Ahmed Messenger 0.1.1-preview

A small Windows PowerShell 5.1 desktop inbox for Ahmed's existing private mailbox.
No npm install, EWS publication, account database, new grant, or model backend.
Windows Forms and DPAPI are supplied by Windows. Keep the extracted package intact.

Install / update (run locally as Ahmed, without elevation):
  powershell.exe -NoProfile -File .\Install-Messenger.ps1
Then open the Ahmed Messenger desktop shortcut. It also opens at next sign-in.
Use -NoStartup to omit UI autostart. The existing receiver startup is untouched.
Run the same installer from a new versioned package to update. Existing app versions
are immutable and retained. Close/reopen the UI to pick up the new version. The
installed Start-Messenger.ps1 -Version <previousVersion> opens a retained version.
Package hashes detect changed files; the manifest is not a publisher signature.

Account / state:
The existing canonical %USERPROFILE%\.ews-conduit\Ahmed directory is used IN PLACE.
No DPAPI/token/profile files are copied, moved, reset or exported. Check account
uses the existing device grant. Local sign in opens a local secure password prompt
against the supported EWS login; it saves only a local DPAPI session and never
replaces or repairs the device grant. Do not enter credentials into a chat.
The grant is account/policy-bound; no new grant is created automatically.

Incoming messages / receiver:
The existing Ahmed-EWS-Conduit-Receiver task remains the SINGLE intake and model
dispatch owner. This package neither creates nor starts a second receiver, nor
overwrites Receive-Automatically.ps1 or Receiver-Nonblocking.ps1. Its UI reads the
existing validated received-UUID cache and updates every ten seconds. Account,
send and health checks run in background jobs; they cannot freeze the UI. The
remote nonblocking repair is a separate existing component whose bytes have not
been obtained here; its live adoption, durable pending jobs and polling during
model work still require Ahmed-side verification. Task Running alone is not proof
of polling. The UI states this explicitly.

Messages / conflicts:
Send creates a saved immutable pending envelope before upload. After an uncertain
send, use Review pending / held and retry only the known unconfirmed UUID; retry
uses the exact saved bytes. Pending files are retained even after success.
An uploaded message is not a read receipt, model acceptance or visible rendering.
For new MAILBOX_ID_CONFLICT responses the repaired client quarantines the exact
PUT path / UUID / body SHA256. Same bytes remain idempotent at the server; different
bytes under the same UUID remain rejected. Unrelated intake/status can continue.
A legacy global MAILBOX_ID_CONFLICT flag remains a read-only recovery hold until
the exact saved item and distinct server/local digests have been reviewed. The UI
disables new sending while that hold is present and shows quarantined identifiers
and digests. It has no clear-state button. See RECOVER-AHMED.txt.

Visible coordinator / health:
Bind-VisibleCoordinator.ps1 binds ONLY original coordinator
01a1959d-01db-7771-b4c7-517dc40606f5 after the owning visible app is verified.
It validates the existing local API listener PID, executable SHA256 and task_read.
Only the already-supported Codex Control loopback task/rpc API is implemented.
The standard app's endpoint/owner is not assumed. The binding script does not
launch an app or backend, change CODEX_HOME, copy auth, or create a chat. A changed
app PID or executable refuses reports until the same visible owner is verified
again. Only references to the local token file are stored; token bytes stay local.
Automatic health changes are submitted to that existing coordinator when bound,
while the UI is open. Unchanged health is quiet. Ambiguous submissions and process
restart after dispatch are durably held without replay. UI autostart supplies
reporting at sign-in. When the app cannot be bound, the UI shows that limitation;
it never claims a hidden CLI or an accepted API request is visible delivery.

Original sidebar history:
Electron/native user-data isolation and CODEX_HOME are different settings. The
earlier empty dedicated backend home can hide original history. Do not launch an
older custom backend against a newer original store without verifying storage
compatibility. Recover through the verified owning app's supported configuration
and history APIs, preserving IDs, account/project filters and archived state.
This package does not edit SQLite/rollouts or restore profiles by copying tokens.
See DESKTOP-CONTEXT.txt for source evidence and the outstanding remote checks.

Uninstall:
Close the UI, then run powershell.exe -NoProfile -File .\Uninstall-Messenger.ps1
Only .ahmed-messenger app code and its own UI shortcuts are removed. The original
receiver task and all protected grant, queue, dedup and chat/history state remain.

Verification:
Test-Messenger.ps1 tests isolated canonical state, validation, real WinForms
construction, ownership, health dedup/restart/ambiguous failures and no-backend
creation. Test-PackageLifecycle.ps1 checks install/idempotency/update/rollback/
uninstall/integrity with an isolated synthetic Windows profile. Device regression
tests ship under device-client. No live grant or real receiver is created by tests.
Remote deployment, exact legacy conflict and visible round-trip remain unverified.

Optional conflict diagnostics:
The owner-side digest snapshot is supplied separately and is not included in this
public package. To run Get-ConflictEvidence.ps1, obtain that private snapshot from
the owner and pass its local path explicitly:
  powershell.exe -NoProfile -File .\Get-ConflictEvidence.ps1 -ServerIndex <private-snapshot-path>
This snapshot is optional; installation and the Messenger UI do not require it.
