+    emailItems[prev].classList.add('selected');
+    emailItems[prev].scrollIntoView({ behavior: 'smooth', block: 'nearest' });
+    if (typeof announce === 'function') {
+        announce(`Email ${prev + 1} of ${emailItems.length}`);
     }
 }
 
@@ -74,93 +91,13 @@ function updateBatchActionsUI() {
     }
 }
 
-// Archive selected emails
-function archiveSelected() {
-    if (selectedEmails.size === 0) return;
-    if (typeof showToast === 'function') {
-        showToast('success', 'Archived', `${selectedEmails.size} emails moved to archive`);
-    }
-    clearEmailSelections();
-}
-
-// Delete selected emails
-function deleteSelected() {
-    if (selectedEmails.size === 0) return;
-    if (typeof showToast === 'function') {
-        showToast('warning', 'Deleted', `${selectedEmails.size} emails moved to trash`);
-    }
-    clearEmailSelections();
-}
-
-// Mark selected as read/unread
-function markSelectedAsRead(read = true) {
-    if (selectedEmails.size === 0) return;
-    if (typeof showToast === 'function') {
-        showToast('info', read ? 'Marked Read' : 'Marked Unread', `${selectedEmails.size} emails updated`);
-    }
-    clearEmailSelections();
-}
-
-// Send email (legacy function for compatibility)
-function sendEmail() {
-    if (typeof showSendAnimation === 'function') {
-        showSendAnimation();
-    }
-    setTimeout(() => {
-        if (typeof showToast === 'function') {
-            showToast('success', 'Email Sent', 'Your message has been delivered');
-        }
-        if (typeof toggleCompose === 'function') {
-            toggleCompose();
-        }
-    }, 1000);
-}
-
-// Generate AI Summary (button-triggered)
-function generateAISummary() {
-    const btn = document.getElementById('aiSummaryBtn');
-    const summaryDiv = document.getElementById('aiSummary');
-    const summaryText = document.getElementById('aiSummaryText');
-
-    if (!btn || !summaryDiv || !summaryText) return;
-
-    // Show loading state
-    btn.classList.add('loading');
-    btn.innerHTML = '<span class="ai-icon">⏳</span><span>Generating summary...</span>';
-
-    // Simulate AI processing
-    setTimeout(() => {
-        const summaries = [
-            "This email discusses the Q4 product roadmap. Key points: 3 new features planned, design mockups attached, stakeholder meeting scheduled for next Tuesday.",
-            "Sarah is requesting approval for the marketing budget. The proposal includes increased social media spend and a new influencer campaign targeting Gen Z.",
-            "Technical review notes: Performance improvements show 40% faster load times. Minor bugs identified in mobile view need addressing before launch.",
-            "Team sync summary: Sprint progress on track, two blockers identified for the auth module, new hire starting Monday needs onboarding setup."
-        ];
-
-        const randomSummary = summaries[Math.floor(Math.random() * summaries.length)];
-
-        // Reset button
-        btn.classList.remove('loading');
-        btn.innerHTML = '<span class="ai-icon">✨</span><span>Summarize with AI</span>';
-
-        // Show summary with typing effect
-        summaryDiv.classList.remove('hidden');
-        if (typeof showAITyping === 'function') {
-            showAITyping(summaryText, randomSummary);
-        } else {
-            summaryText.textContent = randomSummary;
-        }
-
-    }, 1500 + Math.random() * 1000);
-}
-
-// Hide AI Summary
-function hideAISummary() {
-    const summaryDiv = document.getElementById('aiSummary');
-    if (summaryDiv) {
-        summaryDiv.classList.add('hidden');
-    }
-}
+// Note: previous versions of this file shipped five "fake action" helpers
+// (archiveSelected, deleteSelected, markSelectedAsRead, sendEmail,
+// generateAISummary) that showed success toasts without making any API
+// calls. None of them were referenced from templates or other modules —
+// they were dead code that misled audits — so they have been removed.
+// The real implementations live in email-actions.js (CRUD + read/star)
+// and email-ai.js (summarize) and run through AirAPI / fetch.
 
 // Initialize email keyboard navigation
 function initEmailKeyboard() {
@@ -178,7 +115,7 @@ function initEmailKeyboard() {
         item.setAttribute('aria-selected', item.classList.contains('selected') ? 'true' : 'false');
     });
 
-    emailList.addEventListener('keydown', function(e) {
+    emailList.addEventListener('keydown', async function(e) {
         const items = emailList.querySelectorAll('.email-item');
         const currentIndex = Array.from(items).findIndex(item =>
             item.classList.contains('focused') || item.classList.contains('selected')
@@ -218,11 +155,28 @@ function initEmailKeyboard() {
             case 'Delete':
             case 'Backspace':
                 e.preventDefault();
-                if (typeof announce === 'function') {
-                    announce('Email deleted');
-                }
-                if (typeof showToast === 'function') {
-                    showToast('warning', 'Deleted', 'Email moved to trash');
+                // Route through EmailListManager so the keystroke
+                // matches the click-Delete behaviour: optimistic
+                // removal, real fetch, server-side persistence.
+                //
+                // Await the deletion before announcing — the previous
+                // version fired the screen-reader announcement
+                // synchronously, so users heard "Email deleted" even
+                // when the underlying fetch failed and the email was
+                // rolled back into the list. deleteEmail returns true
+                // on a successful round-trip, false on rollback.
+                {
+                    const focused = items[currentIndex];
+                    const id = focused && focused.dataset && focused.dataset.emailId;
+                    if (id && typeof EmailListManager !== 'undefined' &&
+                        typeof EmailListManager.deleteEmail === 'function') {
+                        const ok = await EmailListManager.deleteEmail(id);
+                        if (ok && typeof announce === 'function') {
+                            announce('Email deleted');
+                        } else if (!ok && typeof announce === 'function') {
+                            announce('Delete failed');
+                        }
+                    }
                 }
                 break;
             case 'x':
diff --git a/internal/air/static/js/email-messages.js b/internal/air/static/js/email-messages.js
index db51002..ae6d14e 100644
--- a/internal/air/static/js/email-messages.js
+++ b/internal/air/static/js/email-messages.js
@@ -1,7 +1,35 @@
 /* Email Messages - Loading and pagination */
+
+// debug() gates the noisy lifecycle traces that were left behind during
+// the loadEmails refactor. Set window.AIR_DEBUG=true in devtools to
+// re-enable them; production output stays quiet so the dev console isn't
+// drowning every keystroke.
+function debug(...args) {
+    if (typeof window !== 'undefined' && window.AIR_DEBUG) {
+        console.debug(...args);
+    }
+}
+
 Object.assign(EmailListManager, {
+// loadEmails returns one of three string outcomes:
+//   - 'loaded'      → fetch succeeded and the list re-rendered
+//   - 'in-progress' → another loadEmails was already running; the caller
+//                     should treat this as a benign no-op, NOT a failure
+//   - 'failed'      → fetch raised; an error toast was shown internally
+//
+// Returning a string outcome — rather than rethrowing — keeps long-standing
+// callers (compose.js, app-init.js, settings.js) working unchanged. The
+// boolean predecessor conflated "skipped because already loading" with
+// "fetch failed", so the mobile pull-to-refresh handler showed
+// "Refresh failed" when the user pulled twice in quick succession even
+// though no fetch had failed.
+//
+// For backwards compatibility callers can still treat the return value
+// as truthy/falsy: 'loaded' and 'in-progress' are truthy, 'failed' is a
+// non-empty string but distinguishable; new callers should compare
+// explicitly via `result === 'loaded'`.
 async loadEmails(folderOrOptions = null) {
-    if (this.isLoading) return;
+    if (this.isLoading) return 'in-progress';
     this.isLoading = true;
 
     // Support both string (folder) and object (options) parameter
@@ -16,8 +44,9 @@ async loadEmails(folderOrOptions = null) {
         from = folderOrOptions.from || null;
     }
 
-    console.log('[loadEmails] Starting...', { folder, search, from, limit: 50 });
+    debug('[loadEmails] Starting...', { folder, search, from, limit: 50 });
 
+    let outcome = 'failed';
     try {
         const options = { limit: 50 }; // Increased from 10 to 50 to fill viewport
         if (folder) {
@@ -33,7 +62,7 @@ async loadEmails(folderOrOptions = null) {
         }
 
         const data = await AirAPI.getEmails(options);
-        console.log('[loadEmails] API response:', {
+        debug('[loadEmails] API response:', {
             emailCount: data.emails?.length || 0,
             hasMore: data.has_more,
             nextCursor: data.next_cursor
@@ -46,6 +75,7 @@ async loadEmails(folderOrOptions = null) {
         // Apply current filter
         this.applyFilter();
         this.renderEmails();
+        outcome = 'loaded';
     } catch (error) {
         console.error('[loadEmails] Failed to load emails:', error);
         if (typeof showToast === 'function') {
@@ -53,11 +83,12 @@ async loadEmails(folderOrOptions = null) {
         }
     } finally {
         this.isLoading = false;
-        console.log('[loadEmails] Complete. Triggering ensureScrollable...');
+        debug('[loadEmails] Complete. Triggering ensureScrollable...');
         // Auto-load more AFTER isLoading is set to false
         // Use setTimeout to ensure DOM has updated
         setTimeout(() => this.ensureScrollable(), 100);
     }
+    return outcome;
 },
 
 async loadMore() {
@@ -92,7 +123,7 @@ async loadMore() {
 ensureScrollable() {
     const emailList = document.querySelector('.email-list');
 
-    console.log('[ensureScrollable] Starting check...', {
+    debug('[ensureScrollable] Starting check...', {
         hasEmailList: !!emailList,
         hasMore: this.hasMore,
         isLoading: this.isLoading,
@@ -106,12 +137,12 @@ ensureScrollable() {
     }
 
     if (!this.hasMore) {
-        console.log('[ensureScrollable] No more emails to load (hasMore=false)');
+        debug('[ensureScrollable] No more emails to load (hasMore=false)');
         return;
     }
 
     if (this.isLoading) {
-        console.log('[ensureScrollable] Already loading, skipping');
+        debug('[ensureScrollable] Already loading, skipping');
         return;
     }
 
@@ -120,7 +151,7 @@ ensureScrollable() {
     const clientHeight = emailList.clientHeight;
     const needsMore = scrollHeight <= clientHeight;
 
-    console.log('[ensureScrollable] Viewport check:', {
+    debug('[ensureScrollable] Viewport check:', {
         scrollHeight,
         clientHeight,
         needsMore,
@@ -128,10 +159,10 @@ ensureScrollable() {
     });
 
     if (needsMore) {
-        console.log('[ensureScrollable] Loading more emails to fill viewport...');
+        debug('[ensureScrollable] Loading more emails to fill viewport...');
         setTimeout(() => this.loadMore(), 100);
     } else {
-        console.log('[ensureScrollable] Viewport is full, stopping auto-load');
+        debug('[ensureScrollable] Viewport is full, stopping auto-load');
     }
 },
 
@@ -142,7 +173,7 @@ renderEmails(append = false) {
     // Use filtered emails for display
     const displayEmails = this.getDisplayEmails();
 
-    console.log('[renderEmails]', {
+    debug('[renderEmails]', {
         totalEmails: this.emails.length,
         filteredEmails: this.filteredEmails.length,
         currentFilter: this.currentFilter,
@@ -152,9 +183,6 @@ renderEmails(append = false) {
     });
 
     if (displayEmails.length === 0 && !append) {
-        // Clear spacers for empty state
-        emailList.innerHTML = '';
-
         const isInbox = this.currentFolder === this.inboxFolderId ||
                        this.currentFolder === 'INBOX' ||
                        this.currentFolder === 'inbox';
@@ -166,14 +194,37 @@ renderEmails(append = false) {
                 : { icon: '📭', title: 'No emails', message: 'This folder is empty' }
         };
         const msg = emptyMessages[this.currentFilter] || emptyMessages.all;
-        emailList.innerHTML = `
-            <div class="empty-state inbox-zero${msg.celebrate ? ' celebration' : ''}">
-                <div class="empty-icon">${msg.icon}</div>
-                <div class="empty-title">${msg.title}</div>
-                <div class="empty-message">${msg.message}</div>
-                ${msg.celebrate ? '<div class="inbox-zero-subtitle">✨ Enjoy the moment</div>' : ''}
-            </div>
-        `;
+
+        // DOM-construct the empty state so future copy changes can't
+        // accidentally introduce HTML interpolation. icon/title/message
+        // are static today but the dictionary is a tempting place to
+        // start mixing in a folder name later.
+        const empty = document.createElement('div');
+        empty.className = 'empty-state inbox-zero' + (msg.celebrate ? ' celebration' : '');
+
+        const iconEl = document.createElement('div');
+        iconEl.className = 'empty-icon';
+        iconEl.textContent = msg.icon;
+        empty.appendChild(iconEl);
+
+        const titleEl = document.createElement('div');
+        titleEl.className = 'empty-title';
+        titleEl.textContent = msg.title;
+        empty.appendChild(titleEl);
+
+        const messageEl = document.createElement('div');
+        messageEl.className = 'empty-message';
+        messageEl.textContent = msg.message;
+        empty.appendChild(messageEl);
+
+        if (msg.celebrate) {
+            const sub = document.createElement('div');
+            sub.className = 'inbox-zero-subtitle';
+            sub.textContent = '✨ Enjoy the moment';
+            empty.appendChild(sub);
+        }
+
+        emailList.replaceChildren(empty);
 
         // Trigger celebration confetti for Inbox Zero
         if (msg.celebrate && typeof window.celebrateInboxZero === 'function') {
diff --git a/internal/air/static/js/email-selection.js b/internal/air/static/js/email-selection.js
index 6463a86..93bfb09 100644
--- a/internal/air/static/js/email-selection.js
+++ b/internal/air/static/js/email-selection.js
@@ -48,98 +48,240 @@ async selectEmail(emailId) {
     }
 },
 
+// renderEmailDetail builds the right-pane email view. We use DOM
+// construction (createElement + textContent + setAttribute) instead of a
+// single innerHTML template so:
+//   1. There is no template-literal interpolation of user data, so a
+//      future change can't accidentally introduce an XSS vector by
+//      forgetting to escape one field.
+//   2. IDs derived from email.id round-trip cleanly between write
+//      (setAttribute stores the raw string) and lookup (getElementById
+//      reads the raw string) — no HTML-encoding dance required.
+//   3. Static SVG markup is the only innerHTML use, kept inline because
+//      DOM-constructing each path tag would dwarf the actual logic.
 renderEmailDetail(email) {
     const detailPane = document.querySelector('.email-detail');
     if (!detailPane) return;
 
     const sender = EmailRenderer.getSenderInfo(email.from);
     const time = new Date(email.date * 1000).toLocaleString();
+    const toList = (email.to || []).map(p => p.name || p.email).join(', ');
 
-    const toList = (email.to || [])
-        .map(p => p.name || p.email)
-        .join(', ');
-
-    detailPane.innerHTML = `
-        <div class="email-detail-header">
-            <div class="email-detail-subject">${EmailRenderer.escapeHtml(email.subject || '(No Subject)')}</div>
-            <div class="email-detail-meta">
-                <div class="email-detail-avatar" style="background: var(--gradient-1)">${sender.initials}</div>
-                <div class="email-detail-info">
-                    <div class="email-detail-from">${EmailRenderer.escapeHtml(sender.name)} <span class="email-detail-email">&lt;${EmailRenderer.escapeHtml(sender.email)}&gt;</span></div>
-                    <div class="email-detail-to">To: ${EmailRenderer.escapeHtml(toList || 'me')}</div>
-                </div>
-                <div class="email-detail-time">${time}</div>
-            </div>
-        </div>
-        <div class="email-detail-actions">
-            <button class="action-btn" data-action="reply-email" data-email-id="${escapeHtml(email.id)}" title="Reply">
-                <svg width="16" height="16" fill="none" stroke="currentColor" stroke-width="2" viewBox="0 0 24 24">
-                    <path d="M9 17H4a2 2 0 01-2-2V5a2 2 0 012-2h16a2 2 0 012 2v10a2 2 0 01-2 2h-5l-5 5v-5z"/>
-                </svg>
-                Reply
-            </button>
-            <button class="action-btn" data-action="toggle-star" data-email-id="${escapeHtml(email.id)}" title="Star">
-                <svg width="16" height="16" fill="${email.starred ? 'currentColor' : 'none'}" stroke="currentColor" stroke-width="2" viewBox="0 0 24 24">
-                    <polygon points="12 2 15.09 8.26 22 9.27 17 14.14 18.18 21.02 12 17.77 5.82 21.02 7 14.14 2 9.27 8.91 8.26 12 2"/>
-                </svg>
-                ${email.starred ? 'Starred' : 'Star'}
-            </button>
-            <button class="action-btn" data-action="archive-email" data-email-id="${escapeHtml(email.id)}" title="Archive">
-                <svg width="16" height="16" fill="none" stroke="currentColor" stroke-width="2" viewBox="0 0 24 24">
-                    <rect x="2" y="4" width="20" height="5" rx="1"/>
-                    <path d="M4 9v9a2 2 0 002 2h12a2 2 0 002-2V9M10 13h4"/>
-                </svg>
-                Archive
-            </button>
-            <button class="action-btn" data-action="delete-email" data-email-id="${escapeHtml(email.id)}" title="Delete">
-                <svg width="16" height="16" fill="none" stroke="currentColor" stroke-width="2" viewBox="0 0 24 24">
-                    <path d="M3 6h18M19 6v14a2 2 0 01-2 2H7a2 2 0 01-2-2V6m3 0V4a2 2 0 012-2h4a2 2 0 012 2v2"/>
-                </svg>
-                Delete
-            </button>
-            <button class="action-btn ai-btn" id="summarizeBtn-${escapeHtml(email.id)}" data-action="summarize-email" data-email-id="${escapeHtml(email.id)}" title="Summarize with AI">
-                <svg class="ai-icon" width="16" height="16" fill="none" stroke="currentColor" stroke-width="2" viewBox="0 0 24 24">
-                    <path d="M12 2a10 10 0 100 20 10 10 0 000-20z"/>
-                    <path d="M12 6v6l4 2"/>
-                </svg>
-                <svg class="ai-spinner" width="16" height="16" viewBox="0 0 24 24" style="display:none">
-                    <circle cx="12" cy="12" r="10" stroke="currentColor" stroke-width="2" fill="none" stroke-dasharray="31.4" stroke-dashoffset="10">
-                        <animateTransform attributeName="transform" type="rotate" from="0 12 12" to="360 12 12" dur="1s" repeatCount="indefinite"/>
-                    </circle>
-                </svg>
-                <span class="ai-btn-text">✨ Summarize</span>
-            </button>
-        </div>
-        <div class="smart-replies-container" id="smartReplies-${escapeHtml(email.id)}">
-            <button class="smart-replies-trigger" data-action="load-smart-replies" data-email-id="${escapeHtml(email.id)}">
-                <span class="smart-replies-icon">💬</span>
-                <span>Get smart reply suggestions</span>
-            </button>
-        </div>
-        <div class="calendar-invite-card-slot" id="inviteSlot-${escapeHtml(email.id)}" hidden></div>
-        ${email.attachments && email.attachments.length > 0 ? `
-            <div class="email-detail-attachments">
-                <div class="attachments-header">Attachments (${email.attachments.length})</div>
-                <div class="attachments-list">
-                    ${email.attachments.map(a => `
-                        <div class="attachment-item">
-                            <span class="attachment-icon">&#128206;</span>
-                            <span class="attachment-name">${EmailRenderer.escapeHtml(a.filename)}</span>
-                            <span class="attachment-size">${this.formatSize(a.size)}</span>
-                        </div>
-                    `).join('')}
-                </div>
-            </div>
-        ` : ''}
-        <div class="email-detail-body">
-            <div class="email-iframe-container" id="emailBodyContainer-${email.id}">
-                <div class="email-loading-state">
-                    <div class="email-loading-spinner"></div>
-                    <span>Loading email...</span>
-                </div>
-            </div>
-        </div>
-    `;
+    detailPane.replaceChildren(
+        this.buildDetailHeader(email, sender, toList, time),
+        this.buildDetailActions(email),
+        this.buildSmartRepliesSlot(email.id),
+        this.buildInviteSlot(email.id),
+    );
+
+    if (email.attachments && email.attachments.length > 0) {
+        detailPane.appendChild(this.buildAttachmentsSection(email.attachments));
+    }
+
+    detailPane.appendChild(this.buildBodyContainer(email.id));
+
+    // Move keyboard focus to the subject heading so screen-reader and
+    // keyboard users land on the new email instead of staying on the
+    // previous list-item context. tabindex=-1 makes the heading
+    // programmatically focusable without entering the tab order.
+    const subjectEl = detailPane.querySelector('.email-detail-subject');
+    if (subjectEl) {
+        subjectEl.setAttribute('tabindex', '-1');
+        try { subjectEl.focus({ preventScroll: true }); } catch (_) { /* older browsers */ }
+    }
+},
+
+// buildDetailHeader renders the subject + sender + recipient + timestamp
+// block. All text uses textContent so subject/from/to interpolation is
+// safe by construction.
+buildDetailHeader(email, sender, toList, time) {
+    const header = document.createElement('div');
+    header.className = 'email-detail-header';
+
+    const subjectEl = document.createElement('div');
+    subjectEl.className = 'email-detail-subject';
+    subjectEl.textContent = email.subject || '(No Subject)';
+    header.appendChild(subjectEl);
+
+    const meta = document.createElement('div');
+    meta.className = 'email-detail-meta';
+
+    const avatar = document.createElement('div');
+    avatar.className = 'email-detail-avatar';
+    avatar.style.background = 'var(--gradient-1)';
+    avatar.textContent = sender.initials || '';
+    meta.appendChild(avatar);
+
+    const info = document.createElement('div');
+    info.className = 'email-detail-info';
+
+    const fromEl = document.createElement('div');
+    fromEl.className = 'email-detail-from';
+    fromEl.appendChild(document.createTextNode((sender.name || '') + ' '));
+    const fromAddr = document.createElement('span');
+    fromAddr.className = 'email-detail-email';
+    fromAddr.textContent = '<' + (sender.email || '') + '>';
+    fromEl.appendChild(fromAddr);
+    info.appendChild(fromEl);
+
+    const toEl = document.createElement('div');
+    toEl.className = 'email-detail-to';
+    toEl.textContent = 'To: ' + (toList || 'me');
+    info.appendChild(toEl);
+
+    meta.appendChild(info);
+
+    const timeEl = document.createElement('div');
+    timeEl.className = 'email-detail-time';
+    timeEl.textContent = time;
+    meta.appendChild(timeEl);
+
+    header.appendChild(meta);
+    return header;
+},
+
+// buildDetailActions returns the button row (reply/star/archive/delete +
+// summarize). The SVG icon strings are static literals from this file,
+// so insertAdjacentHTML is safe; everything else uses setAttribute /
+// textContent so email.id round-trips without HTML encoding tricks.
+buildDetailActions(email) {
+    const actions = document.createElement('div');
+    actions.className = 'email-detail-actions';
+
+    // Decorative SVG icons — labelled by the trailing text node, so
+    // aria-hidden keeps screen readers from announcing the path data
+    // alongside the button text. STAR_FILL is interpolated; the rest
+    // of the SVG bodies are static literals owned by this file.
+    const REPLY_SVG = '<svg aria-hidden="true" width="16" height="16" fill="none" stroke="currentColor" stroke-width="2" viewBox="0 0 24 24"><path d="M9 17H4a2 2 0 01-2-2V5a2 2 0 012-2h16a2 2 0 012 2v10a2 2 0 01-2 2h-5l-5 5v-5z"/></svg>';
+    const ARCHIVE_SVG = '<svg aria-hidden="true" width="16" height="16" fill="none" stroke="currentColor" stroke-width="2" viewBox="0 0 24 24"><rect x="2" y="4" width="20" height="5" rx="1"/><path d="M4 9v9a2 2 0 002 2h12a2 2 0 002-2V9M10 13h4"/></svg>';
+    const DELETE_SVG = '<svg aria-hidden="true" width="16" height="16" fill="none" stroke="currentColor" stroke-width="2" viewBox="0 0 24 24"><path d="M3 6h18M19 6v14a2 2 0 01-2 2H7a2 2 0 01-2-2V6m3 0V4a2 2 0 012-2h4a2 2 0 012 2v2"/></svg>';
+    const STAR_FILL = email.starred ? 'currentColor' : 'none';
+    const STAR_SVG = `<svg aria-hidden="true" width="16" height="16" fill="${STAR_FILL}" stroke="currentColor" stroke-width="2" viewBox="0 0 24 24"><polygon points="12 2 15.09 8.26 22 9.27 17 14.14 18.18 21.02 12 17.77 5.82 21.02 7 14.14 2 9.27 8.91 8.26 12 2"/></svg>`;
+
+    actions.appendChild(this.buildActionButton(email.id, 'reply-email', 'Reply', REPLY_SVG));
+    actions.appendChild(this.buildActionButton(email.id, 'toggle-star', email.starred ? 'Starred' : 'Star', STAR_SVG));
+    actions.appendChild(this.buildActionButton(email.id, 'archive-email', 'Archive', ARCHIVE_SVG));
+    actions.appendChild(this.buildActionButton(email.id, 'delete-email', 'Delete', DELETE_SVG));
+    actions.appendChild(this.buildSummarizeButton(email.id));
+
+    return actions;
+},
+
+buildActionButton(emailId, action, label, iconHTML) {
+    const btn = document.createElement('button');
+    btn.className = 'action-btn';
+    btn.setAttribute('data-action', action);
+    btn.setAttribute('data-email-id', emailId);
+    btn.title = label;
+    // iconHTML is a static SVG literal owned by this file — never
+    // touched by user input. Trailing label uses textContent.
+    btn.insertAdjacentHTML('beforeend', iconHTML);
+    btn.appendChild(document.createTextNode(' ' + label));
+    return btn;
+},
+
+buildSummarizeButton(emailId) {
+    const SUMMARIZE_ICON = '<svg aria-hidden="true" class="ai-icon" width="16" height="16" fill="none" stroke="currentColor" stroke-width="2" viewBox="0 0 24 24"><path d="M12 2a10 10 0 100 20 10 10 0 000-20z"/><path d="M12 6v6l4 2"/></svg>';
+    const SPINNER_ICON = '<svg aria-hidden="true" class="ai-spinner" width="16" height="16" viewBox="0 0 24 24" style="display:none"><circle cx="12" cy="12" r="10" stroke="currentColor" stroke-width="2" fill="none" stroke-dasharray="31.4" stroke-dashoffset="10"><animateTransform attributeName="transform" type="rotate" from="0 12 12" to="360 12 12" dur="1s" repeatCount="indefinite"/></circle></svg>';
+
+    const btn = document.createElement('button');
+    btn.className = 'action-btn ai-btn';
+    btn.setAttribute('id', 'summarizeBtn-' + emailId);
+    btn.setAttribute('data-action', 'summarize-email');
+    btn.setAttribute('data-email-id', emailId);
+    btn.title = 'Summarize with AI';
+    btn.insertAdjacentHTML('beforeend', SUMMARIZE_ICON + SPINNER_ICON);
+    const text = document.createElement('span');
+    text.className = 'ai-btn-text';
+    text.textContent = '✨ Summarize';
+    btn.appendChild(text);
+    return btn;
+},
+
+buildSmartRepliesSlot(emailId) {
+    const wrap = document.createElement('div');
+    wrap.className = 'smart-replies-container';
+    wrap.setAttribute('id', 'smartReplies-' + emailId);
+
+    const trigger = document.createElement('button');
+    trigger.className = 'smart-replies-trigger';
+    trigger.setAttribute('data-action', 'load-smart-replies');
+    trigger.setAttribute('data-email-id', emailId);
+    const icon = document.createElement('span');
+    icon.className = 'smart-replies-icon';
+    icon.textContent = '💬'; // 💬
+    trigger.appendChild(icon);
+    const label = document.createElement('span');
+    label.textContent = 'Get smart reply suggestions';
+    trigger.appendChild(label);
+    wrap.appendChild(trigger);
+    return wrap;
+},
+
+buildInviteSlot(emailId) {
+    const slot = document.createElement('div');
+    slot.className = 'calendar-invite-card-slot';
+    slot.setAttribute('id', 'inviteSlot-' + emailId);
+    slot.hidden = true;
+    return slot;
+},
+
+buildAttachmentsSection(attachments) {
+    const wrap = document.createElement('div');
+    wrap.className = 'email-detail-attachments';
+
+    const header = document.createElement('div');
+    header.className = 'attachments-header';
+    header.textContent = 'Attachments (' + attachments.length + ')';
+    wrap.appendChild(header);
+
+    const list = document.createElement('div');
+    list.className = 'attachments-list';
+    attachments.forEach((a) => {
+        const item = document.createElement('div');
+        item.className = 'attachment-item';
+
+        const icon = document.createElement('span');
+        icon.className = 'attachment-icon';
+        icon.textContent = '📎'; // 📎
+        item.appendChild(icon);
+
+        const name = document.createElement('span');
+        name.className = 'attachment-name';
+        name.textContent = a.filename || '';
+        item.appendChild(name);
+
+        const size = document.createElement('span');
+        size.className = 'attachment-size';
+        size.textContent = this.formatSize(a.size);
+        item.appendChild(size);
+
+        list.appendChild(item);
+    });
+    wrap.appendChild(list);
+    return wrap;
+},
+
+buildBodyContainer(emailId) {
+    const wrap = document.createElement('div');
+    wrap.className = 'email-detail-body';
+
+    const container = document.createElement('div');
+    container.className = 'email-iframe-container';
+    container.setAttribute('id', 'emailBodyContainer-' + emailId);
+
+    const loading = document.createElement('div');
+    loading.className = 'email-loading-state';
+    const spinner = document.createElement('div');
+    spinner.className = 'email-loading-spinner';
+    loading.appendChild(spinner);
+    const loadingText = document.createElement('span');
+    loadingText.textContent = 'Loading email...';
+    loading.appendChild(loadingText);
+    container.appendChild(loading);
+
+    wrap.appendChild(container);
+    return wrap;
 },
 
 // Render email body into a sandboxed iframe for security and proper HTML rendering
@@ -173,17 +315,25 @@ renderEmailBodyIframe(emailId, bodyHtml) {
     };
 
     iframe.onerror = () => {
-        container.innerHTML = `
-            <div class="email-error-state">
-                <span class="error-icon">⚠️</span>
-                <span>Failed to load email content</span>
-            </div>
-        `;
+        // DOM-construct the error state for consistency with the rest
+        // of the file. Strings are static literals, but using
+        // replaceChildren keeps every container mutation in this file
+        // free of innerHTML so no future contributor lands user data
+        // through a "just like this one" copy.
+        const errState = document.createElement('div');
+        errState.className = 'email-error-state';
+        const icon = document.createElement('span');
+        icon.className = 'error-icon';
+        icon.textContent = '⚠️';
+        const label = document.createElement('span');
+        label.textContent = 'Failed to load email content';
+        errState.appendChild(icon);
+        errState.appendChild(label);
+        container.replaceChildren(errState);
     };
 
     // Clear loading state and add iframe
-    container.innerHTML = '';
-    container.appendChild(iframe);
+    container.replaceChildren(iframe);
 },
 
 // Build the HTML content for the email iframe with embedded styles
@@ -509,12 +659,13 @@ async loadAndRenderInvite(emailId) {
     // was kicked off.
     if (this.selectedEmailId !== emailId) return;
 
-    // Replace existing children safely, then insert sanitised markup.
-    // All interpolated strings pass through EmailRenderer.escapeHtml; URL
-    // is screened by isSafeUrl. We use insertAdjacentHTML rather than
-    // direct DOM construction to keep the markup colocated and readable.
-    slot.replaceChildren();
-    slot.insertAdjacentHTML('beforeend', this.renderCalendarInviteCard(invite, emailId));
+    // Construct the card via DOM nodes (createElement + textContent +
+    // setAttribute) so every interpolation of upstream-provided strings
+    // (title, organizer name/email, attendees, location) is safe by
+    // construction. Mirrors the renderEmailDetail rewrite — keeping
+    // both blocks consistent prevents an "escapeHtml drift" where a
+    // future template-literal contributor forgets to escape one field.
+    slot.replaceChildren(this.buildCalendarInviteCard(invite, emailId));
     slot.removeAttribute('hidden');
 
     // Mirror Gmail's behaviour by surfacing the ICS as a regular
@@ -526,7 +677,9 @@ async loadAndRenderInvite(emailId) {
 
 // ensureInviteAttachmentRow appends a calendar-attachment row to the
 // email detail view when one isn't already rendered. Used for inline
-// calendar parts that Nylas does not surface in attachments[].
+// calendar parts that Nylas does not surface in attachments[]. All
+// nodes are constructed via createElement+textContent so an attacker-
+// controlled invite.filename can never inject markup.
 ensureInviteAttachmentRow(emailId, invite) {
     if (!invite || !invite.filename) return;
     if (this.selectedEmailId !== emailId) return;
@@ -544,18 +697,9 @@ ensureInviteAttachmentRow(emailId, invite) {
         }
     }
 
-    const esc = EmailRenderer.escapeHtml;
-    const rowHTML = `
-        <div class="attachment-item" data-inline-calendar="true">
-            <span class="attachment-icon">&#128206;</span>
-            <span class="attachment-name">${esc(invite.filename)}</span>
-            <span class="attachment-size">Calendar invitation</span>
-        </div>
-    `;
-
     const list = detail.querySelector('.email-detail-attachments .attachments-list');
     if (list) {
-        list.insertAdjacentHTML('beforeend', rowHTML);
+        list.appendChild(this.buildInviteAttachmentRow(invite));
         const header = detail.querySelector('.email-detail-attachments .attachments-header');
         if (header) {
             const count = list.querySelectorAll('.attachment-item').length;
@@ -568,74 +712,171 @@ ensureInviteAttachmentRow(emailId, invite) {
     // directly after the invite card so it sits where the user expects.
     const slot = document.getElementById(`inviteSlot-${emailId}`);
     if (!slot) return;
-    const sectionHTML = `
-        <div class="email-detail-attachments">
-            <div class="attachments-header">Attachments (1)</div>
-            <div class="attachments-list">${rowHTML}</div>
-        </div>
-    `;
-    slot.insertAdjacentHTML('afterend', sectionHTML);
+    slot.after(this.buildInviteAttachmentSection(invite));
+},
+
+// buildInviteAttachmentRow constructs a single .attachment-item row for
+// an inline calendar part. The filename is set via textContent, so any
+// shape of invite.filename is safe.
+buildInviteAttachmentRow(invite) {
+    const item = document.createElement('div');
+    item.className = 'attachment-item';
+    item.setAttribute('data-inline-calendar', 'true');
+
+    const icon = document.createElement('span');
+    icon.className = 'attachment-icon';
+    icon.textContent = '📎';
+    item.appendChild(icon);
+
+    const name = document.createElement('span');
+    name.className = 'attachment-name';
+    name.textContent = invite.filename || '';
+    item.appendChild(name);
+
+    const size = document.createElement('span');
+    size.className = 'attachment-size';
+    size.textContent = 'Calendar invitation';
+    item.appendChild(size);
+
+    return item;
+},
+
+// buildInviteAttachmentSection builds a fresh
+// .email-detail-attachments section containing exactly the inline-
+// calendar row. Used when no attachments section exists yet.
+buildInviteAttachmentSection(invite) {
+    const wrap = document.createElement('div');
+    wrap.className = 'email-detail-attachments';
+
+    const header = document.createElement('div');
+    header.className = 'attachments-header';
+    header.textContent = 'Attachments (1)';
+    wrap.appendChild(header);
+
+    const list = document.createElement('div');
+    list.className = 'attachments-list';
+    list.appendChild(this.buildInviteAttachmentRow(invite));
+    wrap.appendChild(list);
+
+    return wrap;
 },
 
-// renderCalendarInviteCard returns the HTML for a Gmail-style invite
-// card. All untrusted strings are escaped; the URL is also screened by
-// isSafeUrl before being placed in href.
-renderCalendarInviteCard(invite, emailId) {
-    const esc = EmailRenderer.escapeHtml;
+// buildCalendarInviteCard returns the DOM node for a Gmail-style invite
+// card. Builds the entire tree with createElement + textContent +
+// setAttribute so untrusted invite fields (title, location, organizer,
+// attendees) can never inject markup — there is no template-literal
+// interpolation to forget to escape. Conferencing URL is screened via
+// isSafeUrl before being assigned to <a>.href.
+buildCalendarInviteCard(invite, emailId) {
     const fmtRange = this.formatInviteRange(invite);
     const safeURL = (typeof isSafeUrl === 'function' && invite.conferencing_url &&
         isSafeUrl(invite.conferencing_url)) ? invite.conferencing_url : '';
-
-    const orgLine = invite.organizer_email
-        ? `${esc(invite.organizer_name || invite.organizer_email)} · Organizer`
-        : '';
-
     const isCancelled = String(invite.method || '').toUpperCase() === 'CANCEL' ||
         String(invite.status || '').toUpperCase() === 'CANCELLED';
-    const banner = isCancelled
-        ? `<div class="calendar-invite-banner calendar-invite-banner-cancel" role="alert">This event was cancelled</div>`
-        : '';
-
-    const attendeesBlock = this.renderInviteAttendees(invite.attendees);
-    const actions = isCancelled
-        ? ''
-        : `<div class="calendar-invite-actions">
-                <button type="button" class="calendar-invite-btn primary"
-                        data-action="invite-rsvp" data-email-id="${esc(emailId)}" data-rsvp="yes">Yes</button>
-                <button type="button" class="calendar-invite-btn"
-                        data-action="invite-rsvp" data-email-id="${esc(emailId)}" data-rsvp="maybe">Maybe</button>
-                <button type="button" class="calendar-invite-btn"
-                        data-action="invite-rsvp" data-email-id="${esc(emailId)}" data-rsvp="no">No</button>
-            </div>`;
-
-    return `
-        <section class="calendar-invite-card${isCancelled ? ' is-cancelled' : ''}" role="region" aria-label="Calendar invitation">
-            ${banner}
-            <header class="calendar-invite-header">
-                <div class="calendar-invite-icon" aria-hidden="true">📅</div>
-                <div class="calendar-invite-when">
-                    <div class="calendar-invite-time">${esc(fmtRange)}</div>
-                    <div class="calendar-invite-title">${esc(invite.title || 'Untitled event')}</div>
-                </div>
-            </header>
-            ${invite.location ? `<div class="calendar-invite-location">📍 ${esc(invite.location)}</div>` : ''}
-            ${orgLine ? `<div class="calendar-invite-org">${orgLine}</div>` : ''}
-            ${safeURL ? `<a class="calendar-invite-link" href="${esc(safeURL)}" target="_blank" rel="noopener noreferrer">Join with conferencing</a>` : ''}
-            ${attendeesBlock}
-            ${actions}
-        </section>
-    `;
+
+    const card = document.createElement('section');
+    card.className = 'calendar-invite-card' + (isCancelled ? ' is-cancelled' : '');
+    card.setAttribute('role', 'region');
+    card.setAttribute('aria-label', 'Calendar invitation');
+
+    if (isCancelled) {
+        const banner = document.createElement('div');
+        banner.className = 'calendar-invite-banner calendar-invite-banner-cancel';
+        banner.setAttribute('role', 'alert');
+        banner.textContent = 'This event was cancelled';
+        card.appendChild(banner);
+    }
+
+    const header = document.createElement('header');
+    header.className = 'calendar-invite-header';
+    const iconEl = document.createElement('div');
+    iconEl.className = 'calendar-invite-icon';
+    iconEl.setAttribute('aria-hidden', 'true');
+    iconEl.textContent = '📅';
+    header.appendChild(iconEl);
+
+    const when = document.createElement('div');
+    when.className = 'calendar-invite-when';
+    const timeEl = document.createElement('div');
+    timeEl.className = 'calendar-invite-time';
+    timeEl.textContent = fmtRange;
+    when.appendChild(timeEl);
+    const titleEl = document.createElement('div');
+    titleEl.className = 'calendar-invite-title';
+    titleEl.textContent = invite.title || 'Untitled event';
+    when.appendChild(titleEl);
+    header.appendChild(when);
+    card.appendChild(header);
+
+    if (invite.location) {
+        const loc = document.createElement('div');
+        loc.className = 'calendar-invite-location';
+        // 📍 is a static literal owned by this file — keep as a separate
+        // text node so the user-supplied location text uses textContent.
+        loc.appendChild(document.createTextNode('📍 '));
+        loc.appendChild(document.createTextNode(invite.location));
+        card.appendChild(loc);
+    }
+
+    if (invite.organizer_email) {
+        const org = document.createElement('div');
+        org.className = 'calendar-invite-org';
+        org.textContent = (invite.organizer_name || invite.organizer_email) + ' · Organizer';
+        card.appendChild(org);
+    }
+
+    if (safeURL) {
+        const link = document.createElement('a');
+        link.className = 'calendar-invite-link';
+        // Assigning to .href via property does NOT HTML-escape the URL,
+        // but isSafeUrl already screened the scheme/host above.
+        link.href = safeURL;
+        link.target = '_blank';
+        link.rel = 'noopener noreferrer';
+        link.textContent = 'Join with conferencing';
+        card.appendChild(link);
+    }
+
+    const attendees = this.buildInviteAttendees(invite.attendees);
+    if (attendees) card.appendChild(attendees);
+
+    if (!isCancelled) {
+        card.appendChild(this.buildInviteActions(emailId));
+    }
+    return card;
+},
+
+// buildInviteActions constructs the Yes/Maybe/No RSVP button row.
+buildInviteActions(emailId) {
+    const wrap = document.createElement('div');
+    wrap.className = 'calendar-invite-actions';
+    [
+        { rsvp: 'yes',   label: 'Yes',   primary: true },
+        { rsvp: 'maybe', label: 'Maybe', primary: false },
+        { rsvp: 'no',    label: 'No',    primary: false },
+    ].forEach(({ rsvp, label, primary }) => {
+        const btn = document.createElement('button');
+        btn.type = 'button';
+        btn.className = primary ? 'calendar-invite-btn primary' : 'calendar-invite-btn';
+        btn.setAttribute('data-action', 'invite-rsvp');
+        btn.setAttribute('data-email-id', emailId);
+        btn.setAttribute('data-rsvp', rsvp);
+        btn.textContent = label;
+        wrap.appendChild(btn);
+    });
+    return wrap;
 },
 
-// renderInviteAttendees produces the attendee summary that mirrors
+// buildInviteAttendees produces the attendee summary that mirrors
 // Gmail's "3 going, 1 declined" line and the per-attendee chip list.
-// Returns an empty string when no attendees are present so the card
-// stays compact for invitations without an explicit attendee list
-// (Outlook sometimes omits ATTENDEE on REQUEST).
-renderInviteAttendees(attendees) {
-    if (!Array.isArray(attendees) || attendees.length === 0) return '';
+// Returns null when no attendees are present so the card stays compact
+// for invitations without an explicit attendee list (Outlook sometimes
+// omits ATTENDEE on REQUEST). Every interpolation of attendee data
+// (name, email, role) goes through textContent / setAttribute, never
+// HTML-string concatenation.
+buildInviteAttendees(attendees) {
+    if (!Array.isArray(attendees) || attendees.length === 0) return null;
 
-    const esc = EmailRenderer.escapeHtml;
     const counts = { ACCEPTED: 0, DECLINED: 0, TENTATIVE: 0, OTHER: 0 };
     attendees.forEach((a) => {
         const status = String(a.status || '').toUpperCase();
@@ -643,38 +884,49 @@ renderInviteAttendees(attendees) {
         else counts.OTHER++;
     });
 
+    const wrap = document.createElement('div');
+    wrap.className = 'calendar-invite-attendees';
+
     const parts = [];
     if (counts.ACCEPTED > 0) parts.push(`${counts.ACCEPTED} going`);
     if (counts.DECLINED > 0) parts.push(`${counts.DECLINED} declined`);
     if (counts.TENTATIVE > 0) parts.push(`${counts.TENTATIVE} maybe`);
     if (counts.OTHER > 0) parts.push(`${counts.OTHER} no response`);
+    if (parts.length > 0) {
+        const summary = document.createElement('div');
+        summary.className = 'calendar-invite-summary';
+        summary.textContent = parts.join(' · ');
+        wrap.appendChild(summary);
+    }
 
-    const summary = parts.length > 0
-        ? `<div class="calendar-invite-summary">${esc(parts.join(' · '))}</div>`
-        : '';
-
-    const chips = attendees.slice(0, 8).map((a) => {
+    const list = document.createElement('div');
+    list.className = 'calendar-invite-attendee-list';
+    attendees.slice(0, 8).forEach((a) => {
         const label = a.name || a.email || '';
-        if (!label) return '';
+        if (!label) return;
         const status = String(a.status || '').toUpperCase();
         const cls = status === 'ACCEPTED' ? 'is-accepted'
             : status === 'DECLINED' ? 'is-declined'
             : status === 'TENTATIVE' ? 'is-tentative'
             : 'is-pending';
+        const chip = document.createElement('span');
+        chip.className = 'calendar-invite-attendee ' + cls;
+        // setAttribute does not HTML-encode; the title is read by
+        // browsers as a plain string. Concatenation of the email and
+        // role is safe because both are textual values, never HTML.
         const role = a.is_organizer ? ' · Organizer' : '';
-        return `<span class="calendar-invite-attendee ${cls}" title="${esc(a.email || '')}${esc(role)}">${esc(label)}</span>`;
-    }).filter(Boolean).join('');
-
-    const overflow = attendees.length > 8
-        ? `<span class="calendar-invite-attendee is-overflow">+${attendees.length - 8} more</span>`
-        : '';
-
-    return `
-        <div class="calendar-invite-attendees">
-            ${summary}
-            <div class="calendar-invite-attendee-list">${chips}${overflow}</div>
-        </div>
-    `;
+        chip.setAttribute('title', (a.email || '') + role);
+        chip.textContent = label;
+        list.appendChild(chip);
+    });
+    if (attendees.length > 8) {
+        const overflow = document.createElement('span');
+        overflow.className = 'calendar-invite-attendee is-overflow';
+        overflow.textContent = `+${attendees.length - 8} more`;
+        list.appendChild(overflow);
+    }
+    wrap.appendChild(list);
+    return wrap;
 },
 
 // formatInviteRange turns Unix-second start/end into a human string.
@@ -699,25 +951,102 @@ formatInviteRange(invite) {
     return 'Time not specified';
 },
 
-// rsvpToInvite handles a Yes/No/Maybe click. Currently a stub — shows a
-// toast confirming the choice and updates button state. Backend wiring
-// will plug into PUT /api/events/{id}/rsvp once the embedded event ID is
-// surfaced from the parser.
-rsvpToInvite(emailId, response) {
+// rsvpToInvite forwards the user's choice to POST /api/emails/{id}/rsvp
+// which resolves the invite to a Nylas event and calls send-rsvp.
+//
+// Buttons are disabled for the duration of the request so a frustrated
+// user doesn't double-fire (each call sends a real email to the
+// organiser). The active state is only applied after the server confirms
+// — a click that fails leaves the previous selection alone.
+async rsvpToInvite(emailId, response) {
     const valid = new Set(['yes', 'no', 'maybe']);
     const choice = String(response || '').toLowerCase();
     if (!valid.has(choice)) return;
 
-    if (typeof showToast === 'function') {
-        const labels = { yes: 'Accepted', no: 'Declined', maybe: 'Tentative' };
-        showToast('success', labels[choice], `Invite ${labels[choice].toLowerCase()}`);
-    }
-
-    // Visual feedback — mark the chosen button as active.
     const slot = document.getElementById(`inviteSlot-${emailId}`);
-    if (slot) {
-        slot.querySelectorAll('.calendar-invite-btn').forEach((btn) => {
-            btn.classList.toggle('active', btn.dataset.rsvp === choice);
+    const buttons = slot ? Array.from(slot.querySelectorAll('.calendar-invite-btn')) : [];
+    const previouslyActive = buttons.find((btn) => btn.classList.contains('active')) || null;
+
+    // Disable all RSVP buttons and mark the clicked one as in-flight so
+    // the user gets immediate visual feedback while we wait on Nylas.
+    buttons.forEach((btn) => {
+        btn.disabled = true;
+        btn.classList.toggle('is-loading', btn.dataset.rsvp === choice);
+    });
+
+    try {
+        // No CSRF token: Air binds the listener to localhost via the
+        // shared internal/webguard package, and cross-origin requests
+        // to localhost are blocked by the browser's PNA / origin
+        // checks. If Air is ever ported to a hosted URL, this fetch
+        // (and the matching /rsvp handler) MUST gain a CSRF token.
+        const resp = await fetch(`/api/emails/${encodeURIComponent(emailId)}/rsvp`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ status: choice }),
+        });
+
+        if (!resp.ok) {
+            let message = 'Failed to send RSVP';
+            try {
+                const errBody = await resp.json();
+                if (errBody && typeof errBody.error === 'string' && errBody.error) {
+                    // Cap the upstream message so a 200 KB HTML body
+                    // parsed as JSON, or a maliciously long Nylas error,
+                    // can't blow up the toast layout. showToast also
+                    // truncates defensively, but we narrow at the source.
+                    message = errBody.error.slice(0, 200);
+                }
+            } catch (e) {
+                // Body wasn't JSON — fall back to the generic message.
+                // Log the parse failure so degraded errors (server
+                // returned HTML, body too large, etc.) are debuggable.
+                console.warn('[invite] RSVP error body parse failed:', e);
+            }
+            if (typeof showToast === 'function') {
+                showToast('error', 'RSVP failed', message);
+            }
+            return;
+        }
+
+        if (typeof showToast === 'function') {
+            const labels = { yes: 'Accepted', no: 'Declined', maybe: 'Tentative' };
+            showToast('success', labels[choice], `Invite ${labels[choice].toLowerCase()}`);
+        }
+
+        // Apply the new active state only if the user is STILL on this
+        // email AND the slot still exists. Without these guards, a user
+        // who clicks RSVP, navigates away mid-flight, then returns,
+        // would see success applied to a card that's now showing a
+        // different invite — a confusing reality drift.
+        if (this.selectedEmailId === emailId) {
+            const liveSlot = document.getElementById(`inviteSlot-${emailId}`);
+            if (liveSlot) {
+                liveSlot.querySelectorAll('.calendar-invite-btn').forEach((btn) => {
+                    btn.classList.toggle('active', btn.dataset.rsvp === choice);
+                });
+            }
+        }
+    } catch (err) {
+        console.warn('[invite] RSVP failed:', err);
+        if (typeof showToast === 'function') {
+            showToast('error', 'RSVP failed', 'Could not reach the server. Check your connection.');
+        }
+        // Restore prior selection so the UI doesn't lie about state.
+        // Skip the restore if the user has already navigated away (the
+        // node is no longer connected to the document) — touching a
+        // detached element is harmless but pollutes the heap.
+        if (previouslyActive && previouslyActive.isConnected) {
+            previouslyActive.classList.add('active');
+        }
+    } finally {
+        // Only re-enable the buttons that are still live — captured
+        // references can be detached if the user navigated away, in
+        // which case the toggles are no-ops on a stale reference.
+        buttons.forEach((btn) => {
+            if (!btn.isConnected) return;
+            btn.disabled = false;
+            btn.classList.remove('is-loading');
         });
     }
 },
diff --git a/internal/air/static/js/mobile.js b/internal/air/static/js/mobile.js
index 9484b5f..e5f1151 100644
--- a/internal/air/static/js/mobile.js
+++ b/internal/air/static/js/mobile.js
@@ -124,34 +124,52 @@ function handleTouchMove(e) {
     }
 }
 
-function handleTouchEnd(e) {
+async function handleTouchEnd(e) {
     if (!currentSwipeItem) return;
 
     const transform = currentSwipeItem.style.transform;
     const match = transform.match(/translateX\((-?\d+)px\)/);
     const swipeDistance = match ? parseInt(match[1]) : 0;
+    const emailId = currentSwipeItem.dataset.emailId;
+    const swipedItem = currentSwipeItem;
+
+    // Reset transient state up-front so the EmailListManager can
+    // re-render without our half-finished gesture sticking around.
+    swipedItem.classList.remove('swipe-archive', 'swipe-delete');
+    currentSwipeItem = null;
 
     if (swipeDistance > 80) {
-        // Archive
-        currentSwipeItem.style.transform = 'translateX(100%)';
-        currentSwipeItem.style.opacity = '0';
-        setTimeout(() => {
-            showToast('success', 'Archived', 'Email moved to archive');
-        }, 200);
+        // Archive — animate, then dispatch the same handler the desktop
+        // archive button uses so the swipe actually moves the email.
+        swipedItem.style.transform = 'translateX(100%)';
+        swipedItem.style.opacity = '0';
+        let archived = false;
+        if (emailId && typeof EmailListManager !== 'undefined' &&
+            typeof EmailListManager.archiveEmail === 'function') {
+            archived = await EmailListManager.archiveEmail(emailId);
+        }
+        if (!archived && swipedItem.isConnected) {
+            swipedItem.style.transform = '';
+            swipedItem.style.opacity = '';
+        }
     } else if (swipeDistance < -80) {
-        // Delete
-        currentSwipeItem.style.transform = 'translateX(-100%)';
-        currentSwipeItem.style.opacity = '0';
-        setTimeout(() => {
-            showToast('warning', 'Deleted', 'Email moved to trash');
-        }, 200);
+        // Delete — same routing as archive, but to the delete handler.
+        swipedItem.style.transform = 'translateX(-100%)';
+        swipedItem.style.opacity = '0';
+        let deleted = false;
+        if (emailId && typeof EmailListManager !== 'undefined' &&
+            typeof EmailListManager.deleteEmail === 'function') {
+            deleted = await EmailListManager.deleteEmail(emailId);
+        }
+        if (!deleted && swipedItem.isConnected) {
+            swipedItem.style.transform = '';
+            swipedItem.style.opacity = '';
+        }
     } else {
-        // Reset
-        currentSwipeItem.style.transform = '';
+        // Insufficient distance — snap back.
+        swipedItem.style.transform = '';
+        swipedItem.style.opacity = '';
     }
-
-    currentSwipeItem.classList.remove('swipe-archive', 'swipe-delete');
-    currentSwipeItem = null;
 }
 
 // Initialize pull to refresh
@@ -163,12 +181,25 @@ function initPullToRefresh() {
     if (!pullIndicator) {
         pullIndicator = document.createElement('div');
         pullIndicator.className = 'pull-to-refresh';
-        pullIndicator.innerHTML = `
-            <svg width="24" height="24" fill="none" stroke="currentColor" stroke-width="2" viewBox="0 0 24 24">
-                <path d="M23 4v6h-6M1 20v-6h6"/>
-                <path d="M3.51 9a9 9 0 0114.85-3.36L23 10M1 14l4.64 4.36A9 9 0 0020.49 15"/>
-            </svg>
-        `;
+        // Decorative refresh icon — built via createElementNS so we
+        // don't need innerHTML for a static SVG. aria-hidden because
+        // the indicator is visual feedback, not a labelled control.
+        const svgNS = 'http://www.w3.org/2000/svg';
+        const svg = document.createElementNS(svgNS, 'svg');
+        svg.setAttribute('aria-hidden', 'true');
+        svg.setAttribute('width', '24');
+        svg.setAttribute('height', '24');
+        svg.setAttribute('fill', 'none');
+        svg.setAttribute('stroke', 'currentColor');
+        svg.setAttribute('stroke-width', '2');
+        svg.setAttribute('viewBox', '0 0 24 24');
+        const p1 = document.createElementNS(svgNS, 'path');
+        p1.setAttribute('d', 'M23 4v6h-6M1 20v-6h6');
+        const p2 = document.createElementNS(svgNS, 'path');
+        p2.setAttribute('d', 'M3.51 9a9 9 0 0114.85-3.36L23 10M1 14l4.64 4.36A9 9 0 0020.49 15');
+        svg.appendChild(p1);
+        svg.appendChild(p2);
+        pullIndicator.appendChild(svg);
         emailList.style.position = 'relative';
         emailList.insertBefore(pullIndicator, emailList.firstChild);
     }
@@ -196,13 +227,51 @@ function initPullToRefresh() {
         }
     }, { passive: true });
 
-    emailList.addEventListener('touchend', () => {
+    emailList.addEventListener('touchend', async () => {
         if (pullIndicator.classList.contains('active')) {
-            // Trigger refresh
-            showToast('info', 'Refreshing', 'Checking for new emails...');
-            setTimeout(() => {
+            // Trigger a real refresh — the previous version showed a
+            // canned "Updated" toast on a 1.5s timer without ever
+            // re-fetching, so the inbox could be stale by minutes.
+            showToast('info', 'Refreshing', 'Checking for new emails…');
+            // Re-load WITH the user's current view restored. Calling
+            // loadEmails() with no args used to drop the active folder
+            // filter (Sent / Archive / search results would silently swap
+            // to an unfiltered list while the sidebar still highlighted
+            // the wrong folder). Pass the cached selection through.
+            const opts = {};
+            if (typeof EmailListManager !== 'undefined') {
+                if (EmailListManager.currentFolder) opts.folder = EmailListManager.currentFolder;
+                if (EmailListManager.currentSearch) opts.search = EmailListManager.currentSearch;
+            }
+            // loadEmails returns one of:
+            //   'loaded'      → fetch succeeded
+            //   'in-progress' → another load was already running; treat
+            //                   as a benign no-op, NOT a failure
+            //   'failed'      → fetch raised; an error toast was already
+            //                   shown internally
+            // Older bundles may still return a boolean — coerce so the
+            // contract stays backwards-compatible during rollout.
+            let outcome = 'failed';
+            if (typeof EmailListManager !== 'undefined' &&
+                typeof EmailListManager.loadEmails === 'function') {
+                const result = await EmailListManager.loadEmails(opts);
+                if (typeof result === 'string') {
+                    outcome = result;
+                } else if (result === true) {
+                    outcome = 'loaded';
+                } else if (result === false) {
+                    outcome = 'failed';
+                }
+            }
+            if (outcome === 'loaded') {
                 showToast('success', 'Updated', 'Inbox is up to date');
-            }, 1500);
+            } else if (outcome === 'in-progress') {
+                // Another load is in flight — keep the existing pull
+                // indicator UX silent so users don't see a confusing
+                // toast just because they pulled twice quickly.
+            } else {
+                showToast('error', 'Refresh failed', 'Could not load new emails');
+            }
         }
 
         pullIndicator.style.top = '-50px';
diff --git a/internal/air/static/js/notetaker-helpers.js b/internal/air/static/js/notetaker-helpers.js
index 0712778..a112162 100644
--- a/internal/air/static/js/notetaker-helpers.js
+++ b/internal/air/static/js/notetaker-helpers.js
@@ -103,21 +103,40 @@ buildNotetakerItem(nt) {
     titleRow.appendChild(badge);
     body.appendChild(titleRow);
 
-    // Meta info (date/time)
+    // Meta info (date/time). DOM-construct so localized date/time
+    // strings can never inject markup (toLocaleDateString output is
+    // formally locale-controlled and could in theory contain user-
+    // configured separators).
     const meta = this.createElement('div', 'nt-card-meta');
     if (nt.createdAt) {
         const d = new Date(nt.createdAt);
-        meta.innerHTML = `<span>📅 ${d.toLocaleDateString()}</span><span>🕐 ${d.toLocaleTimeString([], {hour:'2-digit',minute:'2-digit'})}</span>`;
+        const dateSpan = document.createElement('span');
+        dateSpan.textContent = '📅 ' + d.toLocaleDateString();
+        meta.appendChild(dateSpan);
+        const timeSpan = document.createElement('span');
+        timeSpan.textContent = '🕐 ' + d.toLocaleTimeString([], { hour: '2-digit', minute: '2-digit' });
+        meta.appendChild(timeSpan);
     }
     body.appendChild(meta);
 
-    // Details section (collapsed by default)
+    // Details section (collapsed by default). Build with DOM nodes +
+    // textContent so the provider value (which falls through to
+    // `nt.provider` for unknown enums) can never inject markup.
     const details = this.createElement('div', 'nt-card-details');
     details.style.display = 'none';
-    const detailsLink = nt.meetingLink && isSafeUrl(nt.meetingLink)
-        ? `<p><a href="${escapeHtml(nt.meetingLink)}" target="_blank" rel="noopener noreferrer">🔗 Meeting Link</a></p>`
-        : '';
-    details.innerHTML = `<p>${this.getProviderName(nt.provider)}</p>${detailsLink}`;
+    const providerEl = document.createElement('p');
+    providerEl.textContent = this.getProviderName(nt.provider);
+    details.appendChild(providerEl);
+    if (nt.meetingLink && isSafeUrl(nt.meetingLink)) {
+        const linkWrap = document.createElement('p');
+        const linkEl = document.createElement('a');
+        linkEl.href = nt.meetingLink;
+        linkEl.target = '_blank';
+        linkEl.rel = 'noopener noreferrer';
+        linkEl.textContent = '🔗 Meeting Link';
+        linkWrap.appendChild(linkEl);
+        details.appendChild(linkWrap);
+    }
     body.appendChild(details);
 
     // Toggle details button
diff --git a/internal/air/templates/base.gohtml b/internal/air/templates/base.gohtml
index 8485ad6..4d12e77 100644
--- a/internal/air/templates/base.gohtml
+++ b/internal/air/templates/base.gohtml
@@ -67,7 +67,7 @@
     {{template "modals" .}}
 
     <!-- Screen Reader Live Region for Announcements -->
-    <div class="live-region" role="status" aria-live="polite" aria-atomic="true" id="announcer"></div>
+    <div class="live-region" role="status" aria-live="polite" aria-atomic="true" id="announcer" data-testid="announcer"></div>
 
     <!-- JavaScript (load order matters) -->
     <!-- 1. Utilities and helpers -->
diff --git a/internal/air/templates/partials/modals_navigation.gohtml b/internal/air/templates/partials/modals_navigation.gohtml
index 4fa48e2..76a7760 100644
--- a/internal/air/templates/partials/modals_navigation.gohtml
+++ b/internal/air/templates/partials/modals_navigation.gohtml
@@ -164,7 +164,11 @@
 <!-- toggleCcBcc() is now in /js/modals-navigation.js -->
 
 <!-- Toast Container -->
-<div class="toast-container" id="toastContainer" data-testid="toast-container"></div>
+<!-- aria-live=polite + role=status: archive/RSVP outcomes are announced
+     to screen readers without interrupting reading. Toast text is built
+     via textContent in app-core.js so it is safe to read aloud. -->
+<div class="toast-container" id="toastContainer" data-testid="toast-container"
+     role="status" aria-live="polite" aria-atomic="false"></div>
 
 <!-- Send Animation -->
 <div class="send-animation" id="sendAnimation">
diff --git a/internal/cli/common/format.go b/internal/cli/common/format.go
index 019802d..53344d6 100644
--- a/internal/cli/common/format.go
+++ b/internal/cli/common/format.go
@@ -95,7 +95,7 @@ func (f *Formatter) formatCSV(data any) error {
 
 	// Handle slice of structs
 	v := reflect.ValueOf(data)
-	if v.Kind() == reflect.Ptr {
+	if v.Kind() == reflect.Pointer {
 		v = v.Elem()
 	}
 
@@ -110,7 +110,7 @@ func (f *Formatter) formatCSV(data any) error {
 
 	// Get headers from first element
 	first := v.Index(0)
-	if first.Kind() == reflect.Ptr {
+	if first.Kind() == reflect.Pointer {
 		first = first.Elem()
 	}
 
@@ -130,7 +130,7 @@ func (f *Formatter) formatCSV(data any) error {
 	// Write rows using cached field info
 	for i := 0; i < v.Len(); i++ {
 		elem := v.Index(i)
-		if elem.Kind() == reflect.Ptr {
+		if elem.Kind() == reflect.Pointer {
 			elem = elem.Elem()
 		}
 		getCSVRowInto(elem, fields, row)
@@ -145,7 +145,7 @@ func (f *Formatter) formatCSV(data any) error {
 // formatCSVSingle formats a single item as CSV.
 func (f *Formatter) formatCSVSingle(writer *csv.Writer, data any) error {
 	v := reflect.ValueOf(data)
-	if v.Kind() == reflect.Ptr {
+	if v.Kind() == reflect.Pointer {
 		v = v.Elem()
 	}
 
@@ -239,7 +239,7 @@ func formatValue(v reflect.Value) string {
 	}
 
 	switch v.Kind() {
-	case reflect.Ptr, reflect.Interface:
+	case reflect.Pointer, reflect.Interface:
 		if v.IsNil() {
 			return ""
 		}
diff --git a/internal/cli/config/get.go b/internal/cli/config/get.go
index 732b48b..132b325 100644
--- a/internal/cli/config/get.go
+++ b/internal/cli/config/get.go
@@ -61,7 +61,7 @@ func getConfigValue(cfg any, key string) (string, error) {
 	parts := strings.Split(key, ".")
 
 	v := reflect.ValueOf(cfg)
-	if v.Kind() == reflect.Ptr {
+	if v.Kind() == reflect.Pointer {
 		v = v.Elem()
 	}
 
@@ -79,7 +79,7 @@ func getConfigValue(cfg any, key string) (string, error) {
 		}
 
 		// If field is a pointer, dereference it
-		if field.Kind() == reflect.Ptr {
+		if field.Kind() == reflect.Pointer {
 			if field.IsNil() {
 				return "", nil
 			}
diff --git a/internal/cli/config/set.go b/internal/cli/config/set.go
index 050a3b7..6d57d7f 100644
--- a/internal/cli/config/set.go
+++ b/internal/cli/config/set.go
@@ -77,7 +77,7 @@ func setConfigValue(cfg any, key, value string) error {
 	parts := strings.Split(key, ".")
 
 	v := reflect.ValueOf(cfg)
-	if v.Kind() == reflect.Ptr {
+	if v.Kind() == reflect.Pointer {
 		v = v.Elem()
 	}
 
@@ -99,7 +99,7 @@ func setConfigValue(cfg any, key, value string) error {
 		}
 
 		// If field is a pointer, dereference or initialize
-		if field.Kind() == reflect.Ptr {
+		if field.Kind() == reflect.Pointer {
 			if field.IsNil() {
 				// Initialize the struct
 				field.Set(reflect.New(field.Type().Elem()))
diff --git a/internal/domain/basic_test.go b/internal/domain/basic_test.go
index 21c2ff6..5dc490e 100644
--- a/internal/domain/basic_test.go
+++ b/internal/domain/basic_test.go
@@ -1,6 +1,8 @@
 package domain
 
 import (
+	"encoding/json"
+	"strings"
 	"testing"
 )
 
@@ -134,6 +136,40 @@ func TestGrant(t *testing.T) {
 			t.Error("Grant with 'error' status should not be valid")
 		}
 	})
+
+	// Locks the invariant that AccessToken and RefreshToken NEVER appear
+	// in JSON output. `nylas admin grants list --format json` and similar
+	// commands serialise Grant directly to stdout — leaking OAuth tokens
+	// would expose them to shell history, CI logs, and any process able
+	// to read fd 1. The struct fields stay populated programmatically
+	// (ExchangeCode still uses them), but the json:"-" tag must hold.
+	t.Run("tokens_never_serialised_to_json", func(t *testing.T) {
+		grant := Grant{
+			ID:           "grant-id",
+			Email:        "user@example.com",
+			Provider:     ProviderGoogle,
+			GrantStatus:  "valid",
+			AccessToken:  "should-not-leak-access-token",
+			RefreshToken: "should-not-leak-refresh-token",
+		}
+
+		out, err := json.Marshal(grant)
+		if err != nil {
+			t.Fatalf("json.Marshal: %v", err)
+		}
+
+		got := string(out)
+		for _, forbidden := range []string{
+			"access_token",
+			"refresh_token",
+			"should-not-leak-access-token",
+			"should-not-leak-refresh-token",
+		} {
+			if strings.Contains(got, forbidden) {
+				t.Errorf("Grant JSON must not contain %q; got %s", forbidden, got)
+			}
+		}
+	})
 }
 
 // TestGrantStatus tests the GrantStatus struct.
diff --git a/internal/domain/calendar.go b/internal/domain/calendar.go
index dba0b1a..4aedcd5 100644
--- a/internal/domain/calendar.go
+++ b/internal/domain/calendar.go
@@ -221,6 +221,7 @@ type EventQueryParams struct {
 	Busy            *bool  `json:"busy,omitempty"`
 	OrderBy         string `json:"order_by,omitempty"` // start, end
 	ExpandRecurring bool   `json:"expand_recurring,omitempty"`
+	ICalUID         string `json:"ical_uid,omitempty"` // resolves an emailed invite (VEVENT UID) to a Nylas event ID
 }
 
 // CreateEventRequest for creating a new event.
diff --git a/internal/domain/email.go b/internal/domain/email.go
index f219a4b..b544733 100644
--- a/internal/domain/email.go
+++ b/internal/domain/email.go
@@ -174,11 +174,19 @@ type ThreadQueryParams struct {
 	SearchQuery     string   `json:"q,omitempty"`
 }
 
-// UpdateMessageRequest for updating message properties.
+// UpdateMessageRequest for updating message properties. Folders uses
+// Go's nil-vs-empty distinction:
+//
+//	nil              → leave folders alone
+//	[]string{}       → set to empty (Gmail archive — drops INBOX label)
+//	[]string{"x"...} → set to this list
+//
+// The JSON tag omits `omitempty` so Marshal preserves nil → null and
+// []string{} → []; Nylas treats null and absent equivalently.
 type UpdateMessageRequest struct {
 	Unread  *bool    `json:"unread,omitempty"`
 	Starred *bool    `json:"starred,omitempty"`
-	Folders []string `json:"folders,omitempty"`
+	Folders []string `json:"folders"`
 }
 
 // CreateDraftRequest for creating a new draft.
diff --git a/internal/domain/email_request_test.go b/internal/domain/email_request_test.go
index 1f1f823..8678dc1 100644
--- a/internal/domain/email_request_test.go
+++ b/internal/domain/email_request_test.go
@@ -1,6 +1,7 @@
 package domain
 
 import (
+	"encoding/json"
 	"testing"
 	"time"
 )
@@ -184,11 +185,12 @@ func TestThreadQueryParams_Creation(t *testing.T) {
 func TestUpdateMessageRequest_Creation(t *testing.T) {
 	unread := false
 	starred := true
+	folders := []string{"archive", "important"}
 
 	req := UpdateMessageRequest{
 		Unread:  &unread,
 		Starred: &starred,
-		Folders: []string{"archive", "important"},
+		Folders: folders,
 	}
 
 	if req.Unread == nil || *req.Unread {
@@ -202,6 +204,68 @@ func TestUpdateMessageRequest_Creation(t *testing.T) {
 	}
 }
 
+// TestUpdateMessageRequest_FoldersWireFormat pins the three documented
+// caller intents that the plain []string type carries:
+//
+//	nil               → "leave folders alone" (encodes as "folders":null,
+//	                    which Nylas treats equivalently to absent)
+//	[]string{}        → "set folders to empty" (Gmail archive)
+//	[]string{"x",...} → "set folders to this list"
+//
+// The JSON tag intentionally omits `omitempty` because Go's omitempty
+// would elide both nil and empty slices, collapsing the archive intent
+// into the leave-alone intent. The adapter cherry-picks via `!= nil` so
+// only nil-vs-empty matters at the API boundary; this test pins the
+// struct's own marshal shape so a future refactor that adds back
+// `omitempty` (or replaces []string with a different type) trips here
+// rather than reintroducing the silent no-op.
+func TestUpdateMessageRequest_FoldersWireFormat(t *testing.T) {
+	cases := []struct {
+		name             string
+		req              UpdateMessageRequest
+		wantFoldersValue string
+	}{
+		{
+			name:             "nil slice → null",
+			req:              UpdateMessageRequest{Folders: nil},
+			wantFoldersValue: "null",
+		},
+		{
+			name:             "empty slice → []",
+			req:              UpdateMessageRequest{Folders: []string{}},
+			wantFoldersValue: "[]",
+		},
+		{
+			name:             `one-element slice → ["archive"]`,
+			req:              UpdateMessageRequest{Folders: []string{"archive"}},
+			wantFoldersValue: `["archive"]`,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			data, err := json.Marshal(tc.req)
+			if err != nil {
+				t.Fatalf("json.Marshal: %v", err)
+			}
+
+			var parsed map[string]json.RawMessage
+			if err := json.Unmarshal(data, &parsed); err != nil {
+				t.Fatalf("json.Unmarshal: %v", err)
+			}
+
+			raw, present := parsed["folders"]
+			if !present {
+				t.Fatalf("folders key must be present (no omitempty); body=%s", string(data))
+			}
+			if string(raw) != tc.wantFoldersValue {
+				t.Errorf("folders raw=%s, want %s; body=%s",
+					string(raw), tc.wantFoldersValue, string(data))
+			}
+		})
+	}
+}
+
 // =============================================================================
 // CreateDraftRequest Tests
 // =============================================================================
diff --git a/internal/domain/grant.go b/internal/domain/grant.go
index 731b95b..b41745d 100644
--- a/internal/domain/grant.go
+++ b/internal/domain/grant.go
@@ -34,6 +34,8 @@ func (ut *UnixTime) UnmarshalJSON(data []byte) error {
 }
 
 // Grant represents a Nylas grant (authenticated account).
+// AccessToken/RefreshToken use json:"-" so list/get JSON output never
+// leaks OAuth secrets; they are populated by ExchangeCode in adapters/nylas/auth.go.
 type Grant struct {
 	ID           string   `json:"id"`
 	Provider     Provider `json:"provider"`
@@ -42,8 +44,8 @@ type Grant struct {
 	Scope        []string `json:"scope,omitempty"`
 	CreatedAt    UnixTime `json:"created_at,omitempty"`
 	UpdatedAt    UnixTime `json:"updated_at,omitempty"`
-	AccessToken  string   `json:"access_token,omitempty"`
-	RefreshToken string   `json:"refresh_token,omitempty"`
+	AccessToken  string   `json:"-"`
+	RefreshToken string   `json:"-"`
 }
 
 // IsValid returns true if the grant is in a valid state.
diff --git a/internal/httputil/httputil.go b/internal/httputil/httputil.go
index 4750564..5e19c3b 100644
--- a/internal/httputil/httputil.go
+++ b/internal/httputil/httputil.go
@@ -4,6 +4,7 @@ package httputil
 import (
 	"encoding/json"
 	"io"
+	"log/slog"
 	"net/http"
 )
 
@@ -19,10 +20,19 @@ func LimitedBody(w http.ResponseWriter, r *http.Request, maxBytes int64) io.Read
 
 // WriteJSON writes a JSON response with the given status code.
 // It sets the Content-Type header to application/json.
+//
+// Encoder errors are logged rather than swallowed: once WriteHeader has
+// fired we can't change the status code, but we *can* leave a server-side
+// breadcrumb so that "client received truncated JSON" is debuggable
+// instead of invisible. Common failure modes are client disconnect
+// mid-write and unmarshallable values (e.g. NaN, channels) — both of
+// which a developer would want to know about.
 func WriteJSON(w http.ResponseWriter, status int, data any) {
 	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(status)
-	_ = json.NewEncoder(w).Encode(data)
+	if err := json.NewEncoder(w).Encode(data); err != nil {
+		slog.Error("WriteJSON encode failed", "status", status, "err", err)
+	}
 }
 
 // DecodeJSON decodes JSON from the request body into the target.
diff --git a/internal/ui/server_exec.go b/internal/ui/server_exec.go
index 5ed1e28..42a5caa 100644
--- a/internal/ui/server_exec.go
+++ b/internal/ui/server_exec.go
@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"encoding/json"
 	"io"
+	"log/slog"
 	"net/http"
 	"os"
 	"os/exec"
@@ -225,6 +226,85 @@ var allowedCommands = map[string]bool{
 	"notetaker create": true,
 	"notetaker delete": true,
 	"notetaker media":  true,
+	// Email signatures subcommands
+	"email signatures":        true,
+	"email signatures list":   true,
+	"email signatures show":   true,
+	"email signatures create": true,
+	"email signatures update": true,
+	"email signatures delete": true,
+	// Email templates subcommands
+	"email templates":        true,
+	"email templates list":   true,
+	"email templates show":   true,
+	"email templates create": true,
+	"email templates update": true,
+	"email templates delete": true,
+	"email templates use":    true,
+	// Admin applications create / grants stats (referenced by UI, not previously in allowlist)
+	"admin applications create": true,
+	"admin grants stats":        true,
+	// Admin callback-uris subcommands
+	"admin callback-uris":        true,
+	"admin callback-uris list":   true,
+	"admin callback-uris show":   true,
+	"admin callback-uris create": true,
+	"admin callback-uris update": true,
+	"admin callback-uris delete": true,
+	// Agent commands
+	"agent status":         true,
+	"agent account":        true,
+	"agent account list":   true,
+	"agent account get":    true,
+	"agent account create": true,
+	"agent account update": true,
+	"agent account delete": true,
+	"agent policy":         true,
+	"agent policy list":    true,
+	"agent policy get":     true,
+	"agent policy read":    true,
+	"agent policy create":  true,
+	"agent policy update":  true,
+	"agent policy delete":  true,
+	"agent rule":           true,
+	"agent rule list":      true,
+	"agent rule get":       true,
+	"agent rule read":      true,
+	"agent rule create":    true,
+	"agent rule update":    true,
+	"agent rule delete":    true,
+	// Audit commands
+	"audit init":         true,
+	"audit logs":         true,
+	"audit logs show":    true,
+	"audit logs enable":  true,
+	"audit logs disable": true,
+	"audit logs status":  true,
+	"audit logs clear":   true,
+	"audit logs summary": true,
+	"audit config":       true,
+	"audit config show":  true,
+	"audit config set":   true,
+	"audit export":       true,
+	// Dashboard commands (Nylas Dashboard SaaS)
+	"dashboard status":         true,
+	"dashboard register":       true,
+	"dashboard login":          true,
+	"dashboard logout":         true,
+	"dashboard refresh":        true,
+	"dashboard switch":         true,
+	"dashboard sso":            true,
+	"dashboard sso login":      true,
+	"dashboard sso register":   true,
+	"dashboard apps":           true,
+	"dashboard apps list":      true,
+	"dashboard apps create":    true,
+	"dashboard apps use":       true,
+	"dashboard apikeys":        true,
+	"dashboard apikeys list":   true,
+	"dashboard apikeys create": true,
+	"dashboard orgs":           true,
+	"dashboard orgs list":      true,
 	// Other
 	"version": true,
 }
@@ -326,14 +406,19 @@ func (s *Server) handleExecCommand(w http.ResponseWriter, r *http.Request) {
 	}
 
 	if err != nil {
-		// Command failed but may still have useful output
+		// Command failed but may still have useful output. The raw exec
+		// error is exit-status text plus, on some failures, fragments
+		// of the path or invocation; log it via slog and return a
+		// generic message so the localhost UI matches the air doctrine
+		// of "no upstream errors echoed to clients".
 		if output != "" {
 			writeJSON(w, http.StatusOK, ExecResponse{
 				Output: output,
 			})
 		} else {
+			slog.Error("command exec failed", "args", args, "err", err)
 			writeJSON(w, http.StatusOK, ExecResponse{
-				Error: "Command failed: " + err.Error(),
+				Error: "Command failed",
 			})
 		}
 		return
diff --git a/internal/ui/static/css/layout.css b/internal/ui/static/css/layout.css
index ff5408e..6f69e4f 100644
--- a/internal/ui/static/css/layout.css
+++ b/internal/ui/static/css/layout.css
@@ -4,6 +4,8 @@
 
 /* Header */
 .header {
+    position: relative;
+    z-index: 50;
     display: flex;
     align-items: center;
     justify-content: space-between;
@@ -40,6 +42,12 @@
     gap: 14px;
 }
 
+.header-right {
+    display: flex;
+    align-items: center;
+    gap: 14px;
+}
+
 /* Main */
 .main { flex: 1; padding: 40px; }
 
diff --git a/internal/ui/static/js/commands-admin.js b/internal/ui/static/js/commands-admin.js
index 90bec3b..06b60e6 100644
--- a/internal/ui/static/js/commands-admin.js
+++ b/internal/ui/static/js/commands-admin.js
@@ -20,6 +20,33 @@ const adminCommandSections = [
             }
         }
     },
+    {
+        title: 'Callback URIs',
+        commands: {
+            'callback-uris-list': { title: 'List', cmd: 'admin callback-uris list', desc: 'List callback URIs' },
+            'callback-uris-show': { title: 'Show', cmd: 'admin callback-uris show', desc: 'Show callback URI details', param: { name: 'uri-id', placeholder: 'Enter URI ID...' } },
+            'callback-uris-create': {
+                title: 'Create',
+                cmd: 'admin callback-uris create',
+                desc: 'Create a callback URI',
+                flags: [
+                    { name: 'url', type: 'text', label: 'URL', placeholder: 'https://example.com/callback', required: true },
+                    { name: 'platform', type: 'text', label: 'Platform', placeholder: 'web, ios, android' }
+                ]
+            },
+            'callback-uris-update': {
+                title: 'Update',
+                cmd: 'admin callback-uris update',
+                desc: 'Update a callback URI',
+                param: { name: 'uri-id', placeholder: 'Enter URI ID...' },
+                flags: [
+                    { name: 'url', type: 'text', label: 'URL', placeholder: 'https://example.com/new-callback' },
+                    { name: 'platform', type: 'text', label: 'Platform', placeholder: 'web, ios, android' }
+                ]
+            },
+            'callback-uris-delete': { title: 'Delete', cmd: 'admin callback-uris delete', desc: 'Delete a callback URI', param: { name: 'uri-id', placeholder: 'Enter URI ID...' } }
+        }
+    },
     {
         title: 'Connectors',
         commands: {
diff --git a/internal/ui/static/js/commands-agent.js b/internal/ui/static/js/commands-agent.js
new file mode 100644
index 0000000..f332cd3
--- /dev/null
+++ b/internal/ui/static/js/commands-agent.js
@@ -0,0 +1,179 @@
+// =============================================================================
+// Agent Commands
+// =============================================================================
+
+const agentCommandSections = [
+    {
+        title: 'Status',
+        commands: {
+            'status': { title: 'Status', cmd: 'agent status', desc: 'Check connector and account readiness' }
+        }
+    },
+    {
+        title: 'Account',
+        commands: {
+            'account-list': { title: 'List', cmd: 'agent account list', desc: 'List agent accounts' },
+            'account-get': { title: 'Get', cmd: 'agent account get', desc: 'Show an agent account', param: { name: 'agent-id-or-email', placeholder: 'agent-id or email' } },
+            'account-create': {
+                title: 'Create',
+                cmd: 'agent account create',
+                desc: 'Create a new agent account',
+                param: { name: 'email', placeholder: 'me@yourapp.nylas.email' },
+                flags: [
+                    { name: 'app-password', type: 'text', label: 'App password', placeholder: 'Optional IMAP/SMTP app password' },
+                    { name: 'policy-id', type: 'text', label: 'Policy ID', placeholder: 'Attach a policy by ID (optional)' }
+                ]
+            },
+            'account-update': {
+                title: 'Update',
+                cmd: 'agent account update',
+                desc: 'Update an agent account',
+                param: { name: 'agent-id-or-email', placeholder: 'agent-id or email' },
+                flags: [
+                    { name: 'app-password', type: 'text', label: 'App password', placeholder: 'Rotate or add the app password' }
+                ]
+            },
+            'account-delete': { title: 'Delete', cmd: 'agent account delete', desc: 'Delete an agent account', param: { name: 'agent-id-or-email', placeholder: 'agent-id or email' } }
+        }
+    },
+    {
+        title: 'Policy',
+        commands: {
+            'policy-list': { title: 'List', cmd: 'agent policy list', desc: 'List agent policies' },
+            'policy-get': { title: 'Get', cmd: 'agent policy get', desc: 'Show a policy summary', param: { name: 'policy-id', placeholder: 'Enter policy ID...' } },
+            'policy-read': { title: 'Read', cmd: 'agent policy read', desc: 'Read a full policy document', param: { name: 'policy-id', placeholder: 'Enter policy ID...' } },
+            'policy-create': {
+                title: 'Create',
+                cmd: 'agent policy create',
+                desc: 'Create a policy',
+                flags: [
+                    { name: 'name', type: 'text', label: 'Name', placeholder: 'Policy name' },
+                    { name: 'data-file', type: 'text', label: 'Data file', placeholder: 'Path to JSON request body' }
+                ]
+            },
+            'policy-update': {
+                title: 'Update',
+                cmd: 'agent policy update',
+                desc: 'Update a policy',
+                param: { name: 'policy-id', placeholder: 'Enter policy ID...' },
+                flags: [
+                    { name: 'name', type: 'text', label: 'Name', placeholder: 'Updated policy name' },
+                    { name: 'data-file', type: 'text', label: 'Data file', placeholder: 'Path to JSON request body' }
+                ]
+            },
+            'policy-delete': { title: 'Delete', cmd: 'agent policy delete', desc: 'Delete a policy', param: { name: 'policy-id', placeholder: 'Enter policy ID...' } }
+        }
+    },
+    {
+        title: 'Rule',
+        commands: {
+            'rule-list': { title: 'List', cmd: 'agent rule list', desc: 'List agent rules' },
+            'rule-get': { title: 'Get', cmd: 'agent rule get', desc: 'Show a rule summary', param: { name: 'rule-id', placeholder: 'Enter rule ID...' } },
+            'rule-read': { title: 'Read', cmd: 'agent rule read', desc: 'Read a full rule document', param: { name: 'rule-id', placeholder: 'Enter rule ID...' } },
+            'rule-create': {
+                title: 'Create',
+                cmd: 'agent rule create',
+                desc: 'Create a rule',
+                flags: [
+                    { name: 'name', type: 'text', label: 'Name', placeholder: 'Rule name' },
+                    { name: 'description', type: 'text', label: 'Description', placeholder: 'Rule description' },
+                    { name: 'priority', type: 'number', label: 'Priority', placeholder: '0' },
+                    { name: 'trigger', type: 'text', label: 'Trigger', placeholder: 'inbound or outbound' },
+                    { name: 'enabled', type: 'checkbox', label: 'Enabled' },
+                    { name: 'policy-id', type: 'text', label: 'Policy ID', placeholder: 'Attach to policy ID' },
+                    { name: 'data-file', type: 'text', label: 'Data file', placeholder: 'Path to JSON request body' }
+                ]
+            },
+            'rule-update': {
+                title: 'Update',
+                cmd: 'agent rule update',
+                desc: 'Update a rule',
+                param: { name: 'rule-id', placeholder: 'Enter rule ID...' },
+                flags: [
+                    { name: 'name', type: 'text', label: 'Name', placeholder: 'Updated rule name' },
+                    { name: 'description', type: 'text', label: 'Description', placeholder: 'Updated description' },
+                    { name: 'priority', type: 'number', label: 'Priority', placeholder: '0' },
+                    { name: 'enabled', type: 'checkbox', label: 'Enabled' },
+                    { name: 'data-file', type: 'text', label: 'Data file', placeholder: 'Path to JSON request body' }
+                ]
+            },
+            'rule-delete': { title: 'Delete', cmd: 'agent rule delete', desc: 'Delete a rule', param: { name: 'rule-id', placeholder: 'Enter rule ID...' } }
+        }
+    }
+];
+
+const agentCommands = {};
+agentCommandSections.forEach(section => {
+    Object.assign(agentCommands, section.commands);
+});
+
+let currentAgentCmd = '';
+
+function showAgentCmd(cmd) {
+    const data = agentCommands[cmd];
+    if (!data) return;
+
+    currentAgentCmd = cmd;
+
+    document.querySelectorAll('#page-agent .cmd-item').forEach(item => {
+        item.classList.toggle('active', item.dataset.cmd === cmd);
+    });
+
+    const detail = document.getElementById('agent-detail');
+    detail.querySelector('.detail-placeholder').style.display = 'none';
+    detail.querySelector('.detail-content').style.display = 'block';
+
+    document.getElementById('agent-detail-title').textContent = data.title;
+    document.getElementById('agent-detail-cmd').textContent = 'nylas ' + data.cmd;
+    document.getElementById('agent-detail-desc').textContent = data.desc || '';
+    document.getElementById('agent-output').textContent = 'Click "Run" to execute command...';
+    document.getElementById('agent-output').className = 'output-pre';
+
+    showParamInput('agent', data.param, data.flags);
+}
+
+async function runAgentCmd() {
+    if (!currentAgentCmd) return;
+
+    const data = agentCommands[currentAgentCmd];
+    const output = document.getElementById('agent-output');
+    const btn = document.getElementById('agent-run-btn');
+    const fullCmd = buildCommand(data.cmd, 'agent', data.flags);
+
+    document.getElementById('agent-detail-cmd').textContent = 'nylas ' + fullCmd;
+
+    setButtonLoading(btn, true);
+    setOutputLoading(output);
+
+    try {
+        const res = await fetch('/api/exec', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ command: fullCmd })
+        });
+        const result = await res.json();
+
+        if (result.error) {
+            setOutputError(output, result.error);
+            showToast('Command failed', 'error');
+        } else {
+            setOutputSuccess(output, result.output);
+            showToast('Command completed', 'success');
+        }
+
+        updateTimestamp('agent');
+    } catch (err) {
+        setOutputError(output, 'Failed to execute command: ' + err.message);
+        showToast('Connection error', 'error');
+    } finally {
+        setButtonLoading(btn, false);
+    }
+}
+
+function refreshAgentCmd() {
+    if (currentAgentCmd) runAgentCmd();
+}
+
+function renderAgentCommands() {
+    renderCommandSections('agent-cmd-list', agentCommandSections, 'showAgentCmd');
+}
diff --git a/internal/ui/static/js/commands-audit.js b/internal/ui/static/js/commands-audit.js
new file mode 100644
index 0000000..89ef940
--- /dev/null
+++ b/internal/ui/static/js/commands-audit.js
@@ -0,0 +1,162 @@
+// =============================================================================
+// Audit Commands
+// =============================================================================
+
+const auditCommandSections = [
+    {
+        title: 'Setup',
+        commands: {
+            'init': {
+                title: 'Init',
+                cmd: 'audit init',
+                desc: 'Initialize audit logging configuration',
+                flags: [
+                    { name: 'path', type: 'text', label: 'Log directory', placeholder: '~/.config/nylas/audit' },
+                    { name: 'retention', type: 'number', label: 'Retention (days)', placeholder: '90' },
+                    { name: 'max-size', type: 'number', label: 'Max size (MB)', placeholder: '100' },
+                    { name: 'format', type: 'text', label: 'Format', placeholder: 'jsonl or json' },
+                    { name: 'enable', type: 'checkbox', label: 'Enable immediately' },
+                    { name: 'no-prompt', type: 'checkbox', label: 'Skip prompts' }
+                ]
+            }
+        }
+    },
+    {
+        title: 'Logs',
+        commands: {
+            'logs-show': {
+                title: 'Show',
+                cmd: 'audit logs show',
+                desc: 'Show recent audit log entries',
+                flags: [
+                    { name: 'limit', type: 'number', label: 'Limit', placeholder: '20', short: 'n' },
+                    { name: 'since', type: 'text', label: 'Since', placeholder: 'YYYY-MM-DD' },
+                    { name: 'until', type: 'text', label: 'Until', placeholder: 'YYYY-MM-DD' },
+                    { name: 'command', type: 'text', label: 'Command', placeholder: 'Filter by command prefix' },
+                    { name: 'status', type: 'text', label: 'Status', placeholder: 'success or error' },
+                    { name: 'grant', type: 'text', label: 'Grant ID', placeholder: 'Filter by grant' },
+                    { name: 'request-id', type: 'text', label: 'Request ID', placeholder: 'Filter by Nylas request ID' },
+                    { name: 'invoker', type: 'text', label: 'Invoker', placeholder: 'Filter by username' },
+                    { name: 'source', type: 'text', label: 'Source', placeholder: 'claude-code, github-actions, terminal' }
+                ]
+            },
+            'logs-enable': { title: 'Enable', cmd: 'audit logs enable', desc: 'Enable audit logging' },
+            'logs-disable': { title: 'Disable', cmd: 'audit logs disable', desc: 'Disable audit logging' },
+            'logs-status': { title: 'Status', cmd: 'audit logs status', desc: 'Show audit logging status' },
+            'logs-clear': { title: 'Clear', cmd: 'audit logs clear', desc: 'Clear all audit log entries' },
+            'logs-summary': {
+                title: 'Summary',
+                cmd: 'audit logs summary',
+                desc: 'Aggregated audit log summary',
+                flags: [
+                    { name: 'days', type: 'number', label: 'Days', placeholder: '7' }
+                ]
+            }
+        }
+    },
+    {
+        title: 'Config',
+        commands: {
+            'config-show': { title: 'Show', cmd: 'audit config show', desc: 'Show audit configuration' },
+            'config-set': {
+                title: 'Set',
+                cmd: 'audit config set',
+                desc: 'Set an audit config value',
+                param: { name: 'key value', placeholder: 'e.g. retention 30' }
+            }
+        }
+    },
+    {
+        title: 'Export',
+        commands: {
+            'export': {
+                title: 'Export',
+                cmd: 'audit export',
+                desc: 'Export audit log entries',
+                flags: [
+                    { name: 'output', type: 'text', label: 'Output file', placeholder: 'audit-2026-05.json', short: 'o' },
+                    { name: 'format', type: 'text', label: 'Format', placeholder: 'json or csv' },
+                    { name: 'since', type: 'text', label: 'Since', placeholder: 'YYYY-MM-DD' },
+                    { name: 'until', type: 'text', label: 'Until', placeholder: 'YYYY-MM-DD' },
+                    { name: 'limit', type: 'number', label: 'Limit', placeholder: '10000', short: 'n' }
+                ]
+            }
+        }
+    }
+];
+
+const auditCommands = {};
+auditCommandSections.forEach(section => {
+    Object.assign(auditCommands, section.commands);
+});
+
+let currentAuditCmd = '';
+
+function showAuditCmd(cmd) {
+    const data = auditCommands[cmd];
+    if (!data) return;
+
+    currentAuditCmd = cmd;
+
+    document.querySelectorAll('#page-audit .cmd-item').forEach(item => {
+        item.classList.toggle('active', item.dataset.cmd === cmd);
+    });
+
+    const detail = document.getElementById('audit-detail');
+    detail.querySelector('.detail-placeholder').style.display = 'none';
+    detail.querySelector('.detail-content').style.display = 'block';
+
+    document.getElementById('audit-detail-title').textContent = data.title;
+    document.getElementById('audit-detail-cmd').textContent = 'nylas ' + data.cmd;
+    document.getElementById('audit-detail-desc').textContent = data.desc || '';
+    document.getElementById('audit-output').textContent = 'Click "Run" to execute command...';
+    document.getElementById('audit-output').className = 'output-pre';
+
+    showParamInput('audit', data.param, data.flags);
+}
+
+async function runAuditCmd() {
+    if (!currentAuditCmd) return;
+
+    const data = auditCommands[currentAuditCmd];
+    const output = document.getElementById('audit-output');
+    const btn = document.getElementById('audit-run-btn');
+    const fullCmd = buildCommand(data.cmd, 'audit', data.flags);
+
+    document.getElementById('audit-detail-cmd').textContent = 'nylas ' + fullCmd;
+
+    setButtonLoading(btn, true);
+    setOutputLoading(output);
+
+    try {
+        const res = await fetch('/api/exec', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ command: fullCmd })
+        });
+        const result = await res.json();
+
+        if (result.error) {
+            setOutputError(output, result.error);
+            showToast('Command failed', 'error');
+        } else {
+            setOutputSuccess(output, result.output);
+            showToast('Command completed', 'success');
+        }
+
+        updateTimestamp('audit');
+    } catch (err) {
+        setOutputError(output, 'Failed to execute command: ' + err.message);
+        showToast('Connection error', 'error');
+    } finally {
+        setButtonLoading(btn, false);
+    }
+}
+
+function refreshAuditCmd() {
+    if (currentAuditCmd) runAuditCmd();
+}
+
+function renderAuditCommands() {
+    renderCommandSections('audit-cmd-list', auditCommandSections, 'showAuditCmd');
+}
diff --git a/internal/ui/static/js/commands-dashboard.js b/internal/ui/static/js/commands-dashboard.js
new file mode 100644
index 0000000..77bf7f9
--- /dev/null
+++ b/internal/ui/static/js/commands-dashboard.js
@@ -0,0 +1,213 @@
+// =============================================================================
+// Dashboard Commands (Nylas Dashboard SaaS — register, SSO, apps, orgs)
+// =============================================================================
+
+const dashboardCommandSections = [
+    {
+        title: 'Status',
+        commands: {
+            'status': { title: 'Status', cmd: 'dashboard status', desc: 'Show Dashboard session status' },
+            'refresh': { title: 'Refresh', cmd: 'dashboard refresh', desc: 'Refresh Dashboard credentials' }
+        }
+    },
+    {
+        title: 'Account',
+        commands: {
+            'register': {
+                title: 'Register',
+                cmd: 'dashboard register',
+                desc: 'Register a new Dashboard account',
+                flags: [
+                    { name: 'google', type: 'checkbox', label: 'Google SSO' },
+                    { name: 'microsoft', type: 'checkbox', label: 'Microsoft SSO' },
+                    { name: 'github', type: 'checkbox', label: 'GitHub SSO' },
+                    { name: 'accept-privacy-policy', type: 'checkbox', label: 'Accept privacy policy' }
+                ]
+            },
+            'login': {
+                title: 'Login',
+                cmd: 'dashboard login',
+                desc: 'Log in to the Nylas Dashboard',
+                flags: [
+                    { name: 'google', type: 'checkbox', label: 'Google SSO' },
+                    { name: 'microsoft', type: 'checkbox', label: 'Microsoft SSO' },
+                    { name: 'github', type: 'checkbox', label: 'GitHub SSO' },
+                    { name: 'email', type: 'checkbox', label: 'Email + password' },
+                    { name: 'org', type: 'text', label: 'Organization', placeholder: 'Organization public ID' },
+                    { name: 'user', type: 'text', label: 'User email', placeholder: 'For non-interactive login' }
+                ]
+            },
+            'logout': { title: 'Logout', cmd: 'dashboard logout', desc: 'Log out of the Dashboard' }
+        }
+    },
+    {
+        title: 'SSO',
+        commands: {
+            'sso-login': {
+                title: 'SSO Login',
+                cmd: 'dashboard sso login',
+                desc: 'Sign in via SSO provider',
+                flags: [
+                    { name: 'provider', type: 'text', label: 'Provider', placeholder: 'google, microsoft, github', short: 'p' }
+                ]
+            },
+            'sso-register': {
+                title: 'SSO Register',
+                cmd: 'dashboard sso register',
+                desc: 'Register via SSO provider',
+                flags: [
+                    { name: 'provider', type: 'text', label: 'Provider', placeholder: 'google, microsoft, github', short: 'p' },
+                    { name: 'accept-privacy-policy', type: 'checkbox', label: 'Accept privacy policy' }
+                ]
+            }
+        }
+    },
+    {
+        title: 'Apps',
+        commands: {
+            'apps-list': {
+                title: 'List',
+                cmd: 'dashboard apps list',
+                desc: 'List Dashboard applications',
+                flags: [
+                    { name: 'region', type: 'text', label: 'Region', placeholder: 'us or eu', short: 'r' }
+                ]
+            },
+            'apps-create': {
+                title: 'Create',
+                cmd: 'dashboard apps create',
+                desc: 'Create a Dashboard application',
+                flags: [
+                    { name: 'name', type: 'text', label: 'Name', placeholder: 'Application name', required: true, short: 'n' },
+                    { name: 'region', type: 'text', label: 'Region', placeholder: 'us or eu', required: true, short: 'r' },
+                    { name: 'secret-delivery', type: 'text', label: 'Secret delivery', placeholder: 'clipboard or file' }
+                ]
+            },
+            'apps-use': {
+                title: 'Use',
+                cmd: 'dashboard apps use',
+                desc: 'Switch the active Dashboard application',
+                param: { name: 'application-id', placeholder: 'Enter application ID...' },
+                flags: [
+                    { name: 'region', type: 'text', label: 'Region', placeholder: 'us or eu', short: 'r' }
+                ]
+            }
+        }
+    },
+    {
+        title: 'API Keys',
+        commands: {
+            'apikeys-list': {
+                title: 'List',
+                cmd: 'dashboard apikeys list',
+                desc: 'List Dashboard API keys',
+                flags: [
+                    { name: 'app', type: 'text', label: 'Application', placeholder: 'Application ID (overrides active)' },
+                    { name: 'region', type: 'text', label: 'Region', placeholder: 'us or eu', short: 'r' }
+                ]
+            },
+            'apikeys-create': {
+                title: 'Create',
+                cmd: 'dashboard apikeys create',
+                desc: 'Create a Dashboard API key',
+                flags: [
+                    { name: 'app', type: 'text', label: 'Application', placeholder: 'Application ID (overrides active)' },
+                    { name: 'region', type: 'text', label: 'Region', placeholder: 'us or eu', short: 'r' },
+                    { name: 'name', type: 'text', label: 'Name', placeholder: 'API key name', short: 'n' },
+                    { name: 'expires', type: 'number', label: 'Expires (days)', placeholder: '0 (no expiration)' },
+                    { name: 'delivery', type: 'text', label: 'Delivery', placeholder: 'activate, clipboard, or file' }
+                ]
+            }
+        }
+    },
+    {
+        title: 'Orgs',
+        commands: {
+            'orgs-list': { title: 'List', cmd: 'dashboard orgs list', desc: 'List Dashboard organizations' },
+            'orgs-switch': {
+                title: 'Switch',
+                cmd: 'dashboard switch',
+                desc: 'Switch the active organization',
+                flags: [
+                    { name: 'org', type: 'text', label: 'Organization', placeholder: 'Organization public ID' }
+                ]
+            }
+        }
+    }
+];
+
+const dashboardCommands = {};
+dashboardCommandSections.forEach(section => {
+    Object.assign(dashboardCommands, section.commands);
+});
+
+let currentDashboardCmd = '';
+
+function showDashboardCmd(cmd) {
+    const data = dashboardCommands[cmd];
+    if (!data) return;
+
+    currentDashboardCmd = cmd;
+
+    document.querySelectorAll('#page-dashboard .cmd-item').forEach(item => {
+        item.classList.toggle('active', item.dataset.cmd === cmd);
+    });
+
+    const detail = document.getElementById('dashboard-detail');
+    detail.querySelector('.detail-placeholder').style.display = 'none';
+    detail.querySelector('.detail-content').style.display = 'block';
+
+    document.getElementById('dashboard-detail-title').textContent = data.title;
+    document.getElementById('dashboard-detail-cmd').textContent = 'nylas ' + data.cmd;
+    document.getElementById('dashboard-detail-desc').textContent = data.desc || '';
+    document.getElementById('dashboard-output').textContent = 'Click "Run" to execute command...';
+    document.getElementById('dashboard-output').className = 'output-pre';
+
+    showParamInput('dashboard', data.param, data.flags);
+}
+
+async function runDashboardCmd() {
+    if (!currentDashboardCmd) return;
+
+    const data = dashboardCommands[currentDashboardCmd];
+    const output = document.getElementById('dashboard-output');
+    const btn = document.getElementById('dashboard-run-btn');
+    const fullCmd = buildCommand(data.cmd, 'dashboard', data.flags);
+
+    document.getElementById('dashboard-detail-cmd').textContent = 'nylas ' + fullCmd;
+
+    setButtonLoading(btn, true);
+    setOutputLoading(output);
+
+    try {
+        const res = await fetch('/api/exec', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ command: fullCmd })
+        });
+        const result = await res.json();
+
+        if (result.error) {
+            setOutputError(output, result.error);
+            showToast('Command failed', 'error');
+        } else {
+            setOutputSuccess(output, result.output);
+            showToast('Command completed', 'success');
+        }
+
+        updateTimestamp('dashboard');
+    } catch (err) {
+        setOutputError(output, 'Failed to execute command: ' + err.message);
+        showToast('Connection error', 'error');
+    } finally {
+        setButtonLoading(btn, false);
+    }
+}
+
+function refreshDashboardCmd() {
+    if (currentDashboardCmd) runDashboardCmd();
+}
+
+function renderDashboardCommands() {
+    renderCommandSections('dashboard-cmd-list', dashboardCommandSections, 'showDashboardCmd');
+}
diff --git a/internal/ui/static/js/commands-email.js b/internal/ui/static/js/commands-email.js
index 93b1733..2728c43 100644
--- a/internal/ui/static/js/commands-email.js
+++ b/internal/ui/static/js/commands-email.js
@@ -76,6 +76,76 @@ const emailCommandSections = [
             'drafts-send': { title: 'Send', cmd: 'email drafts send', desc: 'Send a draft', param: { name: 'draft-id', placeholder: 'Enter draft ID...' } }
         }
     },
+    {
+        title: 'Signatures',
+        commands: {
+            'signatures-list': { title: 'List', cmd: 'email signatures list', desc: 'List stored signatures' },
+            'signatures-show': { title: 'Show', cmd: 'email signatures show', desc: 'Show signature details', param: { name: 'signature-id', placeholder: 'Enter signature ID...' } },
+            'signatures-create': {
+                title: 'Create',
+                cmd: 'email signatures create',
+                desc: 'Create a new signature',
+                flags: [
+                    { name: 'name', type: 'text', label: 'Name', placeholder: 'Signature name', required: true, short: 'n' },
+                    { name: 'body', type: 'textarea', label: 'Body (HTML)', placeholder: '<p>Best,<br>Alex</p>', short: 'b' }
+                ]
+            },
+            'signatures-update': {
+                title: 'Update',
+                cmd: 'email signatures update',
+                desc: 'Update a signature',
+                param: { name: 'signature-id', placeholder: 'Enter signature ID...' },
+                flags: [
+                    { name: 'name', type: 'text', label: 'Name', placeholder: 'New signature name', short: 'n' },
+                    { name: 'body', type: 'textarea', label: 'Body (HTML)', placeholder: 'Updated HTML body', short: 'b' }
+                ]
+            },
+            'signatures-delete': { title: 'Delete', cmd: 'email signatures delete', desc: 'Delete a signature', param: { name: 'signature-id', placeholder: 'Enter signature ID...' } }
+        }
+    },
+    {
+        title: 'Templates',
+        commands: {
+            'templates-list': { title: 'List', cmd: 'email templates list', desc: 'List stored templates' },
+            'templates-show': { title: 'Show', cmd: 'email templates show', desc: 'Show template details', param: { name: 'template-id', placeholder: 'Enter template ID...' } },
+            'templates-create': {
+                title: 'Create',
+                cmd: 'email templates create',
+                desc: 'Create a new template',
+                flags: [
+                    { name: 'name', type: 'text', label: 'Name', placeholder: 'Template name', required: true, short: 'n' },
+                    { name: 'subject', type: 'text', label: 'Subject', placeholder: 'Subject (supports {{variables}})', short: 's' },
+                    { name: 'body', type: 'textarea', label: 'Body', placeholder: 'Body (supports {{variables}})', short: 'b' },
+                    { name: 'category', type: 'text', label: 'Category', placeholder: 'sales, support, marketing...', short: 'c' }
+                ]
+            },
+            'templates-update': {
+                title: 'Update',
+                cmd: 'email templates update',
+                desc: 'Update a template',
+                param: { name: 'template-id', placeholder: 'Enter template ID...' },
+                flags: [
+                    { name: 'name', type: 'text', label: 'Name', placeholder: 'New name', short: 'n' },
+                    { name: 'subject', type: 'text', label: 'Subject', placeholder: 'New subject', short: 's' },
+                    { name: 'body', type: 'textarea', label: 'Body', placeholder: 'New body', short: 'b' },
+                    { name: 'category', type: 'text', label: 'Category', placeholder: 'New category', short: 'c' }
+                ]
+            },
+            'templates-delete': { title: 'Delete', cmd: 'email templates delete', desc: 'Delete a template', param: { name: 'template-id', placeholder: 'Enter template ID...' } },
+            'templates-use': {
+                title: 'Use',
+                cmd: 'email templates use',
+                desc: 'Send an email using a template',
+                param: { name: 'template-id', placeholder: 'Enter template ID...' },
+                flags: [
+                    { name: 'to', type: 'text', label: 'To', placeholder: 'recipient@example.com', required: true, short: 't' },
+                    { name: 'cc', type: 'text', label: 'CC', placeholder: 'cc@example.com (optional)' },
+                    { name: 'bcc', type: 'text', label: 'BCC', placeholder: 'bcc@example.com (optional)' },
+                    { name: 'preview', type: 'checkbox', label: 'Preview only', short: 'p' }
+                ]
+            }
+        }
+    },
     {
         title: 'Threads',
         commands: {
diff --git a/internal/ui/static/js/commands.js b/internal/ui/static/js/commands.js
index 2c06e9f..803fccd 100644
--- a/internal/ui/static/js/commands.js
+++ b/internal/ui/static/js/commands.js
@@ -51,8 +51,9 @@ function setOutputError(output, message) {
 
 /**
  * Set output to success state with formatted content.
- * Uses formatOutput which returns HTML for ANSI colors and table formatting.
- * Content is escaped via esc() before processing.
+ * formatOutput returns a DOM node (table or ANSI-styled fragment) built
+ * entirely via textContent — no innerHTML, no escaping required at the
+ * call site.
  * @param {HTMLElement} output - The output element
  * @param {string} content - The output content
  */
@@ -60,11 +61,9 @@ function setOutputSuccess(output, content) {
     if (!content) {
         output.textContent = 'Command completed successfully.';
     } else {
-        // formatOutput returns safe HTML (content is escaped via esc())
         const formatted = formatOutput(content);
-        if (formatted) {
-            // Safe: formatOutput escapes content via esc() before processing
-            output.innerHTML = formatted;
+        if (formatted && (formatted.nodeType === 1 || (formatted.childNodes && formatted.childNodes.length > 0))) {
+            output.replaceChildren(formatted);
         } else {
             output.textContent = 'Command completed successfully.';
         }
@@ -88,4 +87,7 @@ document.addEventListener('DOMContentLoaded', () => {
     renderOtpCommands();
     renderAdminCommands();
     renderNotetakerCommands();
+    renderAgentCommands();
+    renderAuditCommands();
+    renderDashboardCommands();
 });
diff --git a/internal/ui/static/js/output.js b/internal/ui/static/js/output.js
index f95799b..d72b145 100644
--- a/internal/ui/static/js/output.js
+++ b/internal/ui/static/js/output.js
@@ -1,31 +1,33 @@
 // =============================================================================
 // Output Formatting (ANSI parsing, table parsing)
 // =============================================================================
-
-// Table Parser - converts CLI table output to HTML table
+//
+// formatOutput / parseTable / parseAnsi return DOM nodes (or null), never
+// HTML strings. Every cell, header, and text run is set via textContent
+// so the call site can always use replaceChildren without needing to
+// think about escaping. Mirrors the Air UI's "interpolation goes through
+// textContent" doctrine.
+
+// Table Parser - converts CLI table output to a <table> element, or
+// null when the input doesn't look like a table.
 function parseTable(text) {
     if (!text) return null;
 
     const lines = text.trim().split('\n');
     if (lines.length < 2) return null;
 
-    // Check if first line looks like a header (has multiple words separated by spaces)
     const headerLine = lines[0].trim();
-
-    // Common CLI table patterns - check for column headers
     const tablePatterns = [
         /^\s*(GRANT\s*ID|ID|EMAIL|NAME|SUBJECT|TITLE|CALENDAR)/i,
-        /^\s*\w+\s{2,}\w+/  // At least two words separated by multiple spaces
+        /^\s*\w+\s{2,}\w+/
     ];
 
     const looksLikeTable = tablePatterns.some(p => p.test(headerLine));
     if (!looksLikeTable) return null;
 
-    // Parse header - split by 2+ spaces
     const headerParts = headerLine.split(/\s{2,}/).filter(h => h.trim());
     if (headerParts.length < 2) return null;
 
-    // Find column positions based on header
     const colPositions = [];
     let pos = 0;
     for (const header of headerParts) {
@@ -34,7 +36,6 @@ function parseTable(text) {
         pos = idx + header.length;
     }
 
-    // Parse rows
     const rows = [];
     for (let i = 1; i < lines.length; i++) {
         const line = lines[i];
@@ -55,109 +56,121 @@ function parseTable(text) {
 
     if (rows.length === 0) return null;
 
-    // Build HTML table
-    let html = '<table class="formatted-table"><thead><tr>';
+    const table = document.createElement('table');
+    table.className = 'formatted-table';
+
+    const thead = document.createElement('thead');
+    const headerRow = document.createElement('tr');
     for (const header of headerParts) {
-        html += `<th>${esc(header)}</th>`;
+        const th = document.createElement('th');
+        th.textContent = header;
+        headerRow.appendChild(th);
     }
-    html += '</tr></thead><tbody>';
+    thead.appendChild(headerRow);
+    table.appendChild(thead);
 
+    const tbody = document.createElement('tbody');
     for (const row of rows) {
-        html += '<tr>';
+        const tr = document.createElement('tr');
         for (let i = 0; i < headerParts.length; i++) {
             const cell = row[i] || '';
             const headerLower = headerParts[i].toLowerCase();
-
-            // Add special classes based on column type
-            let cellClass = '';
+            const td = document.createElement('td');
             if (headerLower.includes('id') || headerLower.includes('grant')) {
-                cellClass = 'cell-id';
+                td.className = 'cell-id';
             } else if (headerLower.includes('email')) {
-                cellClass = 'cell-email';
+                td.className = 'cell-email';
             } else if (cell === '✓' || cell === '✔') {
-                cellClass = 'cell-check';
+                td.className = 'cell-check';
             }
-
-            html += `<td class="${cellClass}">${esc(cell)}</td>`;
+            td.textContent = cell;
+            tr.appendChild(td);
         }
-        html += '</tr>';
+        tbody.appendChild(tr);
     }
-
-    html += '</tbody></table>';
-    return html;
+    table.appendChild(tbody);
+    return table;
 }
 
-// Format output - try table first, then ANSI
+// formatOutput - try table first, then ANSI. Returns a Node (table or
+// DocumentFragment) or null when there is no content to render.
 function formatOutput(text) {
-    if (!text) return '';
+    if (!text) return null;
 
-    // Try to parse as table
-    const tableHtml = parseTable(text);
-    if (tableHtml) {
-        return tableHtml;
+    const table = parseTable(text);
+    if (table) {
+        return table;
     }
 
-    // Fall back to ANSI parsing
     return parseAnsi(text);
 }
 
-// ANSI Color Parser
+// ANSI class mapping. Each entry is the digits between CSI `[` and `m`.
+const ANSI_CLASS_BY_CODE = {
+    '1': 'ansi-bold',
+    '2': 'ansi-dim',
+    '4': 'ansi-underline',
+    '30': 'ansi-gray', '90': 'ansi-gray',
+    '31': 'ansi-red', '91': 'ansi-red',
+    '32': 'ansi-green', '92': 'ansi-green',
+    '33': 'ansi-yellow', '93': 'ansi-yellow',
+    '34': 'ansi-blue', '94': 'ansi-blue',
+    '35': 'ansi-magenta', '95': 'ansi-magenta',
+    '36': 'ansi-cyan', '96': 'ansi-cyan',
+    '37': 'ansi-white', '97': 'ansi-white',
+    '1;32': 'ansi-bold ansi-green',
+    '1;31': 'ansi-bold ansi-red',
+    '1;33': 'ansi-bold ansi-yellow',
+    '1;34': 'ansi-bold ansi-blue',
+    '1;36': 'ansi-bold ansi-cyan',
+};
+
+// Matches a real ANSI CSI SGR sequence plus the two literal-escape forms
+// that occasionally arrive after JSON / HTML round-trips.
+const ANSI_SEQUENCE_RE = /\x1b\[([0-9;]*)m|\\x1b\[([0-9;]*)m|&#x1b;\[([0-9;]*)m/g;
+
+// parseAnsi walks the input and returns a DocumentFragment whose text
+// runs are plain text nodes wrapped in <span class="ansi-..."> for each
+// active style. Resets pop one level off the style stack — matches the
+// original string parser's per-reset behavior. Codes outside the
+// allow-list (and stray escape forms) are silently dropped.
 function parseAnsi(text) {
-    if (!text) return '';
-
-    // First escape HTML
-    let html = esc(text);
-
-    // ANSI escape code patterns
-    const ansiMap = {
-        // Reset
-        '\\x1b\\[0m': '</span>',
-        '\\x1b\\[m': '</span>',
-
-        // Bold/Dim
-        '\\x1b\\[1m': '<span class="ansi-bold">',
-        '\\x1b\\[2m': '<span class="ansi-dim">',
-        '\\x1b\\[4m': '<span class="ansi-underline">',
-
-        // Foreground colors (standard)
-        '\\x1b\\[30m': '<span class="ansi-gray">',
-        '\\x1b\\[31m': '<span class="ansi-red">',
-        '\\x1b\\[32m': '<span class="ansi-green">',
-        '\\x1b\\[33m': '<span class="ansi-yellow">',
-        '\\x1b\\[34m': '<span class="ansi-blue">',
-        '\\x1b\\[35m': '<span class="ansi-magenta">',
-        '\\x1b\\[36m': '<span class="ansi-cyan">',
-        '\\x1b\\[37m': '<span class="ansi-white">',
-
-        // Bright foreground colors
-        '\\x1b\\[90m': '<span class="ansi-gray">',
-        '\\x1b\\[91m': '<span class="ansi-red">',
-        '\\x1b\\[92m': '<span class="ansi-green">',
-        '\\x1b\\[93m': '<span class="ansi-yellow">',
-        '\\x1b\\[94m': '<span class="ansi-blue">',
-        '\\x1b\\[95m': '<span class="ansi-magenta">',
-        '\\x1b\\[96m': '<span class="ansi-cyan">',
-        '\\x1b\\[97m': '<span class="ansi-white">',
-
-        // Bold + color combinations
-        '\\x1b\\[1;32m': '<span class="ansi-bold ansi-green">',
-        '\\x1b\\[1;31m': '<span class="ansi-bold ansi-red">',
-        '\\x1b\\[1;33m': '<span class="ansi-bold ansi-yellow">',
-        '\\x1b\\[1;34m': '<span class="ansi-bold ansi-blue">',
-        '\\x1b\\[1;36m': '<span class="ansi-bold ansi-cyan">',
-    };
-
-    // Replace ANSI codes with HTML spans
-    for (const [code, replacement] of Object.entries(ansiMap)) {
-        html = html.replace(new RegExp(code, 'g'), replacement);
-    }
+    const fragment = document.createDocumentFragment();
+    if (!text) return fragment;
+
+    const stack = [fragment];
+    let lastIndex = 0;
+    let match;
 
-    // Remove any remaining ANSI codes we didn't handle
-    html = html.replace(/\x1b\[[0-9;]*m/g, '');
+    ANSI_SEQUENCE_RE.lastIndex = 0;
+    while ((match = ANSI_SEQUENCE_RE.exec(text)) !== null) {
+        const parent = stack[stack.length - 1];
 
-    // Also handle escaped versions that might come through
-    html = html.replace(/\\x1b\[[0-9;]*m/g, '');
-    html = html.replace(/&#x1b;\[[0-9;]*m/g, '');
+        if (match.index > lastIndex) {
+            parent.appendChild(document.createTextNode(text.substring(lastIndex, match.index)));
+        }
+
+        const code = match[1] ?? match[2] ?? match[3] ?? '';
+        if (code === '' || code === '0') {
+            if (stack.length > 1) {
+                stack.pop();
+            }
+        } else {
+            const className = ANSI_CLASS_BY_CODE[code];
+            if (className) {
+                const span = document.createElement('span');
+                span.className = className;
+                parent.appendChild(span);
+                stack.push(span);
+            }
+        }
+
+        lastIndex = ANSI_SEQUENCE_RE.lastIndex;
+    }
+
+    if (lastIndex < text.length) {
+        stack[stack.length - 1].appendChild(document.createTextNode(text.substring(lastIndex)));
+    }
 
-    return html;
+    return fragment;
 }
diff --git a/internal/ui/templates/base.gohtml b/internal/ui/templates/base.gohtml
index ffd8c4c..58321f0 100644
--- a/internal/ui/templates/base.gohtml
+++ b/internal/ui/templates/base.gohtml
@@ -59,6 +59,9 @@
     <script src="/js/commands-otp.js"></script>
     <script src="/js/commands-admin.js"></script>
     <script src="/js/commands-notetaker.js"></script>
+    <script src="/js/commands-agent.js"></script>
+    <script src="/js/commands-audit.js"></script>
+    <script src="/js/commands-dashboard.js"></script>
     <script src="/js/commands.js"></script>
     <script src="/app.js"></script>
 </body>
diff --git a/internal/ui/templates/pages/agent.gohtml b/internal/ui/templates/pages/agent.gohtml
new file mode 100644
index 0000000..a9d4f00
--- /dev/null
+++ b/internal/ui/templates/pages/agent.gohtml
@@ -0,0 +1,71 @@
+{{define "page-agent"}}
+<div class="page" id="page-agent">
+    <div class="page-layout">
+        <div class="page-main">
+            <div class="detail-view glass-card" id="agent-detail">
+                <div class="detail-placeholder">
+                    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <circle cx="12" cy="12" r="3"/>
+                        <path d="M12 1v6m0 10v6m11-11h-6m-10 0H1"/>
+                        <path d="M19.07 4.93l-4.24 4.24m-5.66 5.66l-4.24 4.24"/>
+                        <path d="M19.07 19.07l-4.24-4.24m-5.66-5.66L4.93 4.93"/>
+                    </svg>
+                    <h2>Agent Commands</h2>
+                    <p>Select a command from the right to see details</p>
+                </div>
+                <div class="detail-content" style="display: none;">
+                    <div class="detail-header">
+                        <h2 id="agent-detail-title">Command</h2>
+                        <p id="agent-detail-desc" class="detail-desc"></p>
+                        <div class="detail-cmd-row">
+                            <code id="agent-detail-cmd">nylas agent</code>
+                            <div class="action-buttons">
+                                <button class="run-btn" id="agent-run-btn" onclick="runAgentCmd()">
+                                    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                                        <polygon points="5 3 19 12 5 21 5 3"/>
+                                    </svg>
+                                    Run
+                                    <span class="spinner"></span>
+                                </button>
+                                <button class="refresh-btn" onclick="refreshAgentCmd()" title="Re-run command">
+                                    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                                        <polyline points="23 4 23 10 17 10"/>
+                                        <path d="M20.49 15a9 9 0 11-2.12-9.36L23 10"/>
+                                    </svg>
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+                    <div id="agent-param-container" style="display: none;"></div>
+                    <div class="detail-section">
+                        <div class="output-container">
+                            <div class="output-header">
+                                <h3>Output</h3>
+                                <div class="output-actions">
+                                    <button class="copy-output-btn" onclick="copyOutput('agent')">
+                                        <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                                            <rect x="9" y="9" width="13" height="13" rx="2"/>
+                                            <path d="M5 15H4a2 2 0 01-2-2V4a2 2 0 012-2h9a2 2 0 012 2v1"/>
+                                        </svg>
+                                        Copy
+                                    </button>
+                                </div>
+                            </div>
+                            <pre class="output-pre" id="agent-output">Run a command to see output here...</pre>
+                        </div>
+                        <div id="agent-timestamp" class="timestamp"></div>
+                    </div>
+                </div>
+            </div>
+        </div>
+        <div class="page-sidebar">
+            <div class="glass-card">
+                <div class="commands-title">Agent Commands</div>
+                <div class="cmd-list" id="agent-cmd-list">
+                    <!-- Rendered by JavaScript from agentCommandSections -->
+                </div>
+            </div>
+        </div>
+    </div>
+</div>
+{{end}}
diff --git a/internal/ui/templates/pages/audit.gohtml b/internal/ui/templates/pages/audit.gohtml
new file mode 100644
index 0000000..684cba8
--- /dev/null
+++ b/internal/ui/templates/pages/audit.gohtml
@@ -0,0 +1,72 @@
+{{define "page-audit"}}
+<div class="page" id="page-audit">
+    <div class="page-layout">
+        <div class="page-main">
+            <div class="detail-view glass-card" id="audit-detail">
+                <div class="detail-placeholder">
+                    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <path d="M14 2H6a2 2 0 00-2 2v16a2 2 0 002 2h12a2 2 0 002-2V8z"/>
+                        <polyline points="14 2 14 8 20 8"/>
+                        <line x1="9" y1="13" x2="15" y2="13"/>
+                        <line x1="9" y1="17" x2="15" y2="17"/>
+                        <line x1="9" y1="9" x2="11" y2="9"/>
+                    </svg>
+                    <h2>Audit Commands</h2>
+                    <p>Select a command from the right to see details</p>
+                </div>
+                <div class="detail-content" style="display: none;">
+                    <div class="detail-header">
+                        <h2 id="audit-detail-title">Command</h2>
+                        <p id="audit-detail-desc" class="detail-desc"></p>
+                        <div class="detail-cmd-row">
+                            <code id="audit-detail-cmd">nylas audit</code>
+                            <div class="action-buttons">
+                                <button class="run-btn" id="audit-run-btn" onclick="runAuditCmd()">
+                                    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                                        <polygon points="5 3 19 12 5 21 5 3"/>
+                                    </svg>
+                                    Run
+                                    <span class="spinner"></span>
+                                </button>
+                                <button class="refresh-btn" onclick="refreshAuditCmd()" title="Re-run command">
+                                    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                                        <polyline points="23 4 23 10 17 10"/>
+                                        <path d="M20.49 15a9 9 0 11-2.12-9.36L23 10"/>
+                                    </svg>
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+                    <div id="audit-param-container" style="display: none;"></div>
+                    <div class="detail-section">
+                        <div class="output-container">
+                            <div class="output-header">
+                                <h3>Output</h3>
+                                <div class="output-actions">
+                                    <button class="copy-output-btn" onclick="copyOutput('audit')">
+                                        <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                                            <rect x="9" y="9" width="13" height="13" rx="2"/>
+                                            <path d="M5 15H4a2 2 0 01-2-2V4a2 2 0 012-2h9a2 2 0 012 2v1"/>
+                                        </svg>
+                                        Copy
+                                    </button>
+                                </div>
+                            </div>
+                            <pre class="output-pre" id="audit-output">Run a command to see output here...</pre>
+                        </div>
+                        <div id="audit-timestamp" class="timestamp"></div>
+                    </div>
+                </div>
+            </div>
+        </div>
+        <div class="page-sidebar">
+            <div class="glass-card">
+                <div class="commands-title">Audit Commands</div>
+                <div class="cmd-list" id="audit-cmd-list">
+                    <!-- Rendered by JavaScript from auditCommandSections -->
+                </div>
+            </div>
+        </div>
+    </div>
+</div>
+{{end}}
diff --git a/internal/ui/templates/pages/dashboard.gohtml b/internal/ui/templates/pages/dashboard.gohtml
new file mode 100644
index 0000000..41ff2ff
--- /dev/null
+++ b/internal/ui/templates/pages/dashboard.gohtml
@@ -0,0 +1,70 @@
+{{define "page-dashboard"}}
+<div class="page" id="page-dashboard">
+    <div class="page-layout">
+        <div class="page-main">
+            <div class="detail-view glass-card" id="dashboard-detail">
+                <div class="detail-placeholder">
+                    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <path d="M21 16V8a2 2 0 00-1-1.73l-7-4a2 2 0 00-2 0l-7 4A2 2 0 003 8v8a2 2 0 001 1.73l7 4a2 2 0 002 0l7-4A2 2 0 0021 16z"/>
+                        <polyline points="3.27 6.96 12 12.01 20.73 6.96"/>
+                        <line x1="12" y1="22.08" x2="12" y2="12"/>
+                    </svg>
+                    <h2>Nylas Dashboard Commands</h2>
+                    <p>Manage your Nylas Dashboard account, applications, and organizations</p>
+                </div>
+                <div class="detail-content" style="display: none;">
+                    <div class="detail-header">
+                        <h2 id="dashboard-detail-title">Command</h2>
+                        <p id="dashboard-detail-desc" class="detail-desc"></p>
+                        <div class="detail-cmd-row">
+                            <code id="dashboard-detail-cmd">nylas dashboard</code>
+                            <div class="action-buttons">
+                                <button class="run-btn" id="dashboard-run-btn" onclick="runDashboardCmd()">
+                                    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                                        <polygon points="5 3 19 12 5 21 5 3"/>
+                                    </svg>
+                                    Run
+                                    <span class="spinner"></span>
+                                </button>
+                                <button class="refresh-btn" onclick="refreshDashboardCmd()" title="Re-run command">
+                                    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                                        <polyline points="23 4 23 10 17 10"/>
+                                        <path d="M20.49 15a9 9 0 11-2.12-9.36L23 10"/>
+                                    </svg>
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+                    <div id="dashboard-param-container" style="display: none;"></div>
+                    <div class="detail-section">
+                        <div class="output-container">
+                            <div class="output-header">
+                                <h3>Output</h3>
+                                <div class="output-actions">
+                                    <button class="copy-output-btn" onclick="copyOutput('dashboard')">
+                                        <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                                            <rect x="9" y="9" width="13" height="13" rx="2"/>
+                                            <path d="M5 15H4a2 2 0 01-2-2V4a2 2 0 012-2h9a2 2 0 012 2v1"/>
+                                        </svg>
+                                        Copy
+                                    </button>
+                                </div>
+                            </div>
+                            <pre class="output-pre" id="dashboard-output">Run a command to see output here...</pre>
+                        </div>
+                        <div id="dashboard-timestamp" class="timestamp"></div>
+                    </div>
+                </div>
+            </div>
+        </div>
+        <div class="page-sidebar">
+            <div class="glass-card">
+                <div class="commands-title">Dashboard Commands</div>
+                <div class="cmd-list" id="dashboard-cmd-list">
+                    <!-- Rendered by JavaScript from dashboardCommandSections -->
+                </div>
+            </div>
+        </div>
+    </div>
+</div>
+{{end}}
diff --git a/internal/ui/templates/pages/overview.gohtml b/internal/ui/templates/pages/overview.gohtml
index 70da1e3..49d59f4 100644
--- a/internal/ui/templates/pages/overview.gohtml
+++ b/internal/ui/templates/pages/overview.gohtml
@@ -64,7 +64,7 @@
             <h3 class="card-title">RESOURCES</h3>
             <div class="card-divider"></div>
             <div class="resources-list">
-                <a href="https://developer.nylas.com/docs" target="_blank" class="resource-item">
+                <a href="https://developer.nylas.com/" target="_blank" class="resource-item">
                     <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
                         <path d="M4 19.5A2.5 2.5 0 016.5 17H20"/>
                         <path d="M6.5 2H20v20H6.5A2.5 2.5 0 014 19.5v-15A2.5 2.5 0 016.5 2z"/>
@@ -74,14 +74,14 @@
                         <span class="resource-desc">API reference & guides</span>
                     </div>
                 </a>
-                <a href="https://developer.nylas.com/docs/v3" target="_blank" class="resource-item">
+                <a href="https://cli.nylas.com/docs/commands" target="_blank" class="resource-item">
                     <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
                         <polyline points="16 18 22 12 16 6"/>
                         <polyline points="8 6 2 12 8 18"/>
                     </svg>
                     <div class="resource-info">
-                        <span class="resource-title">API v3 Reference</span>
-                        <span class="resource-desc">Endpoints & schemas</span>
+                        <span class="resource-title">CLI Command Reference</span>
+                        <span class="resource-desc">Commands & flags</span>
                     </div>
                 </a>
                 <a href="https://github.com/nylas" target="_blank" class="resource-item">
diff --git a/internal/ui/templates/partials/content.gohtml b/internal/ui/templates/partials/content.gohtml
index 66831f8..1c96e68 100644
--- a/internal/ui/templates/partials/content.gohtml
+++ b/internal/ui/templates/partials/content.gohtml
@@ -92,6 +92,25 @@
                         </svg>
                         <span>Admin</span>
                     </button>
+                    <button class="nav-item" data-page="agent" onclick="switchPage('agent')">
+                        <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                            <circle cx="12" cy="12" r="3"/>
+                            <path d="M12 1v6m0 10v6m11-11h-6m-10 0H1"/>
+                            <path d="M19.07 4.93l-4.24 4.24m-5.66 5.66l-4.24 4.24"/>
+                            <path d="M19.07 19.07l-4.24-4.24m-5.66-5.66L4.93 4.93"/>
+                        </svg>
+                        <span>Agent</span>
+                    </button>
+                    <button class="nav-item" data-page="audit" onclick="switchPage('audit')">
+                        <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                            <path d="M14 2H6a2 2 0 00-2 2v16a2 2 0 002 2h12a2 2 0 002-2V8z"/>
+                            <polyline points="14 2 14 8 20 8"/>
+                            <line x1="9" y1="13" x2="15" y2="13"/>
+                            <line x1="9" y1="17" x2="15" y2="17"/>
+                            <line x1="9" y1="9" x2="11" y2="9"/>
+                        </svg>
+                        <span>Audit</span>
+                    </button>
                     <button class="nav-item" data-page="auth" onclick="switchPage('auth')">
                         <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
                             <path d="M20 21v-2a4 4 0 00-4-4H8a4 4 0 00-4 4v2"/>
@@ -117,6 +136,14 @@
                         </svg>
                         <span>Contacts</span>
                     </button>
+                    <button class="nav-item" data-page="dashboard" onclick="switchPage('dashboard')">
+                        <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                            <path d="M21 16V8a2 2 0 00-1-1.73l-7-4a2 2 0 00-2 0l-7 4A2 2 0 003 8v8a2 2 0 001 1.73l7 4a2 2 0 002 0l7-4A2 2 0 0021 16z"/>
+                            <polyline points="3.27 6.96 12 12.01 20.73 6.96"/>
+                            <line x1="12" y1="22.08" x2="12" y2="12"/>
+                        </svg>
+                        <span>Dashboard</span>
+                    </button>
                     <button class="nav-item" data-page="email" onclick="switchPage('email')">
                         <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
                             <path d="M4 4h16c1.1 0 2 .9 2 2v12c0 1.1-.9 2-2 2H4c-1.1 0-2-.9-2-2V6c0-1.1.9-2 2-2z"/>
@@ -173,9 +200,12 @@
         <div class="dashboard-content">
             {{template "page-overview" .}}
             {{template "page-admin" .}}
+            {{template "page-agent" .}}
+            {{template "page-audit" .}}
             {{template "page-auth" .}}
             {{template "page-calendar" .}}
             {{template "page-contacts" .}}
+            {{template "page-dashboard" .}}
             {{template "page-email" .}}
             {{template "page-notetaker" .}}
             {{template "page-otp" .}}
diff --git a/internal/ui/templates/partials/header.gohtml b/internal/ui/templates/partials/header.gohtml
index d576ff1..0bffa42 100644
--- a/internal/ui/templates/partials/header.gohtml
+++ b/internal/ui/templates/partials/header.gohtml
@@ -11,6 +11,7 @@
         <span class="brand-text">Nylas CLI</span>
     </div>
 
+    <div class="header-right">
     <div class="header-controls" id="header-controls" style="{{if not .Configured}}display: none;{{end}}">
         <!-- Client ID Dropdown -->
         <div class="dropdown" id="client-dropdown">
@@ -72,24 +73,25 @@
                 </button>
             </div>
         </div>
+    </div>
 
-        <!-- Theme Toggle -->
-        <button class="theme-btn" onclick="toggleTheme()" title="Toggle theme">
-            <svg class="moon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
-                <path d="M21 12.79A9 9 0 1111.21 3 7 7 0 0021 12.79z"/>
-            </svg>
-            <svg class="sun" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
-                <circle cx="12" cy="12" r="5"/>
-                <line x1="12" y1="1" x2="12" y2="3"/>
-                <line x1="12" y1="21" x2="12" y2="23"/>
-                <line x1="4.22" y1="4.22" x2="5.64" y2="5.64"/>
-                <line x1="18.36" y1="18.36" x2="19.78" y2="19.78"/>
-                <line x1="1" y1="12" x2="3" y2="12"/>
-                <line x1="21" y1="12" x2="23" y2="12"/>
-                <line x1="4.22" y1="19.78" x2="5.64" y2="18.36"/>
-                <line x1="18.36" y1="5.64" x2="19.78" y2="4.22"/>
-            </svg>
-        </button>
+    <!-- Theme Toggle (always available, regardless of configuration state) -->
+    <button class="theme-btn" onclick="toggleTheme()" title="Toggle theme" aria-label="Toggle theme">
+        <svg class="moon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+            <path d="M21 12.79A9 9 0 1111.21 3 7 7 0 0021 12.79z"/>
+        </svg>
+        <svg class="sun" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+            <circle cx="12" cy="12" r="5"/>
+            <line x1="12" y1="1" x2="12" y2="3"/>
+            <line x1="12" y1="21" x2="12" y2="23"/>
+            <line x1="4.22" y1="4.22" x2="5.64" y2="5.64"/>
+            <line x1="18.36" y1="18.36" x2="19.78" y2="19.78"/>
+            <line x1="1" y1="12" x2="3" y2="12"/>
+            <line x1="21" y1="12" x2="23" y2="12"/>
+            <line x1="4.22" y1="19.78" x2="5.64" y2="18.36"/>
+            <line x1="18.36" y1="5.64" x2="19.78" y2="4.22"/>
+        </svg>
+    </button>
     </div>
 </header>
 {{end}}
diff --git a/tests/air/e2e/archive-and-rsvp.spec.js b/tests/air/e2e/archive-and-rsvp.spec.js
new file mode 100644
index 0000000..24092cf
--- /dev/null
+++ b/tests/air/e2e/archive-and-rsvp.spec.js
@@ -0,0 +1,813 @@
+// @ts-check
+const { test, expect } = require('@playwright/test');
+
+/**
+ * Archive + RSVP E2E tests — pin two regressions:
+ *
+ * 1. Gmail Archive: must send `folders: []` (an explicit empty array)
+ *    over the wire. Earlier code elided the empty array via omitempty,
+ *    making "archive" a no-op upstream while the optimistic UI removed
+ *    the row.
+ *
+ * 2. RSVP: clicking Yes/Maybe/No must POST to /api/emails/{id}/rsvp
+ *    with the matching status, show the in-flight loading state, and
+ *    settle on the "active" highlight when the server confirms.
+ *
+ * The in-page parts of these tests (spying on AirAPI / window.fetch,
+ * reading EmailListManager state) live in `page.evaluate` because no
+ * Playwright locator can intercept a same-origin fetch — but every
+ * user-facing click goes through semantic locators (`getByRole`) and
+ * every assertion is on the test side, NOT inside `page.evaluate`.
+ *
+ * Semantic locators only — per CLAUDE.md, never CSS/XPath. The app
+ * shell exposes role="application" with aria-label "Nylas Air Email
+ * Client"; each email row exposes role="option" via email-renderer.js.
+ */
+test.describe('Archive + RSVP Integrations', () => {
+  test.beforeEach(async ({ page }) => {
+    await page.goto('/');
+    await expect(page.getByRole('application', { name: /Nylas Air/i })).toBeVisible();
+    await page.waitForLoadState('domcontentloaded');
+    // Wait for at least one email to render — beats arbitrary timeouts
+    // and surfaces "demo data didn't load" as an explicit failure.
+    await expect(page.getByRole('option').first()).toBeVisible({ timeout: 5000 });
+  });
+
+  test('archive on Gmail (no typed Archive folder) sends explicit empty folders array', async ({ page }) => {
+    // Sanity-check that the bundle is wired up. We deliberately avoid
+    // `if (skipped) return` here — a missing EmailListManager means the
+    // bundle is broken and the test SHOULD fail, not silently pass.
+    await expect.poll(
+      () => page.evaluate(() => typeof EmailListManager !== 'undefined' && Array.isArray(EmailListManager.emails)),
+      { timeout: 5000, message: 'EmailListManager bundle did not initialise' }
+    ).toBe(true);
+
+    // Pin Strategy 2 (Gmail label removal) explicitly. Real Gmail
+    // accounts surface "All Mail" as system_folder='all', NOT 'archive',
+    // so computeArchiveFolders falls through to dropping the INBOX
+    // label and the resulting payload is folders:[]. Seed a Gmail-style
+    // folder list directly rather than relying on the demo dataset,
+    // which intentionally exposes every system_folder type for UI
+    // exercise — including a typed Archive that would (correctly)
+    // make Strategy 1 fire.
+    //
+    // The previous bug here was on the Go side: omitempty elided the
+    // empty array on the wire, so the backend never received the
+    // archive change. That fix is pinned by the Go-side tests
+    // TestHTTPClient_UpdateMessage_ForwardsEmptyFolders and friends;
+    // this test pins the JS half — that the payload reaches the wire
+    // as exactly [] for a Gmail-shaped account.
+    const result = await page.evaluate(async () => {
+      const fakeEmail = { id: 'fake-gmail-archive-1', folders: ['INBOX'], unread: false, starred: false, subject: 'x', from: [], to: [] };
+      EmailListManager.emails = [fakeEmail, ...EmailListManager.emails];
+      EmailListManager.folders = [
+        { id: 'INBOX', system_folder: 'inbox', name: 'INBOX' },
+        { id: 'all-mail', system_folder: 'all', name: 'All Mail' },
+      ];
+
+      let capturedPayload = null;
+      const originalUpdate = AirAPI.updateEmail;
+      AirAPI.updateEmail = async (id, payload) => {
+        capturedPayload = payload;
+        return { status: 'success' };
+      };
+
+      try {
+        await EmailListManager.archiveEmail(fakeEmail.id);
+        return {
+          payload: capturedPayload,
+          wasRemoved: !EmailListManager.emails.find(e => e.id === fakeEmail.id),
+        };
+      } finally {
+        AirAPI.updateEmail = originalUpdate;
+      }
+    });
+
+    expect(result.payload).toBeDefined();
+    expect(result.payload).toHaveProperty('folders');
+    expect(result.payload.folders, 'Gmail archive must send an explicit empty array, not omit the key').toEqual([]);
+    expect(result.wasRemoved).toBe(true);
+  });
+
+  test('archive on Microsoft/IMAP/EWS uses the Archive folder ID (Strategy 2)', async ({ page }) => {
+    // Pin computeArchiveFolders' Strategy 2 — when the email is NOT in
+    // an INBOX label (Gmail-style) but the account has a typed Archive
+    // folder, archive replaces the email's folders with that one ID.
+    // Without coverage, a refactor that "simplifies" the helper could
+    // silently break archive on every non-Gmail provider.
+    const result = await page.evaluate(async () => {
+      // Manufacture a minimal non-Gmail email + folder shape directly on
+      // the manager. We avoid touching the demo dataset so the assertion
+      // is independent of provider classification heuristics.
+      const fakeEmail = { id: 'fake-ms-1', folders: ['some-other-folder-id'], unread: false, starred: false, subject: 'x', from: [], to: [] };
+      EmailListManager.emails = [fakeEmail, ...EmailListManager.emails];
+      EmailListManager.folders = [{ id: 'arch-id-1', system_folder: 'archive', name: 'Archive' }];
+
+      let captured = null;
+      const originalUpdate = AirAPI.updateEmail;
+      AirAPI.updateEmail = async (id, payload) => { captured = payload; return { status: 'success' }; };
+      try {
+        await EmailListManager.archiveEmail(fakeEmail.id);
+        return { payload: captured };
+      } finally {
+        AirAPI.updateEmail = originalUpdate;
+      }
+    });
+
+    expect(result.payload).toBeDefined();
+    expect(result.payload.folders, 'Strategy 2 must replace folders with the Archive folder id, not send empty')
+      .toEqual(['arch-id-1']);
+  });
+
+  test('archive on IMAP/EWS with folders:["INBOX"] + typed Archive uses the Archive folder, not folders:[]', async ({ page }) => {
+    // Regression: IMAP/EWS surfaces the inbox folder as the literal name
+    // "INBOX". The old computeArchiveFolders stripped INBOX before
+    // checking for a typed Archive folder, sending folders:[] upstream
+    // and moving the message out of every folder instead of into Archive.
+    // This pins the corrected order — typed Archive wins over label
+    // removal whenever a system_folder='archive' exists.
+    const result = await page.evaluate(async () => {
+      const fakeEmail = { id: 'fake-imap-1', folders: ['INBOX'], unread: false, starred: false, subject: 'x', from: [], to: [] };
+      EmailListManager.emails = [fakeEmail, ...EmailListManager.emails];
+      EmailListManager.folders = [
+        { id: 'inbox-id', system_folder: 'inbox', name: 'INBOX' },
+        { id: 'arch-imap-1', system_folder: 'archive', name: 'Archive' },
+      ];
+
+      let captured = null;
+      const originalUpdate = AirAPI.updateEmail;
+      AirAPI.updateEmail = async (id, payload) => { captured = payload; return { status: 'success' }; };
+      try {
+        await EmailListManager.archiveEmail(fakeEmail.id);
+        return { payload: captured };
+      } finally {
+        AirAPI.updateEmail = originalUpdate;
+      }
+    });
+
+    expect(result.payload).toBeDefined();
+    expect(result.payload.folders, 'IMAP/EWS archive must move into the typed Archive folder, not send folders:[]')
+      .toEqual(['arch-imap-1']);
+  });
+
+  test('archive does NOT mistake a Gmail user label named "Archive" for the system destination', async ({ page }) => {
+    // Pin the safety property of using system_folder match instead of
+    // name fallback: a Gmail account with a user-created label literally
+    // named "Archive" (system_folder unset) must still archive via
+    // Strategy 2 (drop INBOX), not move into the user's vanity label.
+    const result = await page.evaluate(async () => {
+      const fakeEmail = { id: 'fake-gmail-vanity-1', folders: ['INBOX', 'IMPORTANT'], unread: false, starred: false, subject: 'x', from: [], to: [] };
+      EmailListManager.emails = [fakeEmail, ...EmailListManager.emails];
+      // Gmail-style: only labels with empty system_folder. The user
+      // happens to have a label called "Archive" — must not be picked.
+      EmailListManager.folders = [
+        { id: 'label-inbox', system_folder: 'inbox', name: 'INBOX' },
+        { id: 'label-archive-vanity', system_folder: '', name: 'Archive' },
+      ];
+
+      let captured = null;
+      const originalUpdate = AirAPI.updateEmail;
+      AirAPI.updateEmail = async (id, payload) => { captured = payload; return { status: 'success' }; };
+      try {
+        await EmailListManager.archiveEmail(fakeEmail.id);
+        return { payload: captured };
+      } finally {
+        AirAPI.updateEmail = originalUpdate;
+      }
+    });
+
+    expect(result.payload).toBeDefined();
+    expect(result.payload.folders, 'Gmail label removal must drop only INBOX, leaving other labels intact')
+      .toEqual(['IMPORTANT']);
+  });
+
+  test('archive surfaces "no archive target" when no INBOX and no Archive folder', async ({ page }) => {
+    // Pin the null branch of computeArchiveFolders: if the email isn't
+    // in INBOX (Strategy 1 doesn't apply) AND no system Archive folder
+    // is known (Strategy 2 doesn't apply), archiveEmail must fail
+    // closed — show an error toast and return false. Without this, a
+    // misconfigured account would archive into the void.
+    const result = await page.evaluate(async () => {
+      const fakeEmail = { id: 'fake-no-target-1', folders: ['exotic-folder'], unread: false, starred: false, subject: 'x', from: [], to: [] };
+      EmailListManager.emails = [fakeEmail, ...EmailListManager.emails];
+      EmailListManager.folders = []; // no archive folder available
+
+      let updateCalled = false;
+      const originalUpdate = AirAPI.updateEmail;
+      AirAPI.updateEmail = async () => { updateCalled = true; return { status: 'success' }; };
+      try {
+        const ok = await EmailListManager.archiveEmail(fakeEmail.id);
+        return {
+          ok,
+          updateCalled,
+          stillInList: !!EmailListManager.emails.find(e => e.id === fakeEmail.id),
+        };
+      } finally {
+        AirAPI.updateEmail = originalUpdate;
+      }
+    });
+
+    expect(result.ok, 'archiveEmail must return false when no archive target exists').toBe(false);
+    expect(result.updateCalled, 'AirAPI.updateEmail must NOT be called — fail closed').toBe(false);
+    expect(result.stillInList, 'email must remain in the list when archive is unavailable').toBe(true);
+  });
+
+  test('clicking RSVP Yes calls POST /rsvp with status=yes and highlights the button', async ({ page }) => {
+    // Select the demo invite email through the API surface so the test
+    // doesn't depend on the email list's exact ordering.
+    await page.evaluate(async () => EmailListManager.selectEmail('demo-email-invite-001'));
+
+    const inviteCard = page.getByRole('region', { name: 'Calendar invitation' });
+    await expect(inviteCard, 'invite card must render after selecting the demo invite').toBeVisible({ timeout: 3000 });
+
+    const yesButton = inviteCard.getByRole('button', { name: 'Yes' });
+    await expect(yesButton).toBeVisible();
+    await expect(yesButton).toBeEnabled();
+
+    // Install fetch spy in the page context — Playwright's request
+    // interception runs in a different process and can't intercept
+    // same-origin fetches reliably for SPAs.
+    await page.evaluate(() => {
+      window.__rsvpCall = null;
+      window.__originalFetch = window.fetch;
+      window.fetch = async (url, init) => {
+        if (typeof url === 'string' && url.includes('/rsvp') && init?.method === 'POST') {
+          window.__rsvpCall = { url, body: JSON.parse(init.body) };
+          return new Response(JSON.stringify({ status: 'yes', event_id: 'evt-1', calendar_id: 'cal-1' }), {
+            status: 200,
+            headers: { 'Content-Type': 'application/json' },
+          });
+        }
+        return window.__originalFetch(url, init);
+      };
+    });
+
+    try {
+      await yesButton.click();
+
+      // Wait for the active class to appear via Playwright's auto-retry.
+      await expect(yesButton).toHaveClass(/active/);
+      // The is-loading class is added during flight and removed when
+      // the request settles. After click + auto-retry above, it should
+      // be gone — pin both halves of the contract.
+      await expect(yesButton).not.toHaveClass(/is-loading/);
+
+      const rsvpCall = await page.evaluate(() => window.__rsvpCall);
+      expect(rsvpCall, 'fetch was never invoked — click did not route through the RSVP handler').not.toBeNull();
+      expect(rsvpCall.url).toContain('/api/emails/demo-email-invite-001/rsvp');
+      expect(rsvpCall.body.status).toBe('yes');
+    } finally {
+      await page.evaluate(() => { window.fetch = window.__originalFetch; });
+    }
+  });
+
+  test('RSVP button shows loading + disabled state while in flight', async ({ page }) => {
+    await page.evaluate(async () => EmailListManager.selectEmail('demo-email-invite-001'));
+    const inviteCard = page.getByRole('region', { name: 'Calendar invitation' });
+    await expect(inviteCard).toBeVisible({ timeout: 3000 });
+
+    // Install a hanging fetch spy so we can observe the in-flight UI
+    // state without a race. Resume the fetch from the test side once
+    // we've snapshotted the loading classes.
+    await page.evaluate(() => {
+      window.__resolveFetch = null;
+      window.__originalFetch = window.fetch;
+      window.fetch = (url, init) => {
+        if (typeof url === 'string' && url.includes('/rsvp')) {
+          return new Promise((resolve) => {
+            window.__resolveFetch = () => resolve(new Response(
+              JSON.stringify({ status: 'yes' }),
+              { status: 200, headers: { 'Content-Type': 'application/json' } }
+            ));
+          });
+        }
+        return window.__originalFetch(url, init);
+      };
+    });
+
+    try {
+      const yesButton = inviteCard.getByRole('button', { name: 'Yes' });
+      await yesButton.click();
+
+      // While the fetch is hanging, the button must be disabled and
+      // class-loaded. expect(...).toHaveClass auto-retries up to the
+      // default timeout, so this catches the in-flight state without
+      // fragile setTimeouts.
+      await expect(yesButton).toBeDisabled();
+      await expect(yesButton).toHaveClass(/is-loading/);
+
+      // Resume the fetch and verify the loading state goes away.
+      await page.evaluate(() => window.__resolveFetch && window.__resolveFetch());
+      await expect(yesButton).not.toHaveClass(/is-loading/);
+      await expect(yesButton).toBeEnabled();
+    } finally {
+      await page.evaluate(() => { window.fetch = window.__originalFetch; });
+    }
+  });
+
+  test('RSVP failure restores prior selection and surfaces an error toast', async ({ page }) => {
+    await page.evaluate(async () => EmailListManager.selectEmail('demo-email-invite-001'));
+    const inviteCard = page.getByRole('region', { name: 'Calendar invitation' });
+    await expect(inviteCard).toBeVisible({ timeout: 3000 });
+
+    await page.evaluate(() => {
+      window.__originalFetch = window.fetch;
+      window.fetch = async (url) => {
+        if (typeof url === 'string' && url.includes('/rsvp')) {
+          return new Response(JSON.stringify({ error: 'event not imported' }), {
+            status: 404,
+            headers: { 'Content-Type': 'application/json' },
+          });
+        }
+        return window.__originalFetch(url);
+      };
+    });
+
+    try {
+      const yesButton = inviteCard.getByRole('button', { name: 'Yes' });
+      await yesButton.click();
+
+      // On failure, the button should NOT be left "active" — that
+      // would lie to the user about the server state.
+      await expect(yesButton).not.toHaveClass(/active/);
+      await expect(yesButton).not.toHaveClass(/is-loading/);
+      await expect(yesButton).toBeEnabled();
+    } finally {
+      await page.evaluate(() => { window.fetch = window.__originalFetch; });
+    }
+  });
+
+  test('RSVP network failure (fetch throws) restores prior selection without active class', async ({ page }) => {
+    // Pin the catch-block path: fetch rejects with a network error
+    // (vs returning !response.ok). The previous tests cover the
+    // !resp.ok branch; this one targets the `catch (err)` block where
+    // previouslyActive is re-applied. Without this test a future
+    // refactor that reorders the catch could silently break the
+    // "no connectivity → restore prior selection" UX.
+    await page.evaluate(async () => EmailListManager.selectEmail('demo-email-invite-001'));
+    const inviteCard = page.getByRole('region', { name: 'Calendar invitation' });
+    await expect(inviteCard).toBeVisible({ timeout: 3000 });
+
+    // Pre-mark Maybe as the prior selection so we can verify the
+    // catch block restores it (rather than leaving the chosen Yes
+    // button active in error).
+    const maybeButton = inviteCard.getByRole('button', { name: 'Maybe' });
+    await page.evaluate(() => {
+      const slot = document.querySelector('[id^="inviteSlot-"]');
+      const buttons = slot ? slot.querySelectorAll('.calendar-invite-btn') : [];
+      buttons.forEach((b) => {
+        b.classList.toggle('active', b.dataset.rsvp === 'maybe');
+      });
+    });
+    await expect(maybeButton).toHaveClass(/active/);
+
+    await page.evaluate(() => {
+      window.__originalFetch = window.fetch;
+      window.fetch = async (url) => {
+        if (typeof url === 'string' && url.includes('/rsvp')) {
+          // Reject with a TypeError, mirroring how browsers report
+          // "fetch failed" on connectivity loss / DNS failure.
+          throw new TypeError('Failed to fetch');
+        }
+        return window.__originalFetch(url);
+      };
+    });
+
+    try {
+      const yesButton = inviteCard.getByRole('button', { name: 'Yes' });
+      await yesButton.click();
+
+      // Yes must not be marked active after a network error.
+      await expect(yesButton).not.toHaveClass(/active/);
+      // The previously-active button (Maybe) must be restored.
+      await expect(maybeButton).toHaveClass(/active/);
+      // Both buttons should be re-enabled and not in the loading
+      // state, regardless of which one was clicked.
+      await expect(yesButton).toBeEnabled();
+      await expect(yesButton).not.toHaveClass(/is-loading/);
+      await expect(maybeButton).toBeEnabled();
+    } finally {
+      await page.evaluate(() => { window.fetch = window.__originalFetch; });
+    }
+  });
+
+  test('RSVP navigated-away guard skips active-class toggle on the new email', async ({ page }) => {
+    // Pin the `this.selectedEmailId === emailId` guard inside
+    // rsvpToInvite. Sequence:
+    //   1) Select invite email A, click RSVP Yes (fetch hangs)
+    //   2) Mid-flight, switch to a different email B
+    //   3) Resolve the fetch
+    // The guard must prevent the active class from being applied to
+    // the (no-longer-visible) invite card on email A. Without the
+    // guard, returning to A later would show a stale "active" Yes.
+    await page.evaluate(async () => EmailListManager.selectEmail('demo-email-invite-001'));
+    const inviteCard = page.getByRole('region', { name: 'Calendar invitation' });
+    await expect(inviteCard).toBeVisible({ timeout: 3000 });
+
+    await page.evaluate(() => {
+      window.__resolveFetch = null;
+      window.__originalFetch = window.fetch;
+      window.fetch = (url) => {
+        if (typeof url === 'string' && url.includes('/rsvp')) {
+          return new Promise((resolve) => {
+            window.__resolveFetch = () => resolve(new Response(
+              JSON.stringify({ status: 'yes', event_id: 'evt-1', calendar_id: 'cal-1' }),
+              { status: 200, headers: { 'Content-Type': 'application/json' } }
+            ));
+          });
+        }
+        return window.__originalFetch(url);
+      };
+    });
+
+    try {
+      const yesButton = inviteCard.getByRole('button', { name: 'Yes' });
+      // Don't await — we need the request to be in flight when we
+      // navigate away.
+      void yesButton.click();
+
+      // Wait for the loading class to confirm the request is in flight.
+      await expect(yesButton).toHaveClass(/is-loading/);
+
+      // Navigate to a different email while the RSVP is hanging.
+      const otherEmail = await page.evaluate(() => {
+        const other = EmailListManager.emails.find((e) => e.id !== 'demo-email-invite-001');
+        return other ? other.id : null;
+      });
+      expect(otherEmail, 'demo dataset must contain at least one non-invite email').not.toBeNull();
+      await page.evaluate((id) => EmailListManager.selectEmail(id), otherEmail);
+
+      // Now resolve the fetch. The guard must prevent the active
+      // class from being applied to the original invite card.
+      await page.evaluate(() => window.__resolveFetch && window.__resolveFetch());
+
+      // Switch back to the invite email and verify Yes is NOT active.
+      await page.evaluate(async () => EmailListManager.selectEmail('demo-email-invite-001'));
+      const reselected = page.getByRole('region', { name: 'Calendar invitation' });
+      await expect(reselected).toBeVisible({ timeout: 3000 });
+      const reselectedYes = reselected.getByRole('button', { name: 'Yes' });
+      await expect(reselectedYes, 'navigated-away guard must NOT mark Yes active on the original card').not.toHaveClass(/active/);
+    } finally {
+      await page.evaluate(() => { window.fetch = window.__originalFetch; });
+    }
+  });
+
+  test('archive Undo: "Restore unavailable" toast when original had no folders', async ({ page }) => {
+    // Pin the archive-Undo defensive branch: if the email started
+    // with folders:[] (rare — drafts/sent paths), we cannot restore
+    // it via PUT folders:[...] without a meaningful target. The Undo
+    // callback must short-circuit with an error toast rather than
+    // making a no-op or, worse, an empty-folders PUT that would land
+    // the email unfiled.
+    const result = await page.evaluate(async () => {
+      // Manufacture a fake email with empty folders so we control the
+      // archive-state shape without depending on the demo dataset.
+      const fake = {
+        id: 'fake-empty-folders-1',
+        folders: [],
+        unread: false,
+        starred: false,
+        subject: 'Empty folders',
+        from: [],
+        to: [],
+      };
+      EmailListManager.emails = [fake, ...EmailListManager.emails];
+      // Provide a system Archive folder so Strategy 2 succeeds during
+      // the initial archive (the regression we're testing is the
+      // Undo path, not the archive path).
+      EmailListManager.folders = [{ id: 'arch-id-1', system_folder: 'archive', name: 'Archive' }];
+
+      const captured = { toasts: [], updateCalls: 0 };
+      const originalUpdate = AirAPI.updateEmail;
+      const originalToast = window.showToast;
+      AirAPI.updateEmail = async () => {
+        captured.updateCalls++;
+        return { status: 'success' };
+      };
+      window.showToast = (type, title, msg, opts) => {
+        captured.toasts.push({ type, title, msg });
+        // Synchronously fire the Undo action so the test can observe
+        // the resulting toast without timing dance. We deliberately
+        // capture only the toast events; the action itself goes
+        // through the real callback.
+        if (opts && typeof opts.onAction === 'function' && title === 'Archived') {
+          // Fire the undo action — this is what the user clicking
+          // "Undo" would trigger.
+          opts.onAction();
+        }
+      };
+      try {
+        await EmailListManager.archiveEmail(fake.id);
+        // Wait one microtask tick so the Undo's async toast lands.
+        await new Promise((r) => setTimeout(r, 0));
+        return captured;
+      } finally {
+        AirAPI.updateEmail = originalUpdate;
+        window.showToast = originalToast;
+      }
+    });
+
+    // First call is the archive PUT; no Undo PUT should fire because
+    // the original folders array was empty.
+    expect(result.updateCalls, 'only the initial archive should call updateEmail; Undo must short-circuit').toBe(1);
+    const restoreToast = result.toasts.find((t) => t.title === 'Restore unavailable');
+    expect(restoreToast, 'Undo with empty original folders must surface "Restore unavailable"').toBeDefined();
+    expect(restoreToast.type).toBe('error');
+  });
+
+  test('archive Undo: "Restore failed" toast when restore PUT throws', async ({ page }) => {
+    // Pin the archive-Undo error path: the initial archive PUT
+    // succeeds, but the user clicks Undo and the restore PUT fails.
+    // Without surfacing "Restore failed", the user thinks the email
+    // is back in the inbox while it is still archived on the server.
+    const result = await page.evaluate(async () => {
+      const inbox = EmailListManager.emails.find((e) =>
+        (e.folders || []).includes('inbox') &&
+        !(e.folders || []).includes('archive')
+      );
+      if (!inbox) return { error: 'no inbox-only demo email available' };
+
+      const captured = { toasts: [], updateCalls: 0, restoreThrew: false };
+      const originalUpdate = AirAPI.updateEmail;
+      const originalToast = window.showToast;
+      AirAPI.updateEmail = async (id, payload) => {
+        captured.updateCalls++;
+        // First call (archive) succeeds; second call (Undo restore)
+        // must throw to exercise the error branch.
+        if (captured.updateCalls === 1) return { status: 'success' };
+        captured.restoreThrew = true;
+        throw new Error('simulated 503 on restore');
+      };
+      window.showToast = (type, title, msg, opts) => {
+        captured.toasts.push({ type, title, msg });
+        if (opts && typeof opts.onAction === 'function' && title === 'Archived') {
+          opts.onAction();
+        }
+      };
+      try {
+        await EmailListManager.archiveEmail(inbox.id);
+        await new Promise((r) => setTimeout(r, 0));
+        return captured;
+      } finally {
+        AirAPI.updateEmail = originalUpdate;
+        window.showToast = originalToast;
+      }
+    });
+
+    expect(result.error, `setup failed: ${result.error}`).toBeUndefined();
+    expect(result.updateCalls, 'archive + restore = 2 PUTs').toBe(2);
+    expect(result.restoreThrew, 'restore branch must have been invoked').toBe(true);
+    const failed = result.toasts.find((t) => t.title === 'Restore failed');
+    expect(failed, 'Undo restore failure must surface "Restore failed"').toBeDefined();
+    expect(failed.type).toBe('error');
+    // Crucially, the success toast for "Restored" must NOT fire on
+    // a failed restore — that would lie to the user.
+    const restoredOK = result.toasts.find((t) => t.title === 'Restored');
+    expect(restoredOK, 'must NOT announce "Restored" when the PUT failed').toBeUndefined();
+  });
+
+  test('archive success: detail pane transitions to empty state when archived email was selected', async ({ page }) => {
+    // Pin the success-path counterpart to "archive failure restores
+    // selection AND repopulates the detail pane". When archiveEmail
+    // succeeds AND the email being archived was the currently
+    // selected one, the detail pane MUST flip to the empty state —
+    // otherwise the user sees stale content for an email that no
+    // longer exists in the list. The failure case has its own test
+    // (line ~306); this is the missing positive.
+    await expect.poll(
+      () => page.evaluate(() => typeof EmailListManager !== 'undefined' && Array.isArray(EmailListManager.emails)),
+      { timeout: 5000, message: 'EmailListManager bundle did not initialise' }
+    ).toBe(true);
+
+    // Select an inbox-only email and confirm the detail pane is
+    // populated (i.e., NOT showing the empty state) before we
+    // archive. Anchoring on the empty-state copy directly is more
+    // robust than checking class names that change between layouts.
+    const setup = await page.evaluate(async () => {
+      const email = EmailListManager.emails.find((e) =>
+        (e.folders || []).includes('inbox') &&
+        !(e.folders || []).includes('archive')
+      );
+      if (!email) return { error: 'no inbox-only demo email available' };
+      await EmailListManager.selectEmail(email.id);
+      return { emailId: email.id };
+    });
+    expect(setup.error, `setup failed: ${setup.error}`).toBeUndefined();
+
+    // Pre-condition: detail pane shows the email, NOT the empty state.
+    await expect(
+      page.getByText('Select an email to view'),
+      'detail pane must be populated before we archive',
+    ).not.toBeVisible();
+
+    // Stub a successful archive so we exercise the success branch
+    // deterministically (the demo backend would also succeed, but
+    // we want to also assert the AirAPI payload along the way).
+    const archive = await page.evaluate(async (emailId) => {
+      const originalUpdate = AirAPI.updateEmail;
+      let capturedPayload = null;
+      AirAPI.updateEmail = async (_id, payload) => {
+        capturedPayload = payload;
+        return { status: 'success' };
+      };
+      try {
+        const ok = await EmailListManager.archiveEmail(emailId);
+        return {
+          ok,
+          payload: capturedPayload,
+          stillInList: !!EmailListManager.emails.find((e) => e.id === emailId),
+          // Read selectedEmailId AFTER archive — the success path
+          // sets it to null when the archived email was selected.
+          selectionCleared: EmailListManager.selectedEmailId === null,
+        };
+      } finally {
+        AirAPI.updateEmail = originalUpdate;
+      }
+    }, setup.emailId);
+
+    expect(archive.ok, 'archiveEmail success-path return value').toBe(true);
+    expect(archive.payload, 'archive PUT must include the new folders array').toBeDefined();
+    expect(archive.stillInList, 'archived email must be removed from the list').toBe(false);
+    expect(archive.selectionCleared, 'selectedEmailId must be cleared so the pane transitions out').toBe(true);
+
+    // Detail pane MUST flip to the empty state. Using getByText keeps
+    // us in semantic-locator territory and benefits from Playwright's
+    // auto-retry, replacing any class-based assertion that could
+    // shift with a future layout refactor.
+    await expect(
+      page.getByText('Select an email to view'),
+      'detail pane MUST show the empty state after archive succeeds on the selected email',
+    ).toBeVisible();
+  });
+
+  test('loadEmails returns 3-state outcome (loaded / in-progress / failed)', async ({ page }) => {
+    // Pin the contract change behind the pull-to-refresh "Refresh failed"
+    // false-alarm fix: the previous boolean conflated "skipped because
+    // already loading" with "fetch failed", so a second pull during an
+    // in-flight load showed an error toast even though no fetch failed.
+    await expect.poll(
+      () => page.evaluate(() => typeof EmailListManager !== 'undefined' && typeof EmailListManager.loadEmails === 'function'),
+      { timeout: 5000, message: 'EmailListManager bundle did not initialise' }
+    ).toBe(true);
+
+    const result = await page.evaluate(async () => {
+      const outcomes = {};
+      const originalGet = AirAPI.getEmails;
+
+      // 1) in-progress: another load is already running.
+      EmailListManager.isLoading = true;
+      outcomes.duringConcurrent = await EmailListManager.loadEmails();
+      EmailListManager.isLoading = false;
+
+      // 2) failed: the API throws.
+      AirAPI.getEmails = async () => { throw new Error('simulated network failure'); };
+      outcomes.onError = await EmailListManager.loadEmails();
+
+      // 3) loaded: the API returns data.
+      AirAPI.getEmails = async () => ({ emails: [], next_cursor: null, has_more: false });
+      outcomes.onSuccess = await EmailListManager.loadEmails();
+
+      AirAPI.getEmails = originalGet;
+      return outcomes;
+    });
+
+    expect(result.duringConcurrent, 'concurrent load must NOT be reported as a failure').toBe('in-progress');
+    expect(result.onError).toBe('failed');
+    expect(result.onSuccess).toBe('loaded');
+  });
+
+  test('archive failure restores selection AND repopulates the detail pane', async ({ page }) => {
+    // Pin the regression where archive rollback restored `this.emails`
+    // but left `selectedEmailId === null` and the detail pane showing
+    // the empty state — list and preview drifted out of sync.
+    await expect.poll(
+      () => page.evaluate(() => typeof EmailListManager !== 'undefined' && Array.isArray(EmailListManager.emails)),
+      { timeout: 5000 }
+    ).toBe(true);
+
+    const setup = await page.evaluate(async () => {
+      const email = EmailListManager.emails.find(e =>
+        (e.folders || []).includes('inbox') &&
+        !(e.folders || []).includes('archive')
+      );
+      if (!email) return { error: 'no inbox-only demo email available' };
+
+      // Select the email so the detail pane is populated.
+      await EmailListManager.selectEmail(email.id);
+      return { emailId: email.id };
+    });
+    expect(setup.error, `setup failed: ${setup.error}`).toBeUndefined();
+
+    // Stub AirAPI.updateEmail to fail; trigger the rollback path. Use
+    // evaluate so the spy lives in the page context where the click
+    // handler runs. We return only application state from the spy and
+    // assert on the user-visible UI via Playwright locators below.
+    const rollback = await page.evaluate(async (emailId) => {
+      const originalUpdate = AirAPI.updateEmail;
+      AirAPI.updateEmail = async () => { throw new Error('simulated 503'); };
+      try {
+        await EmailListManager.archiveEmail(emailId);
+        return {
+            stillInList: !!EmailListManager.emails.find(e => e.id === emailId),
+            isSelected: EmailListManager.selectedEmailId === emailId,
+        };
+      } finally {
+        AirAPI.updateEmail = originalUpdate;
+      }
+    }, setup.emailId);
+
+    expect(rollback.stillInList, 'rollback must put the email back in the list').toBe(true);
+    expect(rollback.isSelected, 'selectedEmailId must be restored after rollback').toBe(true);
+
+    // Detail pane must NOT show the "Select an email to view" empty
+    // state. Using getByText keeps us in semantic-locator territory and
+    // benefits from Playwright's auto-retry, replacing the
+    // detail.querySelector('.empty-state') CSS lookup.
+    await expect(
+      page.getByText('Select an email to view'),
+      'detail pane must NOT be left at the empty state',
+    ).not.toBeVisible();
+  });
+
+  test('keyboard Delete announces "Email deleted" only on success, "Delete failed" on rollback', async ({ page }) => {
+    // Pin the screen-reader regression: the previous code fired
+    // announce('Email deleted') synchronously, even when the underlying
+    // fetch failed and the email was rolled back into the list.
+    await expect.poll(
+      () => page.evaluate(() => typeof EmailListManager !== 'undefined' && Array.isArray(EmailListManager.emails)),
+      { timeout: 5000 }
+    ).toBe(true);
+
+    // The screen-reader announcer is a single live region near the top
+    // of base.gohtml with role="status" and id="announcer". We address
+    // it via the role; falling back to the id-based locator only if a
+    // future refactor moves it. Both forms are stable — class names are
+    // not.
+    // The announcer is a single live region near the top of base.gohtml.
+    // Use getByTestId rather than role='status' because the toast
+    // container also has role='status' (so screen readers pick toasts up
+    // too) — testid keeps us pinned to the announcer specifically.
+    const announcer = page.getByTestId('announcer');
+
+    // dispatchKeydown fires a synthetic Delete on the first row's
+    // containing list. We use evaluate for the actual dispatch because
+    // KeyboardEvent isn't reachable through Playwright's keyboard API
+    // when the focus target is inside an SPA-managed widget, but every
+    // assertion that follows is on the test side.
+    async function pressDeleteOnFirstEmail() {
+      return page.evaluate(() => {
+        const email = EmailListManager.emails[0];
+        if (!email) return { error: 'no demo emails available' };
+        const row = document.querySelector(`[data-email-id="${email.id}"]`);
+        if (!row) return { error: 'no list row for first email' };
+        row.classList.add('focused');
+        row.focus();
+        const list = row.closest('[data-testid="email-list"]') || row.parentElement;
+        list.dispatchEvent(new KeyboardEvent('keydown', { key: 'Delete', bubbles: true }));
+        return { ok: true };
+      });
+    }
+
+    // ============== Success path ==============
+    await page.evaluate(() => {
+      window.__originalDel = AirAPI.deleteEmail;
+      AirAPI.deleteEmail = async () => ({ success: true });
+    });
+    try {
+      const success = await pressDeleteOnFirstEmail();
+      expect(success.error).toBeUndefined();
+      // expect.poll auto-retries up to the default timeout — replaces
+      // the brittle 250 ms setTimeout while still waiting for both the
+      // deleteEmail await AND the announce setTimeout to fire.
+      await expect.poll(
+        () => announcer.textContent(),
+        { timeout: 2000, message: 'announcer must say "Email deleted" on success' }
+      ).toContain('Email deleted');
+    } finally {
+      await page.evaluate(() => { AirAPI.deleteEmail = window.__originalDel; });
+    }
+
+    // Reload to reset list state cleanly between phases.
+    await page.reload();
+    await expect(page.getByRole('option').first()).toBeVisible({ timeout: 5000 });
+
+    // ============== Failure path ==============
+    await page.evaluate(() => {
+      window.__originalDel = AirAPI.deleteEmail;
+      AirAPI.deleteEmail = async () => { throw new Error('simulated 5xx'); };
+    });
+    try {
+      const failure = await pressDeleteOnFirstEmail();
+      expect(failure.error).toBeUndefined();
+      const announcer2 = page.getByTestId('announcer');
+      await expect.poll(
+        () => announcer2.textContent(),
+        { timeout: 2000, message: 'announcer must say "Delete failed" on rollback' }
+      ).toContain('Delete failed');
+      expect(await announcer2.textContent(), 'must NOT announce success on rollback')
+        .not.toContain('Email deleted');
+    } finally {
+      await page.evaluate(() => { AirAPI.deleteEmail = window.__originalDel; });
+    }
+  });
+});
diff --git a/tests/air/e2e/folders-and-invite.spec.js b/tests/air/e2e/folders-and-invite.spec.js
index 9e5732d..0211558 100644
--- a/tests/air/e2e/folders-and-invite.spec.js
+++ b/tests/air/e2e/folders-and-invite.spec.js
@@ -229,7 +229,10 @@ test.describe('Folders + calendar invite — Air', () => {
       window.__inviteXss = false;
       // Try injecting via a synthetic invite render.
       const slot = document.getElementById('inviteSlot-demo-email-invite-001');
-      const html = EmailListManager.renderCalendarInviteCard(
+      // buildCalendarInviteCard returns a DOM node (HTMLElement) — see
+      // email-selection.js. We mount it directly via replaceChildren so
+      // there is no HTML-string surface for hostile fields to land in.
+      const cardNode = EmailListManager.buildCalendarInviteCard(
         {
           has_invite: true,
           title: '<img src=x onerror="window.__inviteXss=true">Hi',
@@ -242,8 +245,7 @@ test.describe('Folders + calendar invite — Air', () => {
         },
         'demo-email-invite-001',
       );
-      slot.replaceChildren();
-      slot.insertAdjacentHTML('beforeend', html);
+      slot.replaceChildren(cardNode);
 
       // Click Yes.
       const yesBtn = slot.querySelector('[data-rsvp="yes"]');
@@ -325,12 +327,15 @@ test.describe('Folders + calendar invite — Air', () => {
   // cancellation banner. Test renders a synthetic card directly so we
   // exercise the conditional UI without needing a real cancelled demo
   // email.
-  test('renderCalendarInviteCard: METHOD=CANCEL replaces RSVP buttons with banner', async ({ page }) => {
+  test('buildCalendarInviteCard: METHOD=CANCEL replaces RSVP buttons with banner', async ({ page }) => {
     const result = await page.evaluate(() => {
       if (typeof EmailListManager === 'undefined' || !EmailListManager) {
         return { skipped: true };
       }
-      const html = EmailListManager.renderCalendarInviteCard(
+      // buildCalendarInviteCard returns a DOM node — query it directly.
+      // No DOMParser dance needed: the node is detached but fully
+      // queryable, and it's never serialised to/from HTML.
+      const node = EmailListManager.buildCalendarInviteCard(
         {
           has_invite: true,
           title: 'Quarterly Sync',
@@ -341,15 +346,12 @@ test.describe('Folders + calendar invite — Air', () => {
         'cancelled-test-id',
       );
 
-      // Parse via DOMParser so we never assign untrusted strings to
-      // innerHTML — even in test code, that's the codebase rule.
-      const doc = new DOMParser().parseFromString(html, 'text/html');
       return {
         skipped: false,
-        hasBanner: !!doc.querySelector('.calendar-invite-banner-cancel'),
-        bannerText: doc.querySelector('.calendar-invite-banner-cancel')?.textContent?.trim(),
-        rsvpButtonCount: doc.querySelectorAll('.calendar-invite-btn').length,
-        cardHasCancelClass: doc.querySelector('.calendar-invite-card.is-cancelled') !== null,
+        hasBanner: !!node.querySelector('.calendar-invite-banner-cancel'),
+        bannerText: node.querySelector('.calendar-invite-banner-cancel')?.textContent?.trim(),
+        rsvpButtonCount: node.querySelectorAll('.calendar-invite-btn').length,
+        cardHasCancelClass: node.classList.contains('is-cancelled'),
       };
     });
 
diff --git a/tests/shared/helpers/ui-selectors.js b/tests/shared/helpers/ui-selectors.js
index 1c70c2d..d7cc867 100644
--- a/tests/shared/helpers/ui-selectors.js
+++ b/tests/shared/helpers/ui-selectors.js
@@ -74,6 +74,9 @@ exports.nav = {
   scheduler: '[data-page="scheduler"]',
   timezone: '[data-page="timezone"]',
   webhook: '[data-page="webhook"]',
+  agent: '[data-page="agent"]',
+  audit: '[data-page="audit"]',
+  dashboardCmd: '[data-page="dashboard"]',
 };
 
 // Pages
@@ -89,6 +92,9 @@ exports.pages = {
   scheduler: '#page-scheduler',
   timezone: '#page-timezone',
   webhook: '#page-webhook',
+  agent: '#page-agent',
+  audit: '#page-audit',
+  dashboardCmd: '#page-dashboard',
   activePage: '.page.active',
 };
 
diff --git a/tests/ui/e2e/keyboard.spec.js b/tests/ui/e2e/keyboard.spec.js
index 05bcbf8..02c97a1 100644
--- a/tests/ui/e2e/keyboard.spec.js
+++ b/tests/ui/e2e/keyboard.spec.js
@@ -376,11 +376,17 @@ test.describe('Form Keyboard Navigation', () => {
 
     await expect(apiKeyInput).toBeFocused();
 
-    // Tab to region select
-    await page.keyboard.press('Tab');
-    await page.waitForTimeout(100);
-
+    // The setup form has a "show password" toggle button between the API key
+    // input and the region select, so tab past it to reach the region select.
     const regionSelect = page.locator(selectors.setup.regionSelect);
+    for (let i = 0; i < 5; i++) {
+      if (await regionSelect.evaluate((el) => el === document.activeElement)) {
+        break;
+      }
+      await page.keyboard.press('Tab');
+      await page.waitForTimeout(50);
+    }
+
     await expect(regionSelect).toBeFocused();
   });
 });
diff --git a/tests/ui/e2e/overview-page.spec.js b/tests/ui/e2e/overview-page.spec.js
index b0da6ee..7f7d243 100644
--- a/tests/ui/e2e/overview-page.spec.js
+++ b/tests/ui/e2e/overview-page.spec.js
@@ -197,15 +197,15 @@ test.describe('Resources Card', () => {
 
     const docLink = page.getByRole('link', { name: /Documentation/i });
     await expect(docLink).toBeVisible();
-    await expect(docLink).toHaveAttribute('href', 'https://developer.nylas.com/docs');
+    await expect(docLink).toHaveAttribute('href', 'https://developer.nylas.com/');
   });
 
-  test('API v3 Reference link is present', async ({ page }, testInfo) => {
+  test('CLI Command Reference link is present', async ({ page }, testInfo) => {
     await skipIfNotConfigured(page, testInfo);
 
-    const apiLink = page.getByRole('link', { name: /API v3 Reference/i });
+    const apiLink = page.getByRole('link', { name: /CLI Command Reference/i });
     await expect(apiLink).toBeVisible();
-    await expect(apiLink).toHaveAttribute('href', 'https://developer.nylas.com/docs/v3');
+    await expect(apiLink).toHaveAttribute('href', 'https://cli.nylas.com/docs/commands');
   });
 
   test('GitHub link is present', async ({ page }, testInfo) => {
@@ -229,7 +229,7 @@ test.describe('Resources Card', () => {
 
     // Check for descriptions
     await expect(page.getByText('API reference & guides')).toBeVisible();
-    await expect(page.getByText('Endpoints & schemas')).toBeVisible();
+    await expect(page.getByText('Commands & flags')).toBeVisible();
     await expect(page.getByText('SDKs & examples')).toBeVisible();
     await expect(page.getByText('Get help from our team')).toBeVisible();
   });
@@ -348,7 +348,7 @@ test.describe('Overview Page Responsiveness', () => {
 
     // Overview should still be visible
     await expect(page.locator(selectors.pages.overview)).toBeVisible();
-    await expect(page.getByText('Dashboard')).toBeVisible();
+    await expect(page.getByRole('heading', { name: 'Dashboard' })).toBeVisible();
   });
 
   test('overview page is visible on tablet viewport', async ({ page }, testInfo) => {
@@ -360,6 +360,6 @@ test.describe('Overview Page Responsiveness', () => {
 
     // Overview should still be visible
     await expect(page.locator(selectors.pages.overview)).toBeVisible();
-    await expect(page.getByText('Dashboard')).toBeVisible();
+    await expect(page.getByRole('heading', { name: 'Dashboard' })).toBeVisible();
   });
 });