fix: Let securejoin succeed even if the chat was deleted in the meantime

Capitalize Error
feat: Better logging for securejoin messages
2026-10-16 10:01:05 +03:00 · 2025-12-10 23:54:41 +01:00 · 2025-12-10 22:55:52 +01:00 · 2025-12-10 22:17:21 +01:00 · 2025-12-09 15:20:05 +01:00 · 2025-12-09 13:44:55 +00:00
96 changed files with 2199 additions and 1344 deletions
@@ -29,8 +29,9 @@ jobs:
  lint_rust:
    name: Lint Rust
    runs-on: ubuntu-latest
+    timeout-minutes: 60
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
        with:
          show-progress: false
          persist-credentials: false
@@ -52,8 +53,9 @@ jobs:
  cargo_deny:
    name: cargo deny
    runs-on: ubuntu-latest
+    timeout-minutes: 60
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
        with:
          show-progress: false
          persist-credentials: false
@@ -66,8 +68,9 @@ jobs:
  provider_database:
    name: Check provider database
    runs-on: ubuntu-latest
+    timeout-minutes: 60
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
        with:
          show-progress: false
          persist-credentials: false
@@ -79,10 +82,11 @@ jobs:
  docs:
    name: Rust doc comments
    runs-on: ubuntu-latest
+    timeout-minutes: 60
    env:
      RUSTDOCFLAGS: -Dwarnings
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
        with:
          show-progress: false
          persist-credentials: false
@@ -107,6 +111,7 @@ jobs:
          - os: ubuntu-latest
            rust: minimum
    runs-on: ${{ matrix.os }}
+    timeout-minutes: 60
    steps:
      - run:
          echo "RUSTUP_TOOLCHAIN=$MSRV" >> $GITHUB_ENV
@@ -117,7 +122,7 @@ jobs:
        shell: bash
        if: matrix.rust == 'latest'

-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
        with:
          show-progress: false
          persist-credentials: false
@@ -155,8 +160,9 @@ jobs:
      matrix:
        os: [ubuntu-latest, macos-latest]
    runs-on: ${{ matrix.os }}
+    timeout-minutes: 60
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
        with:
          show-progress: false
          persist-credentials: false
@@ -180,8 +186,9 @@ jobs:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
+    timeout-minutes: 60
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
        with:
          show-progress: false
          persist-credentials: false
@@ -202,8 +209,9 @@ jobs:
  python_lint:
    name: Python lint
    runs-on: ubuntu-latest
+    timeout-minutes: 60
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
        with:
          show-progress: false
          persist-credentials: false
@@ -219,6 +227,38 @@ jobs:
        working-directory: deltachat-rpc-client
        run: tox -e lint

+  # mypy does not work with PyPy since mypy 1.19
+  # as it introduced native `librt` dependency
+  # that uses CPython internals.
+  # We only run mypy with CPython because of this.
+  cffi_python_mypy:
+    name: CFFI Python mypy
+    needs: ["c_library", "python_lint"]
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          show-progress: false
+          persist-credentials: false
+
+      - name: Download libdeltachat.a
+        uses: actions/download-artifact@v6
+        with:
+          name: ubuntu-latest-libdeltachat.a
+          path: target/debug
+
+      - name: Install tox
+        run: pip install tox
+
+      - name: Run mypy
+        env:
+          DCC_RS_TARGET: debug
+          DCC_RS_DEV: ${{ github.workspace }}
+        working-directory: python
+        run: tox -e mypy
+
+
  cffi_python_tests:
    name: CFFI Python tests
    needs: ["c_library", "python_lint"]
@@ -238,15 +278,16 @@ jobs:
          - os: macos-latest
            python: pypy3.10

-          # Minimum Supported Python Version = 3.8
+          # Minimum Supported Python Version = 3.10
          # This is the minimum version for which manylinux Python wheels are
          # built. Test it with minimum supported Rust version.
          - os: ubuntu-latest
-            python: 3.8
+            python: "3.10"

    runs-on: ${{ matrix.os }}
+    timeout-minutes: 60
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
        with:
          show-progress: false
          persist-credentials: false
@@ -271,7 +312,7 @@ jobs:
          DCC_RS_TARGET: debug
          DCC_RS_DEV: ${{ github.workspace }}
        working-directory: python
-        run: tox -e mypy,doc,py
+        run: tox -e doc,py

  rpc_python_tests:
    name: JSON-RPC Python tests
@@ -293,13 +334,14 @@ jobs:
          - os: macos-latest
            python: pypy3.10

-          # Minimum Supported Python Version = 3.8
+          # Minimum Supported Python Version = 3.10
          - os: ubuntu-latest
-            python: 3.8
+            python: "3.10"

    runs-on: ${{ matrix.os }}
+    timeout-minutes: 60
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
        with:
          show-progress: false
          persist-credentials: false
@@ -30,11 +30,11 @@ jobs:
        arch: [aarch64, armv7l, armv6l, i686, x86_64]
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
        with:
          show-progress: false
          persist-credentials: false
-      - uses: cachix/install-nix-action@fd24c48048070c1be9acd18c9d369a83f0fe94d7 # v31
+      - uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # v31

      - name: Build deltachat-rpc-server binaries
        run: nix build .#deltachat-rpc-server-${{ matrix.arch }}-linux
@@ -46,6 +46,30 @@ jobs:
          path: result/bin/deltachat-rpc-server
          if-no-files-found: error

+  build_linux_wheel:
+    name: Linux wheel
+    strategy:
+      fail-fast: false
+      matrix:
+        arch: [aarch64, armv7l, armv6l, i686, x86_64]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          show-progress: false
+          persist-credentials: false
+      - uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # v31
+
+      - name: Build deltachat-rpc-server wheels
+        run: nix build .#deltachat-rpc-server-${{ matrix.arch }}-linux-wheel
+
+      - name: Upload wheel
+        uses: actions/upload-artifact@v5
+        with:
+          name: deltachat-rpc-server-${{ matrix.arch }}-linux-wheel
+          path: result/*.whl
+          if-no-files-found: error
+
  build_windows:
    name: Windows
    strategy:
@@ -54,11 +78,11 @@ jobs:
        arch: [win32, win64]
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
        with:
          show-progress: false
          persist-credentials: false
-      - uses: cachix/install-nix-action@fd24c48048070c1be9acd18c9d369a83f0fe94d7 # v31
+      - uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # v31

      - name: Build deltachat-rpc-server binaries
        run: nix build .#deltachat-rpc-server-${{ matrix.arch }}
@@ -70,6 +94,30 @@ jobs:
          path: result/bin/deltachat-rpc-server.exe
          if-no-files-found: error

+  build_windows_wheel:
+    name: Windows wheel
+    strategy:
+      fail-fast: false
+      matrix:
+        arch: [win32, win64]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          show-progress: false
+          persist-credentials: false
+      - uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # v31
+
+      - name: Build deltachat-rpc-server wheels
+        run: nix build .#deltachat-rpc-server-${{ matrix.arch }}-wheel
+
+      - name: Upload wheel
+        uses: actions/upload-artifact@v5
+        with:
+          name: deltachat-rpc-server-${{ matrix.arch }}-wheel
+          path: result/*.whl
+          if-no-files-found: error
+
  build_macos:
    name: macOS
    strategy:
@@ -79,7 +127,7 @@ jobs:

    runs-on: macos-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
        with:
          show-progress: false
          persist-credentials: false
@@ -105,11 +153,11 @@ jobs:
        arch: [arm64-v8a, armeabi-v7a]
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
        with:
          show-progress: false
          persist-credentials: false
-      - uses: cachix/install-nix-action@fd24c48048070c1be9acd18c9d369a83f0fe94d7 # v31
+      - uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # v31

      - name: Build deltachat-rpc-server binaries
        run: nix build .#deltachat-rpc-server-${{ matrix.arch }}-android
@@ -121,9 +169,33 @@ jobs:
          path: result/bin/deltachat-rpc-server
          if-no-files-found: error

+  build_android_wheel:
+    name: Android wheel
+    strategy:
+      fail-fast: false
+      matrix:
+        arch: [arm64-v8a, armeabi-v7a]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          show-progress: false
+          persist-credentials: false
+      - uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # v31
+
+      - name: Build deltachat-rpc-server wheels
+        run: nix build .#deltachat-rpc-server-${{ matrix.arch }}-android-wheel
+
+      - name: Upload wheel
+        uses: actions/upload-artifact@v5
+        with:
+          name: deltachat-rpc-server-${{ matrix.arch }}-android-wheel
+          path: result/*.whl
+          if-no-files-found: error
+
  publish:
    name: Build wheels and upload binaries to the release
-    needs: ["build_linux", "build_windows", "build_macos"]
+    needs: ["build_linux", "build_linux_wheel", "build_windows", "build_windows_wheel", "build_macos", "build_android", "build_android_wheel"]
    environment:
      name: pypi
      url: https://pypi.org/p/deltachat-rpc-server
@@ -132,11 +204,11 @@ jobs:
      contents: write
    runs-on: "ubuntu-latest"
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
        with:
          show-progress: false
          persist-credentials: false
-      - uses: cachix/install-nix-action@fd24c48048070c1be9acd18c9d369a83f0fe94d7 # v31
+      - uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # v31

      - name: Download Linux aarch64 binary
        uses: actions/download-artifact@v6
@@ -144,42 +216,84 @@ jobs:
          name: deltachat-rpc-server-aarch64-linux
          path: deltachat-rpc-server-aarch64-linux.d

+      - name: Download Linux aarch64 wheel
+        uses: actions/download-artifact@v6
+        with:
+          name: deltachat-rpc-server-aarch64-linux-wheel
+          path: deltachat-rpc-server-aarch64-linux-wheel.d
+
      - name: Download Linux armv7l binary
        uses: actions/download-artifact@v6
        with:
          name: deltachat-rpc-server-armv7l-linux
          path: deltachat-rpc-server-armv7l-linux.d

+      - name: Download Linux armv7l wheel
+        uses: actions/download-artifact@v6
+        with:
+          name: deltachat-rpc-server-armv7l-linux-wheel
+          path: deltachat-rpc-server-armv7l-linux-wheel.d
+
      - name: Download Linux armv6l binary
        uses: actions/download-artifact@v6
        with:
          name: deltachat-rpc-server-armv6l-linux
          path: deltachat-rpc-server-armv6l-linux.d

+      - name: Download Linux armv6l wheel
+        uses: actions/download-artifact@v6
+        with:
+          name: deltachat-rpc-server-armv6l-linux-wheel
+          path: deltachat-rpc-server-armv6l-linux-wheel.d
+
      - name: Download Linux i686 binary
        uses: actions/download-artifact@v6
        with:
          name: deltachat-rpc-server-i686-linux
          path: deltachat-rpc-server-i686-linux.d

+      - name: Download Linux i686 wheel
+        uses: actions/download-artifact@v6
+        with:
+          name: deltachat-rpc-server-i686-linux-wheel
+          path: deltachat-rpc-server-i686-linux-wheel.d
+
      - name: Download Linux x86_64 binary
        uses: actions/download-artifact@v6
        with:
          name: deltachat-rpc-server-x86_64-linux
          path: deltachat-rpc-server-x86_64-linux.d

+      - name: Download Linux x86_64 wheel
+        uses: actions/download-artifact@v6
+        with:
+          name: deltachat-rpc-server-x86_64-linux-wheel
+          path: deltachat-rpc-server-x86_64-linux-wheel.d
+
      - name: Download Win32 binary
        uses: actions/download-artifact@v6
        with:
          name: deltachat-rpc-server-win32
          path: deltachat-rpc-server-win32.d

+      - name: Download Win32 wheel
+        uses: actions/download-artifact@v6
+        with:
+          name: deltachat-rpc-server-win32-wheel
+          path: deltachat-rpc-server-win32-wheel.d
+
      - name: Download Win64 binary
        uses: actions/download-artifact@v6
        with:
          name: deltachat-rpc-server-win64
          path: deltachat-rpc-server-win64.d

+      - name: Download Win64 wheel
+        uses: actions/download-artifact@v6
+        with:
+          name: deltachat-rpc-server-win64-wheel
+          path: deltachat-rpc-server-win64-wheel.d
+
      - name: Download macOS binary for x86_64
        uses: actions/download-artifact@v6
        with:
@@ -198,12 +312,24 @@ jobs:
          name: deltachat-rpc-server-arm64-v8a-android
          path: deltachat-rpc-server-arm64-v8a-android.d

+      - name: Download Android wheel for arm64-v8a
+        uses: actions/download-artifact@v6
+        with:
+          name: deltachat-rpc-server-arm64-v8a-android-wheel
+          path: deltachat-rpc-server-arm64-v8a-android-wheel.d
+
      - name: Download Android binary for armeabi-v7a
        uses: actions/download-artifact@v6
        with:
          name: deltachat-rpc-server-armeabi-v7a-android
          path: deltachat-rpc-server-armeabi-v7a-android.d

+      - name: Download Android wheel for armeabi-v7a
+        uses: actions/download-artifact@v6
+        with:
+          name: deltachat-rpc-server-armeabi-v7a-android-wheel
+          path: deltachat-rpc-server-armeabi-v7a-android-wheel.d
+
      - name: Create bin/ directory
        run: |
          mkdir -p bin
@@ -222,38 +348,21 @@ jobs:
      - name: List binaries
        run: ls -l bin/

-      # Python 3.11 is needed for tomllib used in scripts/wheel-rpc-server.py
-      - name: Install python 3.12
-        uses: actions/setup-python@v6
-        with:
-          python-version: 3.12
-
      - name: Install wheel
        run: pip install wheel

-      - name: Build deltachat-rpc-server Python wheels and source package
+      - name: Build deltachat-rpc-server Python wheels
        run: |
          mkdir -p dist
-          nix build .#deltachat-rpc-server-x86_64-linux-wheel
-          cp result/*.whl dist/
-          nix build .#deltachat-rpc-server-armv7l-linux-wheel
-          cp result/*.whl dist/
-          nix build .#deltachat-rpc-server-armv6l-linux-wheel
-          cp result/*.whl dist/
-          nix build .#deltachat-rpc-server-aarch64-linux-wheel
-          cp result/*.whl dist/
-          nix build .#deltachat-rpc-server-i686-linux-wheel
-          cp result/*.whl dist/
-          nix build .#deltachat-rpc-server-win64-wheel
-          cp result/*.whl dist/
-          nix build .#deltachat-rpc-server-win32-wheel
-          cp result/*.whl dist/
-          nix build .#deltachat-rpc-server-arm64-v8a-android-wheel
-          cp result/*.whl dist/
-          nix build .#deltachat-rpc-server-armeabi-v7a-android-wheel
-          cp result/*.whl dist/
-          nix build .#deltachat-rpc-server-source
-          cp result/*.tar.gz dist/
+          mv deltachat-rpc-server-aarch64-linux-wheel.d/*.whl dist/
+          mv deltachat-rpc-server-armv7l-linux-wheel.d/*.whl dist/
+          mv deltachat-rpc-server-armv6l-linux-wheel.d/*.whl dist/
+          mv deltachat-rpc-server-i686-linux-wheel.d/*.whl dist/
+          mv deltachat-rpc-server-x86_64-linux-wheel.d/*.whl dist/
+          mv deltachat-rpc-server-win64-wheel.d/*.whl dist/
+          mv deltachat-rpc-server-win32-wheel.d/*.whl dist/
+          mv deltachat-rpc-server-arm64-v8a-android-wheel.d/*.whl dist/
+          mv deltachat-rpc-server-armeabi-v7a-android-wheel.d/*.whl dist/
          python3 scripts/wheel-rpc-server.py x86_64-darwin bin/deltachat-rpc-server-x86_64-macos
          python3 scripts/wheel-rpc-server.py aarch64-darwin bin/deltachat-rpc-server-aarch64-macos
          mv *.whl dist/
@@ -271,7 +380,7 @@ jobs:
            --repo ${{ github.repository }} \
            bin/* dist/*

-      - name: Publish deltachat-rpc-client to PyPI
+      - name: Publish deltachat-rpc-server to PyPI
        if: github.event_name == 'release'
        uses: pypa/gh-action-pypi-publish@release/v1

@@ -279,13 +388,16 @@ jobs:
    name: Build & Publish npm prebuilds and deltachat-rpc-server
    needs: ["build_linux", "build_windows", "build_macos"]
    runs-on: "ubuntu-latest"
+    environment:
+      name: npm-stdio-rpc-server
+      url: https://www.npmjs.com/package/@deltachat/stdio-rpc-server
    permissions:
      id-token: write

      # Needed to publish the binaries to the release.
      contents: write
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
        with:
          show-progress: false
          persist-credentials: false
@@ -406,11 +518,14 @@ jobs:
          node-version: 20
          registry-url: "https://registry.npmjs.org"

+      # Ensure npm 11.5.1 or later is installed.
+      # It is needed for <https://docs.npmjs.com/trusted-publishers>
+      - name: Update npm
+        run: npm install -g npm@latest
+
      - name: Publish npm packets for prebuilds and `@deltachat/stdio-rpc-server`
        if: github.event_name == 'release'
        working-directory: deltachat-rpc-server/npm-package
        run: |
          ls -lah platform_package
          for platform in *.tgz; do npm publish --provenance "$platform" --access public; done
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
@@ -10,11 +10,14 @@ jobs:
  pack-module:
    name: "Publish @deltachat/jsonrpc-client"
    runs-on: ubuntu-latest
+    environment:
+      name: npm-jsonrpc-client
+      url: https://www.npmjs.com/package/@deltachat/jsonrpc-client
    permissions:
      id-token: write
      contents: read
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
        with:
          show-progress: false
          persist-credentials: false
@@ -24,6 +27,11 @@ jobs:
          node-version: 20
          registry-url: "https://registry.npmjs.org"

+      # Ensure npm 11.5.1 or later is installed.
+      # It is needed for <https://docs.npmjs.com/trusted-publishers>
+      - name: Update npm
+        run: npm install -g npm@latest
+
      - name: Install dependencies without running scripts
        working-directory: deltachat-jsonrpc/typescript
        run: npm install --ignore-scripts
@@ -37,5 +45,3 @@ jobs:
      - name: Publish
        working-directory: deltachat-jsonrpc/typescript
        run: npm publish --provenance deltachat-jsonrpc-client-* --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
@@ -16,7 +16,7 @@ jobs:
  build_and_test:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
        with:
          show-progress: false
          persist-credentials: false
@@ -21,11 +21,11 @@ jobs:
    name: check flake formatting
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
        with:
          show-progress: false
          persist-credentials: false
-      - uses: cachix/install-nix-action@fd24c48048070c1be9acd18c9d369a83f0fe94d7 # v31
+      - uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # v31
      - run: nix fmt flake.nix -- --check

  build:
@@ -80,11 +80,11 @@ jobs:
          #- deltachat-rpc-server-x86_64-android
          #- deltachat-rpc-server-x86-android
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
        with:
          show-progress: false
          persist-credentials: false
-      - uses: cachix/install-nix-action@fd24c48048070c1be9acd18c9d369a83f0fe94d7 # v31
+      - uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # v31
      - run: nix build .#${{ matrix.installable }}

  build-macos:
@@ -101,9 +101,9 @@ jobs:
          # because of <https://github.com/NixOS/nixpkgs/issues/413910>.
          # - deltachat-rpc-server-aarch64-darwin
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
        with:
          show-progress: false
          persist-credentials: false
-      - uses: cachix/install-nix-action@fd24c48048070c1be9acd18c9d369a83f0fe94d7 # v31
+      - uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # v31
      - run: nix build .#${{ matrix.installable }}
@@ -13,7 +13,7 @@ jobs:
    runs-on: ubuntu-latest

    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
        with:
          show-progress: false
          persist-credentials: false
@@ -14,11 +14,11 @@ jobs:
    name: Build REPL example
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
        with:
          show-progress: false
          persist-credentials: false
-      - uses: cachix/install-nix-action@fd24c48048070c1be9acd18c9d369a83f0fe94d7 # v31
+      - uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # v31
      - name: Build
        run: nix build .#deltachat-repl-win64
      - name: Upload binary
@@ -13,7 +13,7 @@ jobs:
    runs-on: ubuntu-latest

    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
        with:
          show-progress: false
          persist-credentials: false
@@ -31,12 +31,12 @@ jobs:
    runs-on: ubuntu-latest

    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
        with:
          show-progress: false
          persist-credentials: false
          fetch-depth: 0 # Fetch history to calculate VCS version number.
-      - uses: cachix/install-nix-action@fd24c48048070c1be9acd18c9d369a83f0fe94d7 # v31
+      - uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # v31
      - name: Build Python documentation
        run: nix build .#python-docs
      - name: Upload to py.delta.chat
@@ -50,12 +50,12 @@ jobs:
    runs-on: ubuntu-latest

    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
        with:
          show-progress: false
          persist-credentials: false
          fetch-depth: 0 # Fetch history to calculate VCS version number.
-      - uses: cachix/install-nix-action@fd24c48048070c1be9acd18c9d369a83f0fe94d7 # v31
+      - uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # v31
      - name: Build C documentation
        run: nix build .#docs
      - name: Upload to c.delta.chat
@@ -72,7 +72,7 @@ jobs:
        working-directory: ./deltachat-jsonrpc/typescript

    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
        with:
          show-progress: false
          persist-credentials: false
@@ -16,7 +16,7 @@ jobs:
    runs-on: ubuntu-latest

    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
        with:
          show-progress: false
          persist-credentials: false
@@ -14,12 +14,12 @@ jobs:
      security-events: write
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Install the latest version of uv
-        uses: astral-sh/setup-uv@5a7eac68fb9809dea845d802897dc5c723910fa3
+        uses: astral-sh/setup-uv@1e862dfacbd1d6d858c55d9b792c756523627244

      - name: Run zizmor
        run: uvx zizmor --format sarif . > results.sarif
@@ -1,5 +1,135 @@
 # Changelog

+## [2.33.0] - 2025-12-05
+
+### Features / Changes
+
+- Case-insensitive search for non-ASCII chat and contact names ([#7477](https://github.com/chatmail/core/pull/7477)).
+
+### Fixes
+
+- Recognize all transport addresses as own addresses.
+
+## [2.32.0] - 2025-12-04
+
+Version bump to trigger publishing of npm prebuilds
+that failed to be published for 2.31.0 due to not configured "trusted publishers".
+
+### Features / Changes
+
+- Lookup_or_create_adhoc_group(): Add context to SQL errors ([#7554](https://github.com/chatmail/core/pull/7554)).
+
+## [2.31.0] - 2025-12-04
+
+### CI
+
+- Update npm before publishing packages.
+
+### Features / Changes
+
+- Use v2 SEIPD when sending messages to self.
+
+## [2.30.0] - 2025-12-04
+
+### Features / Changes
+
+- Disable SNI for STARTTLS ([#7499](https://github.com/chatmail/core/pull/7499)).
+- Introduce cross-core testing along with improvements to test frameworking.
+- Synchronize transports via sync messages.
+
+### Fixes
+
+- Fix shutdown shortly after call.
+
+### API-Changes
+
+- Add `TransportsModified` event (for tests).
+
+### CI
+
+- Use "trusted publishing" for NPM packages.
+
+### Miscellaneous Tasks
+
+- deps: Bump actions/checkout from 5 to 6.
+- cargo: Bump syn from 2.0.110 to 2.0.111.
+- deps: Bump astral-sh/setup-uv from 7.1.3 to 7.1.4.
+- cargo: Bump sdp from 0.8.0 to 0.10.0.
+- Remove two outdated todo comments ([#7550](https://github.com/chatmail/core/pull/7550)).
+
+## [2.29.0] - 2025-12-01
+
+### API-Changes
+
+- deltachat-rpc-client: Add Message.exists().
+
+### Features / Changes
+
+- [**breaking**] Increase backup version from 3 to 4.
+- Hide `To` header in encrypted messages.
+- `deltachat_rpc_client.Rpc` accepts `rpc_server_path` for using a particular deltachat-rpc-server ([#7493](https://github.com/chatmail/core/pull/7493)).
+- Don't send `Chat-Group-Avatar` header in unencrypted groups.
+- Don't update `self-{avatar,status}` from received messages ([#7002](https://github.com/chatmail/core/pull/7002)).
+
+### Fixes
+
+- `CREATE INDEX imap_only_rfc724_mid ON imap(rfc724_mid)` ([#7490](https://github.com/chatmail/core/pull/7490)).
+- Use the same webxdc ratelimit for all email servers.
+- Handle the case when account does not exist in `get_existing_msg_ids()`.
+- Don't send self-avatar in unencrypted messages ([#7136](https://github.com/chatmail/core/pull/7136)).
+- Do not configure folders during transport configuration.
+- Upload sync messages only with the primary transport.
+- Do not use deprecated ConfiguredProvider in get_configured_provider.
+
+### Build system
+
+- Make scripts for remote testing usable.
+- Increase minimum supported Python version to 3.10.
+- Use SPDX license expression in Python package metadata.
+
+### CI
+
+- Set timeout-minutes for all jobs in ci.yaml workflow.
+- Do not install Python manually to bulid RPC server wheels.
+- Do not build fake RPC server source packages.
+- Build Python wheels in separate jobs.
+
+### Refactor
+
+- [**breaking**] Remove some unneeded stock strings ([#7496](https://github.com/chatmail/core/pull/7496)).
+- Strike events in rpc-client request handling, get result from queue.
+- Use ConfiguredProvider config directly when loading legacy settings.
+- Remove update_icons and disable_server_delete migrations.
+- Use `SYMMETRIC_KEY_ALGORITHM` constant in `symm_encrypt_message()`.
+- Make signing key non-optional for `pk_encrypt`.
+
+### Tests
+
+- `test_remove_member_bcc`: Test unencrypted group as it was initially.
+
+### Miscellaneous Tasks
+
+- deps: Bump cachix/install-nix-action from 31.8.1 to 31.8.4.
+- cargo: Bump hyper from 1.7.0 to 1.8.1.
+- cargo: Bump human-panic from 2.0.3 to 2.0.4.
+- cargo: Bump hyper-util from 0.1.17 to 0.1.18.
+- cargo: Bump rusqlite from 0.36.0 to 0.37.0.
+- cargo: Bump tokio-util from 0.7.16 to 0.7.17.
+- cargo: Bump toml from 0.9.7 to 0.9.8.
+- cargo: Bump proptest from 1.8.0 to 1.9.0.
+- cargo: Bump parking_lot from 0.12.4 to 0.12.5.
+- cargo: Bump syn from 2.0.106 to 2.0.110.
+- cargo: Bump quick-xml from 0.38.3 to 0.38.4.
+- cargo: Bump rustls-pki-types from 1.12.0 to 1.13.0.
+- cargo: Bump nu-ansi-term from 0.50.1 to 0.50.3.
+- cargo: Bump sanitize-filename from 0.5.0 to 0.6.0.
+- cargo: Bump quote from 1.0.41 to 1.0.42.
+- cargo: Bump libc from 0.2.176 to 0.2.177.
+- cargo: Bump bytes from 1.10.1 to 1.11.0.
+- cargo: Bump image from 0.25.8 to 0.25.9.
+- cargo: Bump rand from 0.9.0 to 0.9.2 ([#7501](https://github.com/chatmail/core/pull/7501)).
+- cargo: Bump tokio from 1.45.1 to 1.48.0.
+
 ## [2.28.0] - 2025-11-23

 ### API-Changes
@@ -7236,3 +7366,8 @@ https://github.com/chatmail/core/pulls?q=is%3Apr+is%3Aclosed
 [2.26.0]: https://github.com/chatmail/core/compare/v2.25.0..v2.26.0
 [2.27.0]: https://github.com/chatmail/core/compare/v2.26.0..v2.27.0
 [2.28.0]: https://github.com/chatmail/core/compare/v2.27.0..v2.28.0
+[2.29.0]: https://github.com/chatmail/core/compare/v2.28.0..v2.29.0
+[2.30.0]: https://github.com/chatmail/core/compare/v2.29.0..v2.30.0
+[2.31.0]: https://github.com/chatmail/core/compare/v2.30.0..v2.31.0
+[2.32.0]: https://github.com/chatmail/core/compare/v2.31.0..v2.32.0
+[2.33.0]: https://github.com/chatmail/core/compare/v2.32.0..v2.33.0
@@ -1,6 +1,6 @@
 [package]
 name = "deltachat"
-version = "2.28.0"
+version = "2.33.0"
 edition = "2024"
 license = "MPL-2.0"
 rust-version = "1.88"
@@ -88,7 +88,7 @@ regex = { workspace = true }
 rusqlite = { workspace = true, features = ["sqlcipher"] }
 rustls-pki-types = "1.12.0"
 sanitize-filename = { workspace = true }
-sdp = "0.8.0"
+sdp = "0.10.0"
 serde_json = { workspace = true }
 serde_urlencoded = "0.7.1"
 serde = { workspace = true, features = ["derive"] }
@@ -194,14 +194,14 @@ nu-ansi-term = "0.50"
 num-traits = "0.2"
 rand = "0.9"
 regex = "1.10"
-rusqlite = "0.36"
-sanitize-filename = "0.5"
+rusqlite = "0.37"
+sanitize-filename = "0.6"
 serde = "1.0"
 serde_json = "1"
 tempfile = "3.23.0"
 thiserror = "2"
 tokio = "1"
-tokio-util = "0.7.16"
+tokio-util = "0.7.17"
 tracing-subscriber = "0.3"
 yerpc = "0.6.4"

@@ -16,7 +16,8 @@ id INTEGER PRIMARY KEY AUTOINCREMENT,
 text TEXT DEFAULT '' NOT NULL -- message text
 ) STRICT",
    )
-    .await?;
+    .await
+    .context("CREATE TABLE messages")?;
 ```

 Do not use macros like [`concat!`](https://doc.rust-lang.org/std/macro.concat.html)
@@ -29,7 +30,8 @@ id INTEGER PRIMARY KEY AUTOINCREMENT, \
 text TEXT DEFAULT '' NOT NULL \
 ) STRICT",
    )
-    .await?;
+    .await
+    .context("CREATE TABLE messages")?;
 ```
 Escaping newlines
 is prone to errors like this if space before backslash is missing:
@@ -63,6 +65,9 @@ an older version. Also don't change the column type, consider adding a new colum
 instead. Finally, never change column semantics, this is especially dangerous because the `STRICT`
 keyword doesn't help here.

+Consider adding context to `anyhow` errors for SQL statements using `.context()` so that it's
+possible to understand from logs which statement failed. See [Errors](#errors) for more info.
+
 ## Errors

 Delta Chat core mostly uses [`anyhow`](https://docs.rs/anyhow/) errors.
@@ -38,7 +38,7 @@ use deltachat::{
    internals_for_benches::key_from_asc,
    internals_for_benches::parse_and_get_text,
    internals_for_benches::store_self_keypair,
-    pgp::{KeyPair, decrypt, pk_encrypt, symm_encrypt_message},
+    pgp::{KeyPair, SeipdVersion, decrypt, pk_encrypt, symm_encrypt_message},
    stock_str::StockStrings,
 };
 use rand::{Rng, rng};
@@ -108,9 +108,10 @@ fn criterion_benchmark(c: &mut Criterion) {
            pk_encrypt(
                plain.clone(),
                vec![black_box(key_pair.public.clone())],
-                Some(key_pair.secret.clone()),
+                key_pair.secret.clone(),
                true,
                true,
+                SeipdVersion::V2,
            )
            .await
            .unwrap()
@@ -1,6 +1,6 @@
 [package]
 name = "deltachat_ffi"
-version = "2.28.0"
+version = "2.33.0"
 description = "Deltachat FFI"
 edition = "2018"
 readme = "README.md"
@@ -7215,11 +7215,6 @@ void dc_event_unref(dc_event_t* event);
 /// Used as device message text.
 #define DC_STR_SELF_DELETED_MSG_BODY      91

-/// "'Delete messages from server' turned off as now all folders are affected."
-///
-/// Used as device message text.
-#define DC_STR_SERVER_TURNED_OFF          92
-
 /// "Message deletion timer is set to %1$s minutes."
 ///
 /// Used in status messages.
@@ -7416,19 +7411,6 @@ void dc_event_unref(dc_event_t* event);
 /// @deprecated 2025-06-05
 #define DC_STR_AEAP_ADDR_CHANGED          122

-/// "You changed your email address from %1$s to %2$s.
-/// If you now send a message to a group, contacts there will automatically
-/// replace the old with your new address.\n\n It's highly advised to set up 
-/// your old email provider to forward all emails to your new email address. 
-/// Otherwise you might miss messages of contacts who did not get your new 
-/// address yet." + the link to the AEAP blog post
-/// 
-/// As soon as there is a post about AEAP, the UIs should add it:
-/// set_stock_translation(123, getString(aeap_explanation) + "\n\n" + AEAP_BLOG_LINK)
-///
-/// Used in a device message that explains AEAP.
-#define DC_STR_AEAP_EXPLANATION_AND_LINK  123
-
 /// "You changed group name from \"%1$s\" to \"%2$s\"."
 ///
 /// `%1$s` will be replaced by the old group name.
@@ -7677,12 +7659,6 @@ void dc_event_unref(dc_event_t* event);
 /// Used in info messages.
 #define DC_STR_CHAT_PROTECTION_ENABLED 170

-/// "%1$s sent a message from another device."
-///
-/// Used in info messages.
-/// @deprecated 2025-07
-#define DC_STR_CHAT_PROTECTION_DISABLED 171
-
 /// "Others will only see this group after you sent a first message."
 ///
 /// Used as the first info messages in newly created groups.
@@ -559,6 +559,7 @@ pub unsafe extern "C" fn dc_event_get_id(event: *mut dc_event_t) -> libc::c_int
        EventType::IncomingCallAccepted { .. } => 2560,
        EventType::OutgoingCallAccepted { .. } => 2570,
        EventType::CallEnded { .. } => 2580,
+        EventType::TransportsModified => 2600,
        #[allow(unreachable_patterns)]
        #[cfg(test)]
        _ => unreachable!("This is just to silence a rust_analyzer false-positive"),
@@ -593,7 +594,8 @@ pub unsafe extern "C" fn dc_event_get_data1_int(event: *mut dc_event_t) -> libc:
        | EventType::AccountsBackgroundFetchDone
        | EventType::ChatlistChanged
        | EventType::AccountsChanged
-        | EventType::AccountsItemChanged => 0,
+        | EventType::AccountsItemChanged
+        | EventType::TransportsModified => 0,
        EventType::IncomingReaction { contact_id, .. }
        | EventType::IncomingWebxdcNotify { contact_id, .. } => contact_id.to_u32() as libc::c_int,
        EventType::MsgsChanged { chat_id, .. }
@@ -681,7 +683,8 @@ pub unsafe extern "C" fn dc_event_get_data2_int(event: *mut dc_event_t) -> libc:
        | EventType::IncomingCallAccepted { .. }
        | EventType::OutgoingCallAccepted { .. }
        | EventType::CallEnded { .. }
-        | EventType::EventChannelOverflow { .. } => 0,
+        | EventType::EventChannelOverflow { .. }
+        | EventType::TransportsModified => 0,
        EventType::MsgsChanged { msg_id, .. }
        | EventType::ReactionsChanged { msg_id, .. }
        | EventType::IncomingReaction { msg_id, .. }
@@ -780,7 +783,8 @@ pub unsafe extern "C" fn dc_event_get_data2_str(event: *mut dc_event_t) -> *mut
        | EventType::AccountsChanged
        | EventType::AccountsItemChanged
        | EventType::IncomingCallAccepted { .. }
-        | EventType::WebxdcRealtimeAdvertisementReceived { .. } => ptr::null_mut(),
+        | EventType::WebxdcRealtimeAdvertisementReceived { .. }
+        | EventType::TransportsModified => ptr::null_mut(),
        EventType::IncomingCall {
            place_call_info, ..
        } => {
@@ -1,6 +1,6 @@
 [package]
 name = "deltachat-jsonrpc"
-version = "2.28.0"
+version = "2.33.0"
 description = "DeltaChat JSON-RPC API"
 edition = "2021"
 license = "MPL-2.0"
@@ -10,8 +10,9 @@ pub use deltachat::accounts::Accounts;
 use deltachat::blob::BlobObject;
 use deltachat::calls::ice_servers;
 use deltachat::chat::{
-    self, add_contact_to_chat, forward_msgs, get_chat_media, get_chat_msgs, get_chat_msgs_ex,
-    marknoticed_chat, remove_contact_from_chat, Chat, ChatId, ChatItem, MessageListOptions,
+    self, add_contact_to_chat, forward_msgs, forward_msgs_2ctx, get_chat_media, get_chat_msgs,
+    get_chat_msgs_ex, marknoticed_chat, remove_contact_from_chat, Chat, ChatId, ChatItem,
+    MessageListOptions,
 };
 use deltachat::chatlist::Chatlist;
 use deltachat::config::Config;
@@ -121,14 +122,14 @@ impl CommandApi {
        }
    }

+    async fn get_context_opt(&self, id: u32) -> Option<deltachat::context::Context> {
+        self.accounts.read().await.get_account(id)
+    }
+
    async fn get_context(&self, id: u32) -> Result<deltachat::context::Context> {
-        let sc = self
-            .accounts
-            .read()
+        self.get_context_opt(id)
            .await
-            .get_account(id)
-            .ok_or_else(|| anyhow!("account with id {id} not found"))?;
-        Ok(sc)
+            .ok_or_else(|| anyhow!("account with id {id} not found"))
    }

    async fn with_state<F, T>(&self, id: u32, with_state: F) -> T
@@ -1307,13 +1308,18 @@ impl CommandApi {
    ///
    /// Returns IDs of existing messages.
    async fn get_existing_msg_ids(&self, account_id: u32, msg_ids: Vec<u32>) -> Result<Vec<u32>> {
-        let context = self.get_context(account_id).await?;
-        let msg_ids: Vec<MsgId> = msg_ids.into_iter().map(MsgId::new).collect();
-        let existing_msg_ids = get_existing_msg_ids(&context, &msg_ids).await?;
-        Ok(existing_msg_ids
-            .into_iter()
-            .map(|msg_id| msg_id.to_u32())
-            .collect())
+        if let Some(context) = self.get_context_opt(account_id).await {
+            let msg_ids: Vec<MsgId> = msg_ids.into_iter().map(MsgId::new).collect();
+            let existing_msg_ids = get_existing_msg_ids(&context, &msg_ids).await?;
+            Ok(existing_msg_ids
+                .into_iter()
+                .map(|msg_id| msg_id.to_u32())
+                .collect())
+        } else {
+            // Account does not exist, so messages do not exist either,
+            // but this is not an error.
+            Ok(Vec::new())
+        }
    }

    async fn get_message_list_items(
@@ -2203,6 +2209,27 @@ impl CommandApi {
        forward_msgs(&ctx, &message_ids, ChatId::new(chat_id)).await
    }

+    /// Forward messages to a chat in another account.
+    /// See [`Self::forward_messages`] for more info.
+    async fn forward_messages_to_account(
+        &self,
+        src_account_id: u32,
+        src_message_ids: Vec<u32>,
+        dst_account_id: u32,
+        dst_chat_id: u32,
+    ) -> Result<()> {
+        let src_ctx = self.get_context(src_account_id).await?;
+        let dst_ctx = self.get_context(dst_account_id).await?;
+        let src_message_ids: Vec<MsgId> = src_message_ids.into_iter().map(MsgId::new).collect();
+        forward_msgs_2ctx(
+            &src_ctx,
+            &src_message_ids,
+            &dst_ctx,
+            ChatId::new(dst_chat_id),
+        )
+        .await
+    }
+
    /// Resend messages and make information available for newly added chat members.
    /// Resending sends out the original message, however, recipients and webxdc-status may differ.
    /// Clients that already have the original message can still ignore the resent message as
@@ -15,7 +15,7 @@ pub enum Account {
        display_name: Option<String>,
        addr: Option<String>,
        // size: u32,
-        profile_image: Option<String>, // TODO: This needs to be converted to work with blob http server.
+        profile_image: Option<String>,
        color: String,
        /// Optional tag as "Work", "Family".
        /// Meant to help profile owner to differ between profiles with similar names.
@@ -69,7 +69,7 @@ pub struct FullChat {
    // but that would be an extra DB query.
    self_in_group: bool,
    is_muted: bool,
-    ephemeral_timer: u32, //TODO look if there are more important properties in newer core versions
+    ephemeral_timer: u32,
    can_send: bool,
    was_seen_recently: bool,
    mailing_list_address: Option<String>,
@@ -271,7 +271,7 @@ pub enum EventType {
        /// Progress.
        ///
        /// 0=error, 1-999=progress in permille, 1000=success and done
-        progress: usize,
+        progress: u16,

        /// Progress comment or error, something to display to the user.
        comment: Option<String>,
@@ -282,7 +282,7 @@ pub enum EventType {
    #[serde(rename_all = "camelCase")]
    ImexProgress {
        /// 0=error, 1-999=progress in permille, 1000=success and done
-        progress: usize,
+        progress: u16,
    },

    /// A file has been exported. A file has been written by imex().
@@ -313,7 +313,7 @@ pub enum EventType {
        chat_id: u32,

        /// Progress, always 1000.
-        progress: usize,
+        progress: u16,
    },

    /// Progress information of a secure-join handshake from the view of the joiner
@@ -329,7 +329,7 @@ pub enum EventType {
        /// 400=vg-/vc-request-with-auth sent, typically shown as "alice@addr verified, introducing myself."
        /// (Bob has verified alice and waits until Alice does the same for him)
        /// 1000=vg-member-added/vc-contact-confirm received
-        progress: usize,
+        progress: u16,
    },

    /// The connectivity to the server changed.
@@ -460,6 +460,15 @@ pub enum EventType {
        /// ID of the chat which the message belongs to.
        chat_id: u32,
    },
+
+    /// One or more transports has changed.
+    ///
+    /// This event is used for tests to detect when transport
+    /// synchronization messages arrives.
+    /// UIs don't need to use it, it is unlikely
+    /// that user modifies transports on multiple
+    /// devices simultaneously.
+    TransportsModified,
 }

 impl From<CoreEventType> for EventType {
@@ -642,6 +651,8 @@ impl From<CoreEventType> for EventType {
                msg_id: msg_id.to_u32(),
                chat_id: chat_id.to_u32(),
            },
+            CoreEventType::TransportsModified => TransportsModified,
+
            #[allow(unreachable_patterns)]
            #[cfg(test)]
            _ => unreachable!("This is just to silence a rust_analyzer false-positive"),
@@ -54,5 +54,5 @@
  },
  "type": "module",
  "types": "dist/deltachat.d.ts",
-  "version": "2.28.0"
+  "version": "2.33.0"
 }
@@ -1,6 +1,6 @@
 [package]
 name = "deltachat-repl"
-version = "2.28.0"
+version = "2.33.0"
 license = "MPL-2.0"
 edition = "2021"
 repository = "https://github.com/chatmail/core"
@@ -30,6 +30,15 @@ $ pip install .

 Additional arguments to `tox` are passed to pytest, e.g. `tox -- -s` does not capture test output.

+
+## Activating current checkout of deltachat-rpc-client and -server for development 
+
+Go to root repository directory and run: 
+```
+$ scripts/make-rpc-testenv.sh 
+$ source venv/bin/activate 
+```
+
 ## Using in REPL

 Setup a development environment:
@@ -1,20 +1,18 @@
 [build-system]
-requires = ["setuptools>=45"]
+requires = ["setuptools>=77"]
 build-backend = "setuptools.build_meta"

 [project]
 name = "deltachat-rpc-client"
-version = "2.28.0"
+version = "2.33.0"
+license = "MPL-2.0"
 description = "Python client for Delta Chat core JSON-RPC interface"
 classifiers = [
    "Development Status :: 5 - Production/Stable",
    "Intended Audience :: Developers",
-    "License :: OSI Approved :: Mozilla Public License 2.0 (MPL 2.0)",
    "Operating System :: POSIX :: Linux",
    "Operating System :: MacOS :: MacOS X",
    "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.8",
-    "Programming Language :: Python :: 3.9",
    "Programming Language :: Python :: 3.10",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
@@ -24,7 +22,7 @@ classifiers = [
    "Topic :: Communications :: Email"
 ]
 readme = "README.md"
-requires-python = ">=3.8"
+requires-python = ">=3.10"

 [tool.setuptools.package-data]
 deltachat_rpc_client = [
@@ -219,10 +219,12 @@ class Chat:
        """Mark all messages in this chat as noticed."""
        self._rpc.marknoticed_chat(self.account.id, self.id)

-    def add_contact(self, *contact: Union[int, str, Contact]) -> None:
+    def add_contact(self, *contact: Union[int, str, Contact, "Account"]) -> None:
        """Add contacts to this group."""
+        from .account import Account
+
        for cnt in contact:
-            if isinstance(cnt, str):
+            if isinstance(cnt, (str, Account)):
                contact_id = self.account.create_contact(cnt).id
            elif not isinstance(cnt, int):
                contact_id = cnt.id
@@ -230,10 +232,12 @@ class Chat:
                contact_id = cnt
            self._rpc.add_contact_to_chat(self.account.id, self.id, contact_id)

-    def remove_contact(self, *contact: Union[int, str, Contact]) -> None:
+    def remove_contact(self, *contact: Union[int, str, Contact, "Account"]) -> None:
        """Remove members from this group."""
+        from .account import Account
+
        for cnt in contact:
-            if isinstance(cnt, str):
+            if isinstance(cnt, (str, Account)):
                contact_id = self.account.create_contact(cnt).id
            elif not isinstance(cnt, int):
                contact_id = cnt.id
@@ -249,6 +253,10 @@ class Chat:
        contacts = self._rpc.get_chat_contacts(self.account.id, self.id)
        return [Contact(self.account, contact_id) for contact_id in contacts]

+    def num_contacts(self) -> int:
+        """Return number of contacts in this chat."""
+        return len(self.get_contacts())
+
    def get_past_contacts(self) -> list[Contact]:
        """Get past contacts for this chat."""
        past_contacts = self._rpc.get_past_chat_contacts(self.account.id, self.id)
@@ -80,6 +80,7 @@ class EventType(str, Enum):
    CONFIG_SYNCED = "ConfigSynced"
    WEBXDC_REALTIME_DATA = "WebxdcRealtimeData"
    WEBXDC_REALTIME_ADVERTISEMENT_RECEIVED = "WebxdcRealtimeAdvertisementReceived"
+    TRANSPORTS_MODIFIED = "TransportsModified"


 class ChatId(IntEnum):
@@ -60,6 +60,10 @@ class Message:
        """Mark the message as seen."""
        self._rpc.markseen_msgs(self.account.id, [self.id])

+    def exists(self) -> bool:
+        """Return True if the message exists."""
+        return bool(self._rpc.get_existing_msg_ids(self.account.id, [self.id]))
+
    def continue_autocrypt_key_transfer(self, setup_code: str) -> None:
        """Continue the Autocrypt Setup Message key transfer.

@@ -3,9 +3,14 @@
 from __future__ import annotations

 import os
+import pathlib
+import platform
 import random
+import subprocess
+import sys
 from typing import AsyncGenerator, Optional

+import execnet
 import py
 import pytest

@@ -20,6 +25,18 @@ Currently this is "End-to-end encryption available".
 """


+def pytest_report_header():
+    for base in os.get_exec_path():
+        fn = pathlib.Path(base).joinpath(base, "deltachat-rpc-server")
+        if fn.exists():
+            proc = subprocess.Popen([str(fn), "--version"], stderr=subprocess.PIPE)
+            proc.wait()
+            version = proc.stderr.read().decode().strip()
+            return f"deltachat-rpc-server: {fn} [{version}]"
+
+    return None
+
+
 class ACFactory:
    """Test account factory."""

@@ -197,3 +214,134 @@ def log():
            print("  " + msg)

    return Printer()
+
+
+#
+# support for testing against different deltachat-rpc-server/clients
+# installed into a temporary virtualenv and connected via 'execnet' channels
+#
+
+
+def find_path(venv, name):
+    is_windows = platform.system() == "Windows"
+    bin = venv / ("bin" if not is_windows else "Scripts")
+
+    tryadd = [""]
+    if is_windows:
+        tryadd += os.environ["PATHEXT"].split(os.pathsep)
+    for ext in tryadd:
+        p = bin.joinpath(name + ext)
+        if p.exists():
+            return str(p)
+
+    return None
+
+
+@pytest.fixture(scope="session")
+def get_core_python_env(tmp_path_factory):
+    """Return a factory to create virtualenv environments with rpc server/client packages
+    installed.
+
+    The factory takes a version and returns a (python_path, rpc_server_path) tuple
+    of the respective binaries in the virtualenv.
+    """
+
+    envs = {}
+
+    def get_versioned_venv(core_version):
+        venv = envs.get(core_version)
+        if not venv:
+            venv = tmp_path_factory.mktemp(f"temp-{core_version}")
+            subprocess.check_call([sys.executable, "-m", "venv", venv])
+
+            python = find_path(venv, "python")
+            pkgs = [f"deltachat-rpc-server=={core_version}", f"deltachat-rpc-client=={core_version}", "pytest"]
+            subprocess.check_call([python, "-m", "pip", "install"] + pkgs)
+
+            envs[core_version] = venv
+        python = find_path(venv, "python")
+        rpc_server_path = find_path(venv, "deltachat-rpc-server")
+        print(f"python={python}\nrpc_server={rpc_server_path}")
+        return python, rpc_server_path
+
+    return get_versioned_venv
+
+
+@pytest.fixture
+def alice_and_remote_bob(tmp_path, acfactory, get_core_python_env):
+    """return local Alice account, a contact to bob, and a remote 'eval' function for bob.
+
+    The 'eval' function allows to remote-execute arbitrary expressions
+    that can use the `bob` online account, and the `bob_contact_alice`.
+    """
+
+    def factory(core_version):
+        python, rpc_server_path = get_core_python_env(core_version)
+        gw = execnet.makegateway(f"popen//python={python}")
+
+        accounts_dir = str(tmp_path.joinpath("account1_venv1"))
+        channel = gw.remote_exec(remote_bob_loop)
+        cm = os.environ.get("CHATMAIL_DOMAIN")
+
+        # trigger getting an online account on bob's side
+        channel.send((accounts_dir, str(rpc_server_path), cm))
+
+        # meanwhile get a local alice account
+        alice = acfactory.get_online_account()
+        channel.send(alice.self_contact.make_vcard())
+
+        # wait for bob to have started
+        sysinfo = channel.receive()
+        assert sysinfo == f"v{core_version}"
+        bob_vcard = channel.receive()
+        [alice_contact_bob] = alice.import_vcard(bob_vcard)
+
+        def eval(eval_str):
+            channel.send(eval_str)
+            return channel.receive()
+
+        return alice, alice_contact_bob, eval
+
+    return factory
+
+
+def remote_bob_loop(channel):
+    # This function executes with versioned
+    # deltachat-rpc-client/server packages
+    # installed into the virtualenv.
+    #
+    # The "channel" argument is a send/receive pipe
+    # to the process that runs the corresponding remote_exec(remote_bob_loop)
+
+    import os
+
+    from deltachat_rpc_client import DeltaChat, Rpc
+    from deltachat_rpc_client.pytestplugin import ACFactory
+
+    accounts_dir, rpc_server_path, chatmail_domain = channel.receive()
+    os.environ["CHATMAIL_DOMAIN"] = chatmail_domain
+
+    # older core versions don't support specifying rpc_server_path
+    # so we can't just pass `rpc_server_path` argument to Rpc constructor
+    basepath = os.path.dirname(rpc_server_path)
+    os.environ["PATH"] = os.pathsep.join([basepath, os.environ["PATH"]])
+    rpc = Rpc(accounts_dir=accounts_dir)
+
+    with rpc:
+        dc = DeltaChat(rpc)
+        channel.send(dc.rpc.get_system_info()["deltachat_core_version"])
+        acfactory = ACFactory(dc)
+        bob = acfactory.get_online_account()
+        alice_vcard = channel.receive()
+        [alice_contact] = bob.import_vcard(alice_vcard)
+        ns = {"bob": bob, "bob_contact_alice": alice_contact}
+        channel.send(bob.self_contact.make_vcard())
+
+        while 1:
+            eval_str = channel.receive()
+            res = eval(eval_str, ns)
+            try:
+                channel.send(res)
+            except Exception:
+                # some unserializable result
+                channel.send(None)
@@ -9,7 +9,7 @@ import os
 import subprocess
 import sys
 from queue import Empty, Queue
-from threading import Event, Thread
+from threading import Thread
 from typing import Any, Iterator, Optional


@@ -17,25 +17,6 @@ class JsonRpcError(Exception):
    """JSON-RPC error."""


-class RpcFuture:
-    """RPC future waiting for RPC call result."""
-
-    def __init__(self, rpc: "Rpc", request_id: int, event: Event):
-        self.rpc = rpc
-        self.request_id = request_id
-        self.event = event
-
-    def __call__(self):
-        """Wait for the future to return the result."""
-        self.event.wait()
-        response = self.rpc.request_results.pop(self.request_id)
-        if "error" in response:
-            raise JsonRpcError(response["error"])
-        if "result" in response:
-            return response["result"]
-        return None
-
-
 class RpcMethod:
    """RPC method."""

@@ -57,20 +38,26 @@ class RpcMethod:
            "params": args,
            "id": request_id,
        }
-        event = Event()
-        self.rpc.request_events[request_id] = event
+        self.rpc.request_results[request_id] = queue = Queue()
        self.rpc.request_queue.put(request)

-        return RpcFuture(self.rpc, request_id, event)
+        def rpc_future():
+            """Wait for the request to receive a result."""
+            response = queue.get()
+            if "error" in response:
+                raise JsonRpcError(response["error"])
+            return response.get("result", None)
+
+        return rpc_future


 class Rpc:
    """RPC client."""

-    def __init__(self, accounts_dir: Optional[str] = None, **kwargs):
+    def __init__(self, accounts_dir: Optional[str] = None, rpc_server_path="deltachat-rpc-server", **kwargs):
        """Initialize RPC client.

-        The given arguments will be passed to subprocess.Popen().
+        The 'kwargs' arguments will be passed to subprocess.Popen().
        """
        if accounts_dir:
            kwargs["env"] = {
@@ -79,13 +66,12 @@ class Rpc:
            }

        self._kwargs = kwargs
+        self.rpc_server_path = rpc_server_path
        self.process: subprocess.Popen
        self.id_iterator: Iterator[int]
        self.event_queues: dict[int, Queue]
-        # Map from request ID to `threading.Event`.
-        self.request_events: dict[int, Event]
-        # Map from request ID to the result.
-        self.request_results: dict[int, Any]
+        # Map from request ID to a Queue which provides a single result
+        self.request_results: dict[int, Queue]
        self.request_queue: Queue[Any]
        self.closing: bool
        self.reader_thread: Thread
@@ -94,27 +80,18 @@ class Rpc:

    def start(self) -> None:
        """Start RPC server subprocess."""
+        popen_kwargs = {"stdin": subprocess.PIPE, "stdout": subprocess.PIPE}
        if sys.version_info >= (3, 11):
-            self.process = subprocess.Popen(
-                "deltachat-rpc-server",
-                stdin=subprocess.PIPE,
-                stdout=subprocess.PIPE,
-                # Prevent subprocess from capturing SIGINT.
-                process_group=0,
-                **self._kwargs,
-            )
+            # Prevent subprocess from capturing SIGINT.
+            popen_kwargs["process_group"] = 0
        else:
-            self.process = subprocess.Popen(
-                "deltachat-rpc-server",
-                stdin=subprocess.PIPE,
-                stdout=subprocess.PIPE,
-                # `process_group` is not supported before Python 3.11.
-                preexec_fn=os.setpgrp,  # noqa: PLW1509
-                **self._kwargs,
-            )
+            # `process_group` is not supported before Python 3.11.
+            popen_kwargs["preexec_fn"] = os.setpgrp  # noqa: PLW1509
+
+        popen_kwargs.update(self._kwargs)
+        self.process = subprocess.Popen(self.rpc_server_path, **popen_kwargs)
        self.id_iterator = itertools.count(start=1)
        self.event_queues = {}
-        self.request_events = {}
        self.request_results = {}
        self.request_queue = Queue()
        self.closing = False
@@ -149,9 +126,7 @@ class Rpc:
                response = json.loads(line)
                if "id" in response:
                    response_id = response["id"]
-                    event = self.request_events.pop(response_id)
-                    self.request_results[response_id] = response
-                    event.set()
+                    self.request_results.pop(response_id).put(response)
                else:
                    logging.warning("Got a response without ID: %s", response)
        except Exception:
@@ -0,0 +1,44 @@
+import subprocess
+
+import pytest
+
+from deltachat_rpc_client import DeltaChat, Rpc
+
+
+def test_install_venv_and_use_other_core(tmp_path, get_core_python_env):
+    python, rpc_server_path = get_core_python_env("2.24.0")
+    subprocess.check_call([python, "-m", "pip", "install", "deltachat-rpc-server==2.24.0"])
+    rpc = Rpc(accounts_dir=tmp_path.joinpath("accounts"), rpc_server_path=rpc_server_path)
+
+    with rpc:
+        dc = DeltaChat(rpc)
+        assert dc.rpc.get_system_info()["deltachat_core_version"] == "v2.24.0"
+
+
+@pytest.mark.parametrize("version", ["2.24.0"])
+def test_qr_setup_contact(alice_and_remote_bob, version) -> None:
+    """Test other-core Bob profile can do securejoin with Alice on current core."""
+    alice, alice_contact_bob, remote_eval = alice_and_remote_bob(version)
+
+    qr_code = alice.get_qr_code()
+    remote_eval(f"bob.secure_join({qr_code!r})")
+    alice.wait_for_securejoin_inviter_success()
+
+    # Test that Alice verified Bob's profile.
+    alice_contact_bob_snapshot = alice_contact_bob.get_snapshot()
+    assert alice_contact_bob_snapshot.is_verified
+
+    remote_eval("bob.wait_for_securejoin_joiner_success()")
+
+    # Test that Bob verified Alice's profile.
+    assert remote_eval("bob_contact_alice.get_snapshot().is_verified")
+
+
+def test_send_and_receive_message(alice_and_remote_bob) -> None:
+    """Test other-core Bob profile can send a message to Alice on current core."""
+    alice, alice_contact_bob, remote_eval = alice_and_remote_bob("2.20.0")
+
+    remote_eval("bob_contact_alice.create_chat().send_text('hello')")
+
+    msg = alice.wait_for_incoming_msg()
+    assert msg.get_snapshot().text == "hello"
@@ -1,5 +1,6 @@
 import pytest

+from deltachat_rpc_client import EventType
 from deltachat_rpc_client.rpc import JsonRpcError


@@ -156,3 +157,63 @@ def test_reconfigure_transport(acfactory) -> None:
    # Reconfiguring the transport should not reset
    # the settings as if when configuring the first transport.
    assert account.get_config("mvbox_move") == "1"
+
+
+def test_transport_synchronization(acfactory, log) -> None:
+    """Test synchronization of transports between devices."""
+    ac1, ac2 = acfactory.get_online_accounts(2)
+    ac1_clone = ac1.clone()
+    ac1_clone.bring_online()
+
+    qr = acfactory.get_account_qr()
+
+    ac1.add_transport_from_qr(qr)
+    ac1_clone.wait_for_event(EventType.TRANSPORTS_MODIFIED)
+    assert len(ac1.list_transports()) == 2
+    assert len(ac1_clone.list_transports()) == 2
+
+    ac1_clone.add_transport_from_qr(qr)
+    ac1.wait_for_event(EventType.TRANSPORTS_MODIFIED)
+    assert len(ac1.list_transports()) == 3
+    assert len(ac1_clone.list_transports()) == 3
+
+    log.section("ac1 clone removes second transport")
+    [transport1, transport2, transport3] = ac1_clone.list_transports()
+    addr3 = transport3["addr"]
+    ac1_clone.delete_transport(transport2["addr"])
+
+    ac1.wait_for_event(EventType.TRANSPORTS_MODIFIED)
+    [transport1, transport3] = ac1.list_transports()
+
+    log.section("ac1 changes the primary transport")
+    ac1.set_config("configured_addr", transport3["addr"])
+
+    log.section("ac1 removes the first transport")
+    ac1.delete_transport(transport1["addr"])
+
+    ac1_clone.wait_for_event(EventType.TRANSPORTS_MODIFIED)
+    [transport3] = ac1_clone.list_transports()
+    assert transport3["addr"] == addr3
+    assert ac1_clone.get_config("configured_addr") == addr3
+
+    ac2_chat = ac2.create_chat(ac1)
+    ac2_chat.send_text("Hello!")
+
+    assert ac1.wait_for_incoming_msg().get_snapshot().text == "Hello!"
+    assert ac1_clone.wait_for_incoming_msg().get_snapshot().text == "Hello!"
+
+
+def test_recognize_self_address(acfactory) -> None:
+    alice, bob = acfactory.get_online_accounts(2)
+
+    bob_chat = bob.create_chat(alice)
+
+    qr = acfactory.get_account_qr()
+    alice.add_transport_from_qr(qr)
+
+    new_alice_addr = alice.list_transports()[1]["addr"]
+    alice.set_config("configured_addr", new_alice_addr)
+
+    bob_chat.send_text("Hello!")
+    msg = alice.wait_for_incoming_msg().get_snapshot()
+    assert msg.chat == alice.create_chat(bob)
@@ -661,8 +661,6 @@ def test_download_limit_chat_assignment(acfactory, tmp_path, n_accounts):
        contact = alice.create_contact(account)
        alice_group.add_contact(contact)

-    if n_accounts == 2:
-        bob_chat_alice = bob.create_chat(alice)
    bob.set_config("download_limit", str(download_limit))

    alice_group.send_text("hi")
@@ -678,15 +676,7 @@ def test_download_limit_chat_assignment(acfactory, tmp_path, n_accounts):
        alice_group.send_file(str(path))
        snapshot = bob.wait_for_incoming_msg().get_snapshot()
        assert snapshot.download_state == DownloadState.AVAILABLE
-        if n_accounts > 2:
-            assert snapshot.chat == bob_group
-        else:
-            # Group contains only Alice and Bob,
-            # so partially downloaded messages are
-            # hard to distinguish from private replies to group messages.
-            #
-            # Message may be a private reply, so we assign it to 1:1 chat with Alice.
-            assert snapshot.chat == bob_chat_alice
+        assert snapshot.chat == bob_group


 def test_markseen_contact_request(acfactory):
@@ -1003,3 +993,66 @@ def test_background_fetch(acfactory, dc):
        snapshot = messages[-1].get_snapshot()
        if snapshot.text == "Hello again!":
            break
+
+
+def test_message_exists(acfactory):
+    ac1, ac2 = acfactory.get_online_accounts(2)
+    chat = ac1.create_chat(ac2)
+    message1 = chat.send_text("Hello!")
+    message2 = chat.send_text("Hello again!")
+    assert message1.exists()
+    assert message2.exists()
+
+    ac1.delete_messages([message1])
+    assert not message1.exists()
+    assert message2.exists()
+
+    # There is no error when checking if
+    # the message exists for deleted account.
+    ac1.remove()
+    assert not message1.exists()
+    assert not message2.exists()
+
+
+def test_synchronize_member_list_on_group_rejoin(acfactory, log):
+    """
+    Test that user recreates group member list when it joins the group again.
+    ac1 creates a group with two other accounts: ac2 and ac3
+    Then it removes ac2, removes ac3 and adds ac2 back.
+    ac2 did not see that ac3 is removed, so it should rebuild member list from scratch.
+    """
+    log.section("setting up accounts, accepted with each other")
+    ac1, ac2, ac3 = accounts = acfactory.get_online_accounts(3)
+
+    log.section("ac1: creating group chat with 2 other members")
+    chat = ac1.create_group("title1")
+    chat.add_contact(ac2)
+    chat.add_contact(ac3)
+
+    log.section("ac1: send message to new group chat")
+    msg = chat.send_text("hello")
+    assert chat.num_contacts() == 3
+
+    log.section("checking that the chat arrived correctly")
+    for ac in accounts[1:]:
+        msg = ac.wait_for_incoming_msg().get_snapshot()
+        assert msg.text == "hello"
+        assert msg.chat.num_contacts() == 3
+        msg.chat.accept()
+
+    log.section("ac1: removing ac2")
+    chat.remove_contact(ac2)
+
+    log.section("ac2: wait for a message about removal from the chat")
+    ac2.wait_for_incoming_msg()
+    log.section("ac1: removing ac3")
+    chat.remove_contact(ac3)
+
+    log.section("ac1: adding ac2 back")
+    chat.add_contact(ac2)
+
+    log.section("ac2: check that ac3 is removed")
+    msg = ac2.wait_for_incoming_msg()
+
+    assert chat.num_contacts() == 2
+    assert msg.get_snapshot().chat.num_contacts() == 2
@@ -1,6 +1,6 @@
 [package]
 name = "deltachat-rpc-server"
-version = "2.28.0"
+version = "2.33.0"
 description = "DeltaChat JSON-RPC server"
 edition = "2021"
 readme = "README.md"
@@ -15,5 +15,5 @@
  },
  "type": "module",
  "types": "index.d.ts",
-  "version": "2.28.0"
+  "version": "2.33.0"
 }
@@ -12,6 +12,11 @@ ignore = [

    # Unmaintained paste
    "RUSTSEC-2024-0436",
+
+    # Unmaintained rustls-pemfile
+    # It is a transitive dependency of iroh 0.35.0,
+    # this should be fixed by upgrading to iroh 1.0 once it is released.
+    "RUSTSEC-2025-0134"
 ]

 [bans]
@@ -38,6 +43,7 @@ skip = [
     { name = "rand", version = "0.8.5" },
     { name = "rustix", version = "0.38.44" },
     { name = "serdect", version = "0.2.0" },
+     { name = "socket2", version = "0.5.9" },
     { name = "spin", version = "0.9.8" },
     { name = "strum_macros", version = "0.26.2" },
     { name = "strum", version = "0.26.2" },
@@ -62,7 +68,6 @@ skip = [
     { name = "windows_x86_64_gnu" },
     { name = "windows_x86_64_gnullvm" },
     { name = "windows_x86_64_msvc" },
-     { name = "zerocopy", version = "0.7.32" },
 ]


@@ -1,20 +1,20 @@
 [build-system]
-requires = ["setuptools>=45", "wheel", "cffi>=1.0.0", "pkgconfig"]
+requires = ["setuptools>=77", "wheel", "cffi>=1.0.0", "pkgconfig"]
 build-backend = "setuptools.build_meta"

 [project]
 name = "deltachat"
-version = "2.28.0"
+version = "2.33.0"
+license = "MPL-2.0"
 description = "Python bindings for the Delta Chat Core library using CFFI against the Rust-implemented libdeltachat"
 readme = "README.rst"
-requires-python = ">=3.8"
+requires-python = ">=3.10"
 authors = [
    { name = "holger krekel, Floris Bruynooghe, Bjoern Petersen and contributors" },
 ]
 classifiers = [
    "Development Status :: 5 - Production/Stable",
    "Intended Audience :: Developers",
-    "License :: OSI Approved :: Mozilla Public License 2.0 (MPL 2.0)",
    "Programming Language :: Python :: 3",
    "Topic :: Communications :: Chat",
    "Topic :: Communications :: Email",
@@ -23,7 +23,6 @@ classifiers = [
 dependencies = [
    "cffi>=1.0.0",
    "imap-tools",
-    "importlib_metadata;python_version<'3.8'",
    "pluggy",
    "requests",
 ]
@@ -1,4 +1,3 @@
-import sys
 import time

 import deltachat as dc
@@ -63,56 +62,6 @@ class TestGroupStressTests:
        # Message should be encrypted because keys of other members are gossiped
        assert msg.is_encrypted()

-    def test_synchronize_member_list_on_group_rejoin(self, acfactory, lp):
-        """
-        Test that user recreates group member list when it joins the group again.
-        ac1 creates a group with two other accounts: ac2 and ac3
-        Then it removes ac2, removes ac3 and adds ac2 back.
-        ac2 did not see that ac3 is removed, so it should rebuild member list from scratch.
-        """
-        lp.sec("setting up accounts, accepted with each other")
-        accounts = acfactory.get_online_accounts(3)
-        acfactory.introduce_each_other(accounts)
-        ac1, ac2, ac3 = accounts
-
-        lp.sec("ac1: creating group chat with 2 other members")
-        chat = ac1.create_group_chat("title1", contacts=[ac2, ac3])
-        assert not chat.is_promoted()
-
-        lp.sec("ac1: send message to new group chat")
-        msg = chat.send_text("hello")
-        assert chat.is_promoted() and msg.is_encrypted()
-
-        assert chat.num_contacts() == 3
-
-        lp.sec("checking that the chat arrived correctly")
-        for ac in accounts[1:]:
-            msg = ac._evtracker.wait_next_incoming_message()
-            assert msg.text == "hello"
-            print("chat is", msg.chat)
-            assert msg.chat.num_contacts() == 3
-
-        lp.sec("ac1: removing ac2")
-        chat.remove_contact(ac2)
-
-        lp.sec("ac2: wait for a message about removal from the chat")
-        msg = ac2._evtracker.wait_next_incoming_message()
-
-        lp.sec("ac1: removing ac3")
-        chat.remove_contact(ac3)
-
-        lp.sec("ac1: adding ac2 back")
-        # Group is promoted, message is sent automatically
-        assert chat.is_promoted()
-        chat.add_contact(ac2)
-
-        lp.sec("ac2: check that ac3 is removed")
-        msg = ac2._evtracker.wait_next_incoming_message()
-
-        assert chat.num_contacts() == 2
-        assert msg.chat.num_contacts() == 2
-        acfactory.dump_imap_summary(sys.stdout)
-

 def test_qr_verified_group_and_chatting(acfactory, lp):
    ac1, ac2, ac3 = acfactory.get_online_accounts(3)
@@ -1 +1 @@
-2025-11-23
+2025-12-05
@@ -26,10 +26,10 @@ and an own build machine.
   i.e. `deltachat-rpc-client` and `deltachat-rpc-server`.

 - `remote_tests_python.sh` rsyncs to a build machine and runs
-  `run-python-test.sh` remotely on the build machine. 
+  JSON-RPC Python tests remotely on the build machine. 

 - `remote_tests_rust.sh` rsyncs to the build machine and runs
-  `run-rust-test.sh` remotely on the build machine. 
+  Rust tests remotely on the build machine. 

 - `run-doxygen.sh` generates C-docs which are then uploaded to https://c.delta.chat/

@@ -1,45 +1,32 @@
-#!/bin/bash 
+#!/usr/bin/env bash
+set -euo pipefail

-BUILD_ID=${1:?specify build ID}
-
-SSHTARGET=${SSHTARGET-ci@b1.delta.chat}
-BUILDDIR=ci_builds/$BUILD_ID
+set -x
+if ! test -v SSHTARGET; then
+	echo >&2 SSHTARGET is not set
+	exit 1
+fi
+BUILDDIR=ci_builds/chatmailcore

 echo "--- Copying files to $SSHTARGET:$BUILDDIR"

-set -xe
-
-ssh -oBatchMode=yes -oStrictHostKeyChecking=no  $SSHTARGET mkdir -p "$BUILDDIR"
-git ls-files >.rsynclist 
-# we seem to need .git for setuptools_scm versioning 
-find .git >>.rsynclist
-rsync --delete --files-from=.rsynclist -az ./ "$SSHTARGET:$BUILDDIR"
-
-set +x
+rsync -az --delete --mkpath --files-from=<(git ls-files) ./ "$SSHTARGET:$BUILDDIR"

 echo "--- Running Python tests remotely"

-ssh $SSHTARGET <<_HERE
+ssh -oBatchMode=yes -- "$SSHTARGET" <<_HERE
    set +x -e

    # make sure all processes exit when ssh dies
    shopt -s huponexit

-    export RUSTC_WRAPPER=\`which sccache\`
+    export RUSTC_WRAPPER=\`command -v sccache\`
    cd $BUILDDIR
-    export TARGET=release
    export CHATMAIL_DOMAIN=$CHATMAIL_DOMAIN

-    #we rely on tox/virtualenv being available in the host
-    #rm -rf virtualenv venv
-    #virtualenv -q -p python3.7 venv 
-    #source venv/bin/activate
-    #pip install -q tox virtualenv
+    scripts/make-rpc-testenv.sh
+    . venv/bin/activate

-    set -x
-    which python
-    source \$HOME/venv/bin/activate
-    which python
-
-    bash scripts/run-python-test.sh 
+    cd deltachat-rpc-client
+    pytest -n6 $@
 _HERE
@@ -1,29 +1,25 @@
-#!/bin/bash 
+#!/usr/bin/env bash
+set -euo pipefail

-BUILD_ID=${1:?specify build ID}
-
-SSHTARGET=${SSHTARGET-ci@b1.delta.chat}
-BUILDDIR=ci_builds/$BUILD_ID
-
-set -e
+if ! test -v SSHTARGET; then
+        echo >&2 SSHTARGET is not set
+        exit 1
+fi
+BUILDDIR=ci_builds/chatmailcore

 echo "--- Copying files to $SSHTARGET:$BUILDDIR"

-ssh -oBatchMode=yes -oStrictHostKeyChecking=no $SSHTARGET mkdir -p "$BUILDDIR"
-git ls-files >.rsynclist
-rsync --delete --files-from=.rsynclist -az ./ "$SSHTARGET:$BUILDDIR"
+rsync -az --delete --mkpath --files-from=<(git ls-files) ./ "$SSHTARGET:$BUILDDIR"

 echo "--- Running Rust tests remotely"

-ssh $SSHTARGET <<_HERE
+ssh -oBatchMode=yes -- "$SSHTARGET" <<_HERE
    set +x -e
    # make sure all processes exit when ssh dies
    shopt -s huponexit
-    export RUSTC_WRAPPER=\`which sccache\`
+    export RUSTC_WRAPPER=\`command -v sccache\`
    cd $BUILDDIR
-    export TARGET=x86_64-unknown-linux-gnu
-    export RUSTC_WRAPPER=sccache

-    bash scripts/run-rust-test.sh
+    cargo nextest run
 _HERE

@@ -31,6 +31,6 @@ unset CHATMAIL_DOMAIN

 # Try to build wheels for a range of interpreters, but don't fail if they are not available.
 # E.g. musllinux_1_1 does not have PyPy interpreters as of 2022-07-10
-tox --workdir "$TOXWORKDIR" -e py38,py39,py310,py311,py312,py313,pypy38,pypy39,pypy310 --skip-missing-interpreters true
+tox --workdir "$TOXWORKDIR" -e py310,py311,py312,py313,pypy310 --skip-missing-interpreters true

 auditwheel repair "$TOXWORKDIR"/wheelhouse/deltachat* -w "$TOXWORKDIR/wheelhouse"
@@ -377,6 +377,11 @@ impl Accounts {
                "Starting background fetch for {n_accounts} accounts."
            )),
        });
+        ::tracing::event!(
+            ::tracing::Level::INFO,
+            account_id = 0,
+            "Starting background fetch for {n_accounts} accounts."
+        );
        let mut set = JoinSet::new();
        for account in accounts {
            set.spawn(async move {
@@ -392,6 +397,11 @@ impl Accounts {
                "Finished background fetch for {n_accounts} accounts."
            )),
        });
+        ::tracing::event!(
+            ::tracing::Level::INFO,
+            account_id = 0,
+            "Finished background fetch for {n_accounts} accounts."
+        );
    }

    /// Auxiliary function for [Accounts::background_fetch].
@@ -429,6 +439,11 @@ impl Accounts {
                id: 0,
                typ: EventType::Warning("Background fetch timed out.".to_string()),
            });
+            ::tracing::event!(
+                ::tracing::Level::WARN,
+                account_id = 0,
+                "Background fetch timed out."
+            );
        }
        events.emit(Event {
            id: 0,
@@ -3,8 +3,11 @@ use std::time::Duration;
 use super::*;
 use crate::message::{Message, Viewtype};
 use crate::param::Param;
+use crate::securejoin::{get_securejoin_qr, join_securejoin};
 use crate::sql;
-use crate::test_utils::{self, AVATAR_64x64_BYTES, AVATAR_64x64_DEDUPLICATED, TestContext};
+use crate::test_utils::{
+    self, AVATAR_64x64_BYTES, AVATAR_64x64_DEDUPLICATED, TestContext, TestContextManager,
+};
 use crate::tools::SystemTime;

 fn check_image_size(path: impl AsRef<Path>, width: u32, height: u32) -> image::DynamicImage {
@@ -173,11 +176,8 @@ async fn test_selfavatar_outside_blobdir() {
        .unwrap();
    let avatar_blob = t.get_config(Config::Selfavatar).await.unwrap().unwrap();
    let avatar_path = Path::new(&avatar_blob);
-    assert!(
-        avatar_blob.ends_with("7dde69e06b5ae6c27520a436bbfd65b.jpg"),
-        "The avatar filename should be its hash, put instead it's {avatar_blob}"
-    );
    let scaled_avatar_size = file_size(avatar_path).await;
+    info!(&t, "Scaled avatar size: {scaled_avatar_size}.");
    assert!(scaled_avatar_size < avatar_bytes.len() as u64);

    check_image_size(avatar_src, 1000, 1000);
@@ -187,6 +187,11 @@ async fn test_selfavatar_outside_blobdir() {
        constants::BALANCED_AVATAR_SIZE,
    );

+    assert!(
+        avatar_blob.ends_with("2a048b6fcd86448032b854ea1ad7608.jpg"),
+        "The avatar filename should be its hash, but instead it's {avatar_blob}"
+    );
+
    let mut blob = BlobObject::create_and_deduplicate(&t, avatar_path, avatar_path).unwrap();
    let viewtype = &mut Viewtype::Image;
    let strict_limits = true;
@@ -796,3 +801,33 @@ async fn test_create_and_deduplicate_from_bytes() -> Result<()> {

    Ok(())
 }
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn test_user_deletes_chat_before_securejoin_completes() -> Result<()> {
+    let mut tcm = TestContextManager::new();
+    let alice = &tcm.alice().await;
+    let bob = &tcm.bob().await;
+
+    let qr = get_securejoin_qr(alice, None).await?;
+    let bob_chat_id = join_securejoin(bob, &qr).await?;
+
+    let bob_alice_chat = bob.get_chat(alice).await;
+    // It's not possible yet to send to the chat, because Bob doesn't have Alice's key:
+    assert_eq!(bob_alice_chat.can_send(bob).await?, false);
+    assert_eq!(bob_alice_chat.id, bob_chat_id);
+
+    let request = bob.pop_sent_msg().await;
+
+    bob_chat_id.delete(bob).await?;
+
+    alice.recv_msg_trash(&request).await;
+    let auth_required = alice.pop_sent_msg().await;
+
+    bob.recv_msg_trash(&auth_required).await;
+
+    // The chat with Alice should be recreated,
+    // and it should be sendable now:
+    assert!(bob.get_chat(alice).await.can_send(bob).await?);
+
+    Ok(())
+}
@@ -6,15 +6,15 @@ use crate::chat::ChatIdBlocked;
 use crate::chat::{Chat, ChatId, send_msg};
 use crate::constants::{Blocked, Chattype};
 use crate::contact::ContactId;
-use crate::context::Context;
+use crate::context::{Context, WeakContext};
 use crate::events::EventType;
 use crate::headerdef::HeaderDef;
 use crate::log::warn;
-use crate::message::{self, Message, MsgId, Viewtype};
+use crate::message::{Message, MsgId, Viewtype};
 use crate::mimeparser::{MimeMessage, SystemMessage};
 use crate::net::dns::lookup_host_with_cache;
 use crate::param::Param;
-use crate::tools::time;
+use crate::tools::{normalize_text, time};
 use anyhow::{Context as _, Result, ensure};
 use sdp::SessionDescription;
 use serde::Serialize;
@@ -33,7 +33,7 @@ use tokio::time::sleep;
 ///
 /// For the caller, this means they should also not wait longer,
 /// as the callee won't start the call afterwards.
-const RINGING_SECONDS: i64 = 60;
+const RINGING_SECONDS: i64 = 120;

 // For persisting parameters in the call, we use Param::Arg*

@@ -86,7 +86,7 @@ impl CallInfo {
            .sql
            .execute(
                "UPDATE msgs SET txt=?, txt_normalized=? WHERE id=?",
-                (text, message::normalize_text(text), self.msg.id),
+                (text, normalize_text(text), self.msg.id),
            )
            .await?;
        Ok(())
@@ -199,8 +199,9 @@ impl Context {
        call.id = send_msg(self, chat_id, &mut call).await?;

        let wait = RINGING_SECONDS;
+        let context = self.get_weak_context();
        task::spawn(Context::emit_end_call_if_unaccepted(
-            self.clone(),
+            context,
            wait.try_into()?,
            call.id,
        ));
@@ -291,11 +292,12 @@ impl Context {
    }

    async fn emit_end_call_if_unaccepted(
-        context: Context,
+        context: WeakContext,
        wait: u64,
        call_id: MsgId,
    ) -> Result<()> {
        sleep(Duration::from_secs(wait)).await;
+        let context = context.upgrade()?;
        let Some(mut call) = context.load_call_by_id(call_id).await? else {
            warn!(
                context,
@@ -368,8 +370,9 @@ impl Context {
                        }
                    }
                    let wait = call.remaining_ring_seconds();
+                    let context = self.get_weak_context();
                    task::spawn(Context::emit_end_call_if_unaccepted(
-                        self.clone(),
+                        context,
                        wait.try_into()?,
                        call.msg.id,
                    ));
@@ -45,7 +45,7 @@ use crate::sync::{self, Sync::*, SyncData};
 use crate::tools::{
    IsNoneOrEmpty, SystemTime, buf_compress, create_broadcast_secret, create_id,
    create_outgoing_rfc724_mid, create_smeared_timestamp, create_smeared_timestamps, get_abs_path,
-    gm2local_offset, smeared_time, time, truncate_msg_text,
+    gm2local_offset, normalize_text, smeared_time, time, truncate_msg_text,
 };
 use crate::webxdc::StatusUpdateSerial;
 use crate::{chatlist_events, imap};
@@ -286,10 +286,11 @@ impl ChatId {
        let timestamp = cmp::min(timestamp, smeared_time(context));
        let row_id =
            context.sql.insert(
-                "INSERT INTO chats (type, name, grpid, blocked, created_timestamp, protected, param) VALUES(?, ?, ?, ?, ?, 0, ?);",
+                "INSERT INTO chats (type, name, name_normalized, grpid, blocked, created_timestamp, protected, param) VALUES(?, ?, ?, ?, ?, ?, 0, ?)",
                (
                    chattype,
                    &grpname,
+                    normalize_text(&grpname),
                    grpid,
                    create_blocked,
                    timestamp,
@@ -782,7 +783,7 @@ impl ChatId {
                                    time(),
                                    msg.viewtype,
                                    &msg.text,
-                                    message::normalize_text(&msg.text),
+                                    normalize_text(&msg.text),
                                    msg.param.to_string(),
                                    msg.in_reply_to.as_deref().unwrap_or_default(),
                                    msg.id,
@@ -823,7 +824,7 @@ impl ChatId {
                        msg.viewtype,
                        MessageState::OutDraft,
                        &msg.text,
-                        message::normalize_text(&msg.text),
+                        normalize_text(&msg.text),
                        msg.param.to_string(),
                        1,
                        msg.in_reply_to.as_deref().unwrap_or_default(),
@@ -1919,7 +1920,7 @@ impl Chat {
                        msg.viewtype,
                        msg.state,
                        msg_text,
-                        message::normalize_text(&msg_text),
+                        normalize_text(&msg_text),
                        &msg.subject,
                        msg.param.to_string(),
                        msg.hidden,
@@ -1970,7 +1971,7 @@ impl Chat {
                        msg.viewtype,
                        msg.state,
                        msg_text,
-                        message::normalize_text(&msg_text),
+                        normalize_text(&msg_text),
                        &msg.subject,
                        msg.param.to_string(),
                        msg.hidden,
@@ -2274,8 +2275,8 @@ async fn update_special_chat_name(
        context
            .sql
            .execute(
-                "UPDATE chats SET name=? WHERE id=? AND name!=?",
-                (&name, chat_id, &name),
+                "UPDATE chats SET name=?, name_normalized=? WHERE id=? AND name!=?",
+                (&name, normalize_text(&name), chat_id, &name),
            )
            .await?;
    }
@@ -2388,11 +2389,12 @@ impl ChatIdBlocked {
            .transaction(move |transaction| {
                transaction.execute(
                    "INSERT INTO chats
-                     (type, name, param, blocked, created_timestamp)
-                     VALUES(?, ?, ?, ?, ?)",
+                     (type, name, name_normalized, param, blocked, created_timestamp)
+                     VALUES(?, ?, ?, ?, ?, ?)",
                    (
                        Chattype::Single,
-                        chat_name,
+                        &chat_name,
+                        normalize_text(&chat_name),
                        params.to_string(),
                        create_blocked as u8,
                        smeared_time,
@@ -2944,7 +2946,7 @@ pub(crate) async fn save_text_edit_to_db(
            "UPDATE msgs SET txt=?, txt_normalized=?, param=? WHERE id=?",
            (
                new_text,
-                message::normalize_text(new_text),
+                normalize_text(new_text),
                original_msg.param.to_string(),
                original_msg.id,
            ),
@@ -3433,9 +3435,15 @@ pub(crate) async fn create_group_ex(
        .sql
        .insert(
            "INSERT INTO chats
-        (type, name, grpid, param, created_timestamp)
-        VALUES(?, ?, ?, \'U=1\', ?);",
-            (Chattype::Group, &chat_name, &grpid, timestamp),
+        (type, name, name_normalized, grpid, param, created_timestamp)
+        VALUES(?, ?, ?, ?, \'U=1\', ?)",
+            (
+                Chattype::Group,
+                &chat_name,
+                normalize_text(&chat_name),
+                &grpid,
+                timestamp,
+            ),
        )
        .await?;

@@ -3519,9 +3527,15 @@ pub(crate) async fn create_out_broadcast_ex(

        t.execute(
            "INSERT INTO chats
-            (type, name, grpid, created_timestamp)
-            VALUES(?, ?, ?, ?);",
-            (Chattype::OutBroadcast, &chat_name, &grpid, timestamp),
+            (type, name, name_normalized, grpid, created_timestamp)
+            VALUES(?, ?, ?, ?, ?)",
+            (
+                Chattype::OutBroadcast,
+                &chat_name,
+                normalize_text(&chat_name),
+                &grpid,
+                timestamp,
+            ),
        )?;
        let chat_id = ChatId::new(t.last_insert_rowid().try_into()?);

@@ -3730,10 +3744,16 @@ pub(crate) async fn add_contact_to_chat_ex(
        chat.typ != Chattype::OutBroadcast || contact_id != ContactId::SELF,
        "Cannot add SELF to broadcast channel."
    );
-    ensure!(
-        chat.is_encrypted(context).await? == contact.is_key_contact(),
-        "Only key-contacts can be added to encrypted chats"
-    );
+    match chat.is_encrypted(context).await? {
+        true => ensure!(
+            contact.is_key_contact(),
+            "Only key-contacts can be added to encrypted chats"
+        ),
+        false => ensure!(
+            !contact.is_key_contact(),
+            "Only address-contacts can be added to unencrypted chats"
+        ),
+    }

    if !chat.is_self_in_chat(context).await? {
        context.emit_event(EventType::ErrorSelfNotInGroup(
@@ -4088,8 +4108,8 @@ async fn rename_ex(
            context
                .sql
                .execute(
-                    "UPDATE chats SET name=? WHERE id=?;",
-                    (new_name.to_string(), chat_id),
+                    "UPDATE chats SET name=?, name_normalized=? WHERE id=?",
+                    (&new_name, normalize_text(&new_name), chat_id),
                )
                .await?;
            if chat.is_promoted()
@@ -4183,6 +4203,16 @@ pub async fn set_chat_profile_image(

 /// Forwards multiple messages to a chat.
 pub async fn forward_msgs(context: &Context, msg_ids: &[MsgId], chat_id: ChatId) -> Result<()> {
+    forward_msgs_2ctx(context, msg_ids, context, chat_id).await
+}
+
+/// Forwards multiple messages to a chat in another context.
+pub async fn forward_msgs_2ctx(
+    ctx_src: &Context,
+    msg_ids: &[MsgId],
+    ctx_dst: &Context,
+    chat_id: ChatId,
+) -> Result<()> {
    ensure!(!msg_ids.is_empty(), "empty msgs_ids: nothing to forward");
    ensure!(!chat_id.is_special(), "can not forward to special chat");

@@ -4190,16 +4220,16 @@ pub async fn forward_msgs(context: &Context, msg_ids: &[MsgId], chat_id: ChatId)
    let mut curr_timestamp: i64;

    chat_id
-        .unarchive_if_not_muted(context, MessageState::Undefined)
+        .unarchive_if_not_muted(ctx_dst, MessageState::Undefined)
        .await?;
-    let mut chat = Chat::load_from_db(context, chat_id).await?;
-    if let Some(reason) = chat.why_cant_send(context).await? {
+    let mut chat = Chat::load_from_db(ctx_dst, chat_id).await?;
+    if let Some(reason) = chat.why_cant_send(ctx_dst).await? {
        bail!("cannot send to {chat_id}: {reason}");
    }
-    curr_timestamp = create_smeared_timestamps(context, msg_ids.len());
+    curr_timestamp = create_smeared_timestamps(ctx_dst, msg_ids.len());
    let mut msgs = Vec::with_capacity(msg_ids.len());
    for id in msg_ids {
-        let ts: i64 = context
+        let ts: i64 = ctx_src
            .sql
            .query_get_value("SELECT timestamp FROM msgs WHERE id=?", (id,))
            .await?
@@ -4209,11 +4239,14 @@ pub async fn forward_msgs(context: &Context, msg_ids: &[MsgId], chat_id: ChatId)
    msgs.sort_unstable();
    for (_, id) in msgs {
        let src_msg_id: MsgId = id;
-        let mut msg = Message::load_from_db(context, src_msg_id).await?;
+        let mut msg = Message::load_from_db(ctx_src, src_msg_id).await?;
        if msg.state == MessageState::OutDraft {
            bail!("cannot forward drafts.");
        }

+        let mut param = msg.param;
+        msg.param = Params::new();
+
        if msg.get_viewtype() != Viewtype::Sticker {
            msg.param
                .set_int(Param::Forwarded, src_msg_id.to_u32() as i32);
@@ -4223,17 +4256,16 @@ pub async fn forward_msgs(context: &Context, msg_ids: &[MsgId], chat_id: ChatId)
            msg.viewtype = Viewtype::Text;
        }

-        msg.param.remove(Param::GuaranteeE2ee);
-        msg.param.remove(Param::ForcePlaintext);
-        msg.param.remove(Param::Cmd);
-        msg.param.remove(Param::OverrideSenderDisplayname);
-        msg.param.remove(Param::WebxdcDocument);
-        msg.param.remove(Param::WebxdcDocumentTimestamp);
-        msg.param.remove(Param::WebxdcSummary);
-        msg.param.remove(Param::WebxdcSummaryTimestamp);
-        msg.param.remove(Param::IsEdited);
-        msg.param.remove(Param::WebrtcRoom);
-        msg.param.remove(Param::WebrtcAccepted);
+        let param = &mut param;
+        msg.param.steal(param, Param::File);
+        msg.param.steal(param, Param::Filename);
+        msg.param.steal(param, Param::Width);
+        msg.param.steal(param, Param::Height);
+        msg.param.steal(param, Param::Duration);
+        msg.param.steal(param, Param::MimeType);
+        msg.param.steal(param, Param::ProtectQuote);
+        msg.param.steal(param, Param::Quote);
+        msg.param.steal(param, Param::Summary1);
        msg.in_reply_to = None;

        // do not leak data as group names; a default subject is generated by mimefactory
@@ -4242,16 +4274,16 @@ pub async fn forward_msgs(context: &Context, msg_ids: &[MsgId], chat_id: ChatId)
        msg.state = MessageState::OutPending;
        msg.rfc724_mid = create_outgoing_rfc724_mid();
        msg.timestamp_sort = curr_timestamp;
-        chat.prepare_msg_raw(context, &mut msg, None).await?;
+        chat.prepare_msg_raw(ctx_dst, &mut msg, None).await?;

        curr_timestamp += 1;
-        if !create_send_msg_jobs(context, &mut msg).await?.is_empty() {
-            context.scheduler.interrupt_smtp().await;
+        if !create_send_msg_jobs(ctx_dst, &mut msg).await?.is_empty() {
+            ctx_dst.scheduler.interrupt_smtp().await;
        }
        created_msgs.push(msg.id);
    }
    for msg_id in created_msgs {
-        context.emit_msgs_changed(chat_id, msg_id);
+        ctx_dst.emit_msgs_changed(chat_id, msg_id);
    }
    Ok(())
 }
@@ -4523,7 +4555,7 @@ pub async fn add_device_msg_with_importance(
                    msg.viewtype,
                    state,
                    &msg.text,
-                    message::normalize_text(&msg.text),
+                    normalize_text(&msg.text),
                    msg.param.to_string(),
                    rfc724_mid,
                ),
@@ -4662,7 +4694,7 @@ pub(crate) async fn add_info_msg_with_cmd(
            Viewtype::Text,
            MessageState::InNoticed,
            text,
-            message::normalize_text(text),
+            normalize_text(text),
            rfc724_mid,
            ephemeral_timer,
            param.to_string(),
@@ -4704,7 +4736,7 @@ pub(crate) async fn update_msg_text_and_timestamp(
        .sql
        .execute(
            "UPDATE msgs SET txt=?, txt_normalized=?, timestamp=? WHERE id=?;",
-            (text, message::normalize_text(text), timestamp, msg_id),
+            (text, normalize_text(text), timestamp, msg_id),
        )
        .await?;
    context.emit_msgs_changed(chat_id, msg_id);
@@ -815,15 +815,6 @@ async fn test_self_talk() -> Result<()> {
    assert!(msg.get_showpadlock());

    let sent_msg = t.pop_sent_msg().await;
-    let payload = sent_msg.payload();
-    // Make sure the `To` field contains the address and not
-    // "undisclosed recipients".
-    // Otherwise Delta Chat core <1.153.0 assigns the message
-    // to the trash chat.
-    assert_eq!(
-        payload.match_indices("To: <alice@example.org>\r\n").count(),
-        1
-    );

    let t2 = TestContext::new_alice().await;
    t2.recv_msg(&sent_msg).await;
@@ -3321,10 +3312,7 @@ async fn test_leave_broadcast_multidevice() -> Result<()> {

    let leave_msg = bob0.pop_sent_msg().await;
    let parsed = MimeMessage::from_bytes(bob1, leave_msg.payload().as_bytes(), None).await?;
-    assert_eq!(
-        parsed.parts[0].msg,
-        stock_str::msg_group_left_remote(bob0).await
-    );
+    assert_eq!(parsed.parts[0].msg, "I left the group.");

    let rcvd = bob1.recv_msg(&leave_msg).await;

@@ -5252,6 +5240,44 @@ async fn test_send_delete_request_no_encryption() -> Result<()> {
    Ok(())
 }

+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn test_forward_msgs_2ctx() -> Result<()> {
+    let mut tcm = TestContextManager::new();
+    let alice = &tcm.alice().await;
+    let bob = &tcm.bob().await;
+
+    let alice_chat = alice.create_chat(bob).await;
+    let alice_sent = alice.send_text(alice_chat.id, "hi").await;
+    let bob_alice_msg = bob.recv_msg(&alice_sent).await;
+    let bob_chat_id = bob_alice_msg.chat_id;
+    bob_chat_id.accept(bob).await?;
+
+    let bob_text = "Hi, did you know we're using the same device so i have access to your profile?";
+    let bob_sent = bob.send_text(bob_chat_id, bob_text).await;
+    alice.recv_msg(&bob_sent).await;
+    let alice_chat_len = alice_chat.id.get_msg_cnt(alice).await?;
+
+    forward_msgs_2ctx(
+        bob,
+        &[bob_alice_msg.id, bob_sent.sender_msg_id],
+        alice,
+        alice_chat.id,
+    )
+    .await?;
+    assert_eq!(alice_chat.id.get_msg_cnt(alice).await?, alice_chat_len + 2);
+    let msg = alice.get_last_msg().await;
+    assert!(msg.is_forwarded());
+    assert_eq!(msg.text, bob_text);
+    assert_eq!(msg.from_id, ContactId::SELF);
+
+    let sent = alice.pop_sent_msg().await;
+    let msg = bob.recv_msg(&sent).await;
+    assert!(msg.is_forwarded());
+    assert_eq!(msg.text, bob_text);
+    assert_eq!(msg.from_id, bob_alice_msg.from_id);
+    Ok(())
+}
+
 /// Tests that in multi-device setup
 /// second device learns the key of a contact
 /// via Autocrypt-Gossip in 1:1 chats.
@@ -185,7 +185,7 @@ impl Chatlist {
                warn!(context, "Cannot update special chat names: {err:#}.")
            }

-            let str_like_cmd = format!("%{query}%");
+            let str_like_cmd = format!("%{}%", query.to_lowercase());
            context
                .sql
                .query_map_vec(
@@ -201,7 +201,7 @@ impl Chatlist {
                                  ORDER BY timestamp DESC, id DESC LIMIT 1)
                 WHERE c.id>9 AND c.id!=?2
                   AND c.blocked!=1
-                   AND c.name LIKE ?3
+                   AND IFNULL(c.name_normalized,c.name) LIKE ?3
                   AND (NOT ?4 OR EXISTS (SELECT 1 FROM msgs m WHERE m.chat_id = c.id AND m.state == ?5 AND hidden=0))
                 GROUP BY c.id
                 ORDER BY IFNULL(m.timestamp,c.created_timestamp) DESC, m.id DESC;",
@@ -472,7 +472,7 @@ mod tests {
    use crate::chat::save_msgs;
    use crate::chat::{
        add_contact_to_chat, create_group, get_chat_contacts, remove_contact_from_chat,
-        send_text_msg,
+        send_text_msg, set_chat_name,
    };
    use crate::receive_imf::receive_imf;
    use crate::stock_str::StockMessage;
@@ -482,7 +482,7 @@ mod tests {
    use std::time::Duration;

    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-    async fn test_try_load() {
+    async fn test_try_load() -> Result<()> {
        let mut tcm = TestContextManager::new();
        let bob = &tcm.bob().await;
        let chat_id1 = create_group(bob, "a chat").await.unwrap();
@@ -552,6 +552,15 @@ mod tests {
            .await
            .unwrap();
        assert_eq!(chats.len(), 1);
+
+        let chat_id = create_group(bob, "Δ-chat").await.unwrap();
+        let chats = Chatlist::try_load(bob, 0, Some("δ"), None).await?;
+        assert_eq!(chats.len(), 1);
+        assert_eq!(chats.ids[0].0, chat_id);
+        set_chat_name(bob, chat_id, "abcδe").await?;
+        let chats = Chatlist::try_load(bob, 0, Some("Δ"), None).await?;
+        assert_eq!(chats.len(), 1);
+        Ok(())
    }

    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
@@ -13,15 +13,14 @@ use strum_macros::{AsRefStr, Display, EnumIter, EnumString};
 use tokio::fs;

 use crate::blob::BlobObject;
-use crate::configure::EnteredLoginParam;
 use crate::context::Context;
 use crate::events::EventType;
 use crate::log::LogExt;
 use crate::mimefactory::RECOMMENDED_FILE_SIZE;
-use crate::provider::{Provider, get_provider_by_id};
+use crate::provider::Provider;
 use crate::sync::{self, Sync::*, SyncData};
 use crate::tools::get_abs_path;
-use crate::transport::ConfiguredLoginParam;
+use crate::transport::{ConfiguredLoginParam, add_pseudo_transport};
 use crate::{constants, stats};

 /// The available configuration keys.
@@ -204,7 +203,7 @@ pub enum Config {
    /// `ProviderOptions::delete_to_trash`.
    DeleteToTrash,

-    /// The primary email address. Also see `SecondaryAddrs`.
+    /// The primary email address.
    ConfiguredAddr,

    /// List of configured IMAP servers as a JSON array.
@@ -306,10 +305,6 @@ pub enum Config {
    /// Meant to help profile owner to differ between profiles with similar names.
    PrivateTag,

-    /// All secondary self addresses separated by spaces
-    /// (`addr1@example.org addr2@example.org addr3@example.org`)
-    SecondaryAddrs,
-
    /// Read-only core version string.
    #[strum(serialize = "sys.version")]
    SysVersion,
@@ -646,15 +641,14 @@ impl Context {
        Ok(val)
    }

-    /// Gets the configured provider, as saved in the `configured_provider` value.
+    /// Gets the configured provider.
    ///
-    /// The provider is determined by `get_provider_info()` during configuration and then saved
-    /// to the db in `param.save_to_database()`, together with all the other `configured_*` values.
+    /// The provider is determined by the current primary transport.
    pub async fn get_configured_provider(&self) -> Result<Option<&'static Provider>> {
-        if let Some(cfg) = self.get_config(Config::ConfiguredProvider).await? {
-            return Ok(get_provider_by_id(&cfg));
-        }
-        Ok(None)
+        let provider = ConfiguredLoginParam::load(self)
+            .await?
+            .and_then(|(_transport_id, param)| param.provider);
+        Ok(provider)
    }

    /// Gets configured "delete_device_after" value.
@@ -820,11 +814,10 @@ impl Context {
                        self,
                        "Creating a pseudo configured account which will not be able to send or receive messages. Only meant for tests!"
                    );
-                    ConfiguredLoginParam::from_json(&format!(
-                        r#"{{"addr":"{addr}","imap":[],"imap_user":"","imap_password":"","smtp":[],"smtp_user":"","smtp_password":"","certificate_checks":"Automatic","oauth2":false}}"#
-                    ))?
-                    .save_to_transports_table(self, &EnteredLoginParam::default())
-                    .await?;
+                    add_pseudo_transport(self, addr).await?;
+                    self.sql
+                        .set_raw_config(Config::ConfiguredAddr.as_ref(), Some(addr))
+                        .await?;
                }
                self.sql
                    .transaction(|transaction| {
@@ -951,16 +944,6 @@ impl Context {
    pub(crate) async fn set_primary_self_addr(&self, primary_new: &str) -> Result<()> {
        self.quota.write().await.take();

-        // add old primary address (if exists) to secondary addresses
-        let mut secondary_addrs = self.get_all_self_addrs().await?;
-        // never store a primary address also as a secondary
-        secondary_addrs.retain(|a| !addr_cmp(a, primary_new));
-        self.set_config_internal(
-            Config::SecondaryAddrs,
-            Some(secondary_addrs.join(" ").as_str()),
-        )
-        .await?;
-
        self.sql
            .set_raw_config(Config::ConfiguredAddr.as_ref(), Some(primary_new))
            .await?;
@@ -978,14 +961,10 @@ impl Context {

    /// Returns all secondary self addresses.
    pub(crate) async fn get_secondary_self_addrs(&self) -> Result<Vec<String>> {
-        let secondary_addrs = self
-            .get_config(Config::SecondaryAddrs)
-            .await?
-            .unwrap_or_default();
-        Ok(secondary_addrs
-            .split_ascii_whitespace()
-            .map(|s| s.to_string())
-            .collect())
+        self.sql.query_map_vec("SELECT addr FROM transports WHERE addr NOT IN (SELECT value FROM config WHERE keyname='configured_addr')", (), |row| {
+            let addr: String = row.get(0)?;
+            Ok(addr)
+        }).await
    }

    /// Returns the primary self address.
@@ -94,59 +94,6 @@ async fn test_set_config_bool() -> Result<()> {
    Ok(())
 }

-#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn test_self_addrs() -> Result<()> {
-    let alice = TestContext::new_alice().await;
-
-    assert!(alice.is_self_addr("alice@example.org").await?);
-    assert_eq!(alice.get_all_self_addrs().await?, vec!["alice@example.org"]);
-    assert!(!alice.is_self_addr("alice@alice.com").await?);
-
-    // Test adding the same primary address
-    alice.set_primary_self_addr("alice@example.org").await?;
-    alice.set_primary_self_addr("Alice@Example.Org").await?;
-    assert_eq!(alice.get_all_self_addrs().await?, vec!["Alice@Example.Org"]);
-
-    // Test adding a new (primary) self address
-    // The address is trimmed during configure by `LoginParam::from_database()`,
-    // so `set_primary_self_addr()` doesn't have to trim it.
-    alice.set_primary_self_addr("Alice@alice.com").await?;
-    assert!(alice.is_self_addr("aliCe@example.org").await?);
-    assert!(alice.is_self_addr("alice@alice.com").await?);
-    assert_eq!(
-        alice.get_all_self_addrs().await?,
-        vec!["Alice@alice.com", "Alice@Example.Org"]
-    );
-
-    // Check that the entry is not duplicated
-    alice.set_primary_self_addr("alice@alice.com").await?;
-    alice.set_primary_self_addr("alice@alice.com").await?;
-    assert_eq!(
-        alice.get_all_self_addrs().await?,
-        vec!["alice@alice.com", "Alice@Example.Org"]
-    );
-
-    // Test switching back
-    alice.set_primary_self_addr("alice@example.org").await?;
-    assert_eq!(
-        alice.get_all_self_addrs().await?,
-        vec!["alice@example.org", "alice@alice.com"]
-    );
-
-    // Test setting a new primary self address, the previous self address
-    // should be kept as a secondary self address
-    alice.set_primary_self_addr("alice@alice.xyz").await?;
-    assert_eq!(
-        alice.get_all_self_addrs().await?,
-        vec!["alice@alice.xyz", "alice@example.org", "alice@alice.com"]
-    );
-    assert!(alice.is_self_addr("alice@example.org").await?);
-    assert!(alice.is_self_addr("alice@alice.com").await?);
-    assert!(alice.is_self_addr("Alice@alice.xyz").await?);
-
-    Ok(())
-}
-
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn test_mdns_default_behaviour() -> Result<()> {
    let t = &TestContext::new_alice().await;
@@ -278,7 +225,6 @@ async fn test_sync() -> Result<()> {
    Ok(())
 }

-/// Sync message mustn't be sent if self-{status,avatar} is changed by a self-sent message.
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn test_no_sync_on_self_sent_msg() -> Result<()> {
    let mut tcm = TestContextManager::new();
@@ -288,7 +234,7 @@ async fn test_no_sync_on_self_sent_msg() -> Result<()> {
        a.set_config_bool(Config::SyncMsgs, true).await?;
    }

-    let status = "Synced via usual message";
+    let status = "Sent via usual message";
    alice0.set_config(Config::Selfstatus, Some(status)).await?;
    alice0.send_sync_msg().await?;
    alice0.pop_sent_sync_msg().await;
@@ -297,7 +243,7 @@ async fn test_no_sync_on_self_sent_msg() -> Result<()> {
    tcm.send_recv(alice0, alice1, "hi Alice!").await;
    assert_eq!(
        alice1.get_config(Config::Selfstatus).await?,
-        Some(status.to_string())
+        Some(status1.to_string())
    );
    sync(alice1, alice0).await;
    assert_eq!(
@@ -328,7 +274,7 @@ async fn test_no_sync_on_self_sent_msg() -> Result<()> {
        alice1
            .get_config(Config::Selfavatar)
            .await?
-            .filter(|path| path.ends_with(".png"))
+            .filter(|path| path.ends_with(".jpg"))
            .is_some()
    );
    sync(alice1, alice0).await;
@@ -27,7 +27,7 @@ use crate::config::{self, Config};
 use crate::constants::NON_ALPHANUMERIC_WITHOUT_DOT;
 use crate::context::Context;
 use crate::imap::Imap;
-use crate::log::{LogExt, warn};
+use crate::log::warn;
 use crate::login_param::EnteredCertificateChecks;
 pub use crate::login_param::EnteredLoginParam;
 use crate::message::Message;
@@ -40,11 +40,10 @@ use crate::sync::Sync::*;
 use crate::tools::time;
 use crate::transport::{
    ConfiguredCertificateChecks, ConfiguredLoginParam, ConfiguredServerLoginParam,
-    ConnectionCandidate,
+    ConnectionCandidate, send_sync_transports,
 };
 use crate::{EventType, stock_str};
 use crate::{chat, provider};
-use deltachat_contact_tools::addr_cmp;

 macro_rules! progress {
    ($context:tt, $progress:expr, $comment:expr) => {
@@ -206,6 +205,7 @@ impl Context {
    /// Removes the transport with the specified email address
    /// (i.e. [EnteredLoginParam::addr]).
    pub async fn delete_transport(&self, addr: &str) -> Result<()> {
+        let now = time();
        self.sql
            .transaction(|transaction| {
                let primary_addr = transaction.query_row(
@@ -220,12 +220,13 @@ impl Context {
                if primary_addr == addr {
                    bail!("Cannot delete primary transport");
                }
-                let transport_id = transaction.query_row(
-                    "DELETE FROM transports WHERE addr=? RETURNING id",
+                let (transport_id, add_timestamp) = transaction.query_row(
+                    "DELETE FROM transports WHERE addr=? RETURNING id, add_timestamp",
                    (addr,),
                    |row| {
                        let id: u32 = row.get(0)?;
-                        Ok(id)
+                        let add_timestamp: i64 = row.get(1)?;
+                        Ok((id, add_timestamp))
                    },
                )?;
                transaction.execute("DELETE FROM imap WHERE transport_id=?", (transport_id,))?;
@@ -234,9 +235,23 @@ impl Context {
                    (transport_id,),
                )?;

+                // Removal timestamp should not be lower than addition timestamp
+                // to be accepted by other devices when synced.
+                let remove_timestamp = std::cmp::max(now, add_timestamp);
+
+                transaction.execute(
+                    "INSERT INTO removed_transports (addr, remove_timestamp)
+                     VALUES (?, ?)
+                     ON CONFLICT (addr)
+                     DO UPDATE SET remove_timestamp = excluded.remove_timestamp",
+                    (addr, remove_timestamp),
+                )?;
+
                Ok(())
            })
            .await?;
+        send_sync_transports(self).await?;
+
        Ok(())
    }

@@ -267,7 +282,7 @@ impl Context {
        let provider = configure(self, param).await?;
        self.set_config_internal(Config::NotifyAboutWrongPw, Some("1"))
            .await?;
-        on_configure_completed(self, provider, old_addr).await?;
+        on_configure_completed(self, provider).await?;
        Ok(())
    }
 }
@@ -275,7 +290,6 @@ impl Context {
 async fn on_configure_completed(
    context: &Context,
    provider: Option<&'static Provider>,
-    old_addr: Option<String>,
 ) -> Result<()> {
    if let Some(provider) = provider {
        if let Some(config_defaults) = provider.config_defaults {
@@ -305,20 +319,6 @@ async fn on_configure_completed(
        }
    }

-    if let Some(new_addr) = context.get_config(Config::ConfiguredAddr).await?
-        && let Some(old_addr) = old_addr
-        && !addr_cmp(&new_addr, &old_addr)
-    {
-        let mut msg = Message::new_text(
-            stock_str::aeap_explanation_and_link(context, &old_addr, &new_addr).await,
-        );
-        chat::add_device_msg(context, None, Some(&mut msg))
-            .await
-            .context("Cannot add AEAP explanation")
-            .log_err(context)
-            .ok();
-    }
-
    Ok(())
 }

@@ -554,12 +554,11 @@ async fn configure(ctx: &Context, param: &EnteredLoginParam) -> Result<Option<&'
    let (_s, r) = async_channel::bounded(1);
    let mut imap = Imap::new(ctx, transport_id, configured_param.clone(), r).await?;
    let configuring = true;
-    let mut imap_session = match imap.connect(ctx, configuring).await {
-        Ok(session) => session,
-        Err(err) => bail!(
+    if let Err(err) = imap.connect(ctx, configuring).await {
+        bail!(
            "{}",
            nicer_configuration_error(ctx, format!("{err:#}")).await
-        ),
+        );
    };

    progress!(ctx, 850);
@@ -569,23 +568,22 @@ async fn configure(ctx: &Context, param: &EnteredLoginParam) -> Result<Option<&'

    progress!(ctx, 900);

-    if !ctx.is_configured().await? {
+    let is_configured = ctx.is_configured().await?;
+    if !is_configured {
        ctx.sql.set_raw_config("mvbox_move", Some("0")).await?;
        ctx.sql.set_raw_config("only_fetch_mvbox", None).await?;
    }

-    let create_mvbox = false;
-    imap.configure_folders(ctx, &mut imap_session, create_mvbox)
-        .await?;
-
    drop(imap);

    progress!(ctx, 910);

    let provider = configured_param.provider;
    configured_param
-        .save_to_transports_table(ctx, param)
+        .clone()
+        .save_to_transports_table(ctx, param, time())
        .await?;
+    send_sync_transports(ctx).await?;

    ctx.set_config_internal(Config::ConfiguredTimestamp, Some(&time().to_string()))
        .await?;
@@ -36,7 +36,7 @@ use crate::message::MessageState;
 use crate::mimeparser::AvatarAction;
 use crate::param::{Param, Params};
 use crate::sync::{self, Sync::*};
-use crate::tools::{SystemTime, duration_to_str, get_abs_path, time, to_lowercase};
+use crate::tools::{SystemTime, duration_to_str, get_abs_path, normalize_text, time, to_lowercase};
 use crate::{chat, chatlist_events, ensure_and_debug_assert_ne, stock_str};

 /// Time during which a contact is considered as seen recently.
@@ -115,9 +115,23 @@ impl ContactId {
        let row = context
            .sql
            .transaction(|transaction| {
+                let authname;
+                let name_or_authname = if !name.is_empty() {
+                    name
+                } else {
+                    authname = transaction.query_row(
+                        "SELECT authname FROM contacts WHERE id=?",
+                        (self,),
+                        |row| {
+                            let authname: String = row.get(0)?;
+                            Ok(authname)
+                        },
+                    )?;
+                    &authname
+                };
                let is_changed = transaction.execute(
-                    "UPDATE contacts SET name=?1 WHERE id=?2 AND name!=?1",
-                    (name, self),
+                    "UPDATE contacts SET name=?1, name_normalized=?2 WHERE id=?3 AND name!=?1",
+                    (name, normalize_text(name_or_authname), self),
                )? > 0;
                if is_changed {
                    update_chat_names(context, transaction, self)?;
@@ -383,20 +397,16 @@ async fn import_vcard_contact(context: &Context, contact: &VcardContact) -> Resu
        },
        None => None,
    };
-    if let Some(path) = path {
-        // Currently this value doesn't matter as we don't import the contact of self.
-        let was_encrypted = false;
-        if let Err(e) =
-            set_profile_image(context, id, &AvatarAction::Change(path), was_encrypted).await
-        {
-            warn!(
-                context,
-                "import_vcard_contact: Could not set avatar for {}: {e:#}.", contact.addr
-            );
-        }
+    if let Some(path) = path
+        && let Err(e) = set_profile_image(context, id, &AvatarAction::Change(path)).await
+    {
+        warn!(
+            context,
+            "import_vcard_contact: Could not set avatar for {}: {e:#}.", contact.addr
+        );
    }
    if let Some(biography) = &contact.biography
-        && let Err(e) = set_status(context, id, biography.to_owned(), false, false).await
+        && let Err(e) = set_status(context, id, biography.to_owned()).await
    {
        warn!(
            context,
@@ -971,11 +981,22 @@ impl Contact {
                        } else {
                            row_name
                        };
+                        let new_authname = if update_authname {
+                            name.to_string()
+                        } else {
+                            row_authname
+                        };

                        transaction.execute(
-                            "UPDATE contacts SET name=?, addr=?, origin=?, authname=? WHERE id=?;",
+                            "UPDATE contacts SET name=?, name_normalized=?, addr=?, origin=?, authname=? WHERE id=?",
                            (
-                                new_name,
+                                &new_name,
+                                normalize_text(
+                                    if !new_name.is_empty() {
+                                        &new_name
+                                    } else {
+                                        &new_authname
+                                    }),
                                if update_addr {
                                    addr.to_string()
                                } else {
@@ -986,11 +1007,7 @@ impl Contact {
                                } else {
                                    row_origin
                                },
-                                if update_authname {
-                                    name.to_string()
-                                } else {
-                                    row_authname
-                                },
+                                &new_authname,
                                row_id,
                            ),
                        )?;
@@ -1002,18 +1019,18 @@ impl Contact {
                        sth_modified = Modifier::Modified;
                    }
                } else {
-                    let update_name = manual;
-                    let update_authname = !manual;
-
                    transaction.execute(
-                        "INSERT INTO contacts (name, addr, fingerprint, origin, authname)
-                         VALUES (?, ?, ?, ?, ?);",
+                        "
+INSERT INTO contacts (name, name_normalized, addr, fingerprint, origin, authname)
+VALUES (?, ?, ?, ?, ?, ?)
+                        ",
                        (
-                            if update_name { &name } else { "" },
+                            if manual { &name } else { "" },
+                            normalize_text(&name),
                            &addr,
                            fingerprint,
                            origin,
-                            if update_authname { &name } else { "" },
+                            if manual { "" } else { &name },
                        ),
                    )?;

@@ -1116,17 +1133,19 @@ impl Contact {
            Origin::IncomingReplyTo
        };
        if query.is_some() {
-            let s3str_like_cmd = format!("%{}%", query.unwrap_or(""));
+            let s3str_like_cmd = format!("%{}%", query.unwrap_or("").to_lowercase());
            context
                .sql
                .query_map(
-                    "SELECT c.id, c.addr FROM contacts c
-                 WHERE c.id>?
-                 AND (c.fingerprint='')=?
-                 AND c.origin>=? \
-                 AND c.blocked=0 \
-                 AND (iif(c.name='',c.authname,c.name) LIKE ? OR c.addr LIKE ?) \
-                 ORDER BY c.last_seen DESC, c.id DESC;",
+                    "
+SELECT c.id, c.addr FROM contacts c
+WHERE c.id>?
+    AND (c.fingerprint='')=?
+    AND c.origin>=?
+    AND c.blocked=0
+    AND (IFNULL(c.name_normalized,IIF(c.name='',c.authname,c.name)) LIKE ? OR c.addr LIKE ?)
+ORDER BY c.last_seen DESC, c.id DESC
+                    ",
                    (
                        ContactId::LAST_SPECIAL,
                        flag_address,
@@ -1253,8 +1272,18 @@ impl Contact {
                    };
                    // Always do an update in case the blocking is reset or name is changed.
                    transaction.execute(
-                        "UPDATE contacts SET name=?, origin=?, blocked=1, fingerprint=? WHERE addr=?",
-                        (&name, Origin::MailinglistAddress, fingerprint, &grpid),
+                        "
+UPDATE contacts
+SET name=?, name_normalized=IIF(?1='',name_normalized,?), origin=?, blocked=1, fingerprint=?
+WHERE addr=?
+                        ",
+                        (
+                            &name,
+                            normalize_text(&name),
+                            Origin::MailinglistAddress,
+                            fingerprint,
+                            &grpid,
+                        ),
                    )?;
                }
                Ok(())
@@ -1509,18 +1538,6 @@ impl Contact {
        &self.addr
    }

-    /// Get authorized name or address.
-    ///
-    /// This string is suitable for sending over email
-    /// as it does not leak the locally set name.
-    pub(crate) fn get_authname_or_addr(&self) -> String {
-        if !self.authname.is_empty() {
-            (&self.authname).into()
-        } else {
-            (&self.addr).into()
-        }
-    }
-
    /// Get a summary of name and address.
    ///
    /// The returned string is either "Name (email@domain.com)" or just
@@ -1741,8 +1758,8 @@ fn update_chat_names(
        };

        let count = transaction.execute(
-            "UPDATE chats SET name=?1 WHERE id=?2 AND name!=?1",
-            (chat_name, chat_id),
+            "UPDATE chats SET name=?1, name_normalized=?2 WHERE id=?3 AND name!=?1",
+            (&chat_name, normalize_text(&chat_name), chat_id),
        )?;

        if count > 0 {
@@ -1836,25 +1853,19 @@ WHERE type=? AND id IN (
 /// The given profile image is expected to be already in the blob directory
 /// as profile images can be set only by receiving messages, this should be always the case, however.
 ///
-/// For contact SELF, the image is not saved in the contact-database but as Config::Selfavatar;
-/// this typically happens if we see message with our own profile image.
+/// For contact SELF, the image is not saved in the contact-database but as Config::Selfavatar.
 pub(crate) async fn set_profile_image(
    context: &Context,
    contact_id: ContactId,
    profile_image: &AvatarAction,
-    was_encrypted: bool,
 ) -> Result<()> {
    let mut contact = Contact::get_by_id(context, contact_id).await?;
    let changed = match profile_image {
        AvatarAction::Change(profile_image) => {
            if contact_id == ContactId::SELF {
-                if was_encrypted {
-                    context
-                        .set_config_ex(Nosync, Config::Selfavatar, Some(profile_image))
-                        .await?;
-                } else {
-                    info!(context, "Do not use unencrypted selfavatar.");
-                }
+                context
+                    .set_config_ex(Nosync, Config::Selfavatar, Some(profile_image))
+                    .await?;
            } else {
                contact.param.set(Param::ProfileImage, profile_image);
            }
@@ -1862,13 +1873,9 @@ pub(crate) async fn set_profile_image(
        }
        AvatarAction::Delete => {
            if contact_id == ContactId::SELF {
-                if was_encrypted {
-                    context
-                        .set_config_ex(Nosync, Config::Selfavatar, None)
-                        .await?;
-                } else {
-                    info!(context, "Do not use unencrypted selfavatar deletion.");
-                }
+                context
+                    .set_config_ex(Nosync, Config::Selfavatar, None)
+                    .await?;
            } else {
                contact.param.remove(Param::ProfileImage);
            }
@@ -1885,22 +1892,16 @@ pub(crate) async fn set_profile_image(

 /// Sets contact status.
 ///
-/// For contact SELF, the status is not saved in the contact table, but as Config::Selfstatus.  This
-/// is only done if message is sent from Delta Chat and it is encrypted, to synchronize signature
-/// between Delta Chat devices.
+/// For contact SELF, the status is not saved in the contact table, but as Config::Selfstatus.
 pub(crate) async fn set_status(
    context: &Context,
    contact_id: ContactId,
    status: String,
-    encrypted: bool,
-    has_chat_version: bool,
 ) -> Result<()> {
    if contact_id == ContactId::SELF {
-        if encrypted && has_chat_version {
-            context
-                .set_config_ex(Nosync, Config::Selfstatus, Some(&status))
-                .await?;
-        }
+        context
+            .set_config_ex(Nosync, Config::Selfstatus, Some(&status))
+            .await?;
    } else {
        let mut contact = Contact::get_by_id(context, contact_id).await?;

@@ -4,7 +4,7 @@ use super::*;
 use crate::chat::{Chat, get_chat_contacts, send_text_msg};
 use crate::chatlist::Chatlist;
 use crate::receive_imf::receive_imf;
-use crate::test_utils::{self, TestContext, TestContextManager, TimeShiftFalsePositiveNote};
+use crate::test_utils::{self, TestContext, TestContextManager, TimeShiftFalsePositiveNote, sync};

 #[test]
 fn test_contact_id_values() {
@@ -60,16 +60,16 @@ async fn test_get_contacts() -> Result<()> {
    let context = tcm.bob().await;
    let alice = tcm.alice().await;
    alice
-        .set_config(Config::Displayname, Some("MyName"))
+        .set_config(Config::Displayname, Some("MyNameIsΔ"))
        .await?;

    // Alice is not in the contacts yet.
    let contacts = Contact::get_all(&context.ctx, 0, Some("Alice")).await?;
    assert_eq!(contacts.len(), 0);
-    let contacts = Contact::get_all(&context.ctx, 0, Some("MyName")).await?;
+    let contacts = Contact::get_all(&context.ctx, 0, Some("MyNameIsΔ")).await?;
    assert_eq!(contacts.len(), 0);

-    let claire_id = Contact::create(&context, "someone", "claire@example.org").await?;
+    let claire_id = Contact::create(&context, "Δ-someone", "claire@example.org").await?;
    let dave_id = Contact::create(&context, "", "dave@example.org").await?;

    let id = context.add_or_lookup_contact_id(&alice).await;
@@ -77,8 +77,8 @@ async fn test_get_contacts() -> Result<()> {

    let contact = Contact::get_by_id(&context, id).await.unwrap();
    assert_eq!(contact.get_name(), "");
-    assert_eq!(contact.get_authname(), "MyName");
-    assert_eq!(contact.get_display_name(), "MyName");
+    assert_eq!(contact.get_authname(), "MyNameIsΔ");
+    assert_eq!(contact.get_display_name(), "MyNameIsΔ");

    // Search by name.
    let contacts = Contact::get_all(&context, 0, Some("myname")).await?;
@@ -93,12 +93,12 @@ async fn test_get_contacts() -> Result<()> {
    let contacts = Contact::get_all(&context, 0, Some("Foobar")).await?;
    assert_eq!(contacts.len(), 0);

-    // Set Alice name to "someone" manually.
-    id.set_name(&context, "someone").await?;
+    // Set Alice name manually.
+    id.set_name(&context, "Δ-someone").await?;
    let contact = Contact::get_by_id(&context.ctx, id).await.unwrap();
-    assert_eq!(contact.get_name(), "someone");
-    assert_eq!(contact.get_authname(), "MyName");
-    assert_eq!(contact.get_display_name(), "someone");
+    assert_eq!(contact.get_name(), "Δ-someone");
+    assert_eq!(contact.get_authname(), "MyNameIsΔ");
+    assert_eq!(contact.get_display_name(), "Δ-someone");

    // Not searchable by authname, because it is not displayed.
    let contacts = Contact::get_all(&context, 0, Some("MyName")).await?;
@@ -108,7 +108,9 @@ async fn test_get_contacts() -> Result<()> {
        info!(&context, "add_self={add_self}");

        // Search key-contacts by display name (same as manually set name).
-        let contacts = Contact::get_all(&context.ctx, add_self, Some("someone")).await?;
+        let contacts = Contact::get_all(&context.ctx, add_self, Some("Δ-someone")).await?;
+        assert_eq!(contacts, vec![id]);
+        let contacts = Contact::get_all(&context.ctx, add_self, Some("δ-someon")).await?;
        assert_eq!(contacts, vec![id]);

        // Get all key-contacts.
@@ -120,7 +122,7 @@ async fn test_get_contacts() -> Result<()> {
    }

    // Search address-contacts by display name.
-    let contacts = Contact::get_all(&context, constants::DC_GCL_ADDRESS, Some("someone")).await?;
+    let contacts = Contact::get_all(&context, constants::DC_GCL_ADDRESS, Some("Δ-someone")).await?;
    assert_eq!(contacts, vec![claire_id]);

    // Get all address-contacts. Newer contacts go first.
@@ -134,6 +136,16 @@ async fn test_get_contacts() -> Result<()> {
    .await?;
    assert_eq!(contacts, vec![dave_id, claire_id, ContactId::SELF]);

+    // Reset the user-provided name for Alice.
+    id.set_name(&context, "").await?;
+    let contact = Contact::get_by_id(&context.ctx, id).await.unwrap();
+    assert_eq!(contact.get_name(), "");
+    assert_eq!(contact.get_authname(), "MyNameIsΔ");
+    assert_eq!(contact.get_display_name(), "MyNameIsΔ");
+    let contacts = Contact::get_all(&context, 0, Some("MyName")).await?;
+    assert_eq!(contacts.len(), 1);
+    let contacts = Contact::get_all(&context, 0, Some("δ")).await?;
+    assert_eq!(contacts.len(), 1);
    Ok(())
 }

@@ -850,8 +862,7 @@ CCCB 5AA9 F6E1 141C 9431
    Ok(())
 }

-/// Tests that status is synchronized when sending encrypted BCC-self messages and not
-/// synchronized when the message is not encrypted.
+/// Tests that self-status is not synchronized from outgoing messages.
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn test_synchronize_status() -> Result<()> {
    let mut tcm = TestContextManager::new();
@@ -870,21 +881,12 @@ async fn test_synchronize_status() -> Result<()> {
        .await?;
    let chat = alice1.create_email_chat(bob).await;

-    // Alice sends a message to Bob from the first device.
+    // Alice sends an unencrypted message to Bob from the first device.
    send_text_msg(alice1, chat.id, "Hello".to_string()).await?;
    let sent_msg = alice1.pop_sent_msg().await;

-    // Message is not encrypted.
-    let message = sent_msg.load_from_db().await;
-    assert!(!message.get_showpadlock());
-
    // Alice's second devices receives a copy of outgoing message.
    alice2.recv_msg(&sent_msg).await;
-
-    // Bob receives message.
-    bob.recv_msg(&sent_msg).await;
-
-    // Message was not encrypted, so status is not copied.
    assert_eq!(alice2.get_config(Config::Selfstatus).await?, default_status);

    // Alice sends encrypted message.
@@ -892,17 +894,9 @@ async fn test_synchronize_status() -> Result<()> {
    send_text_msg(alice1, chat.id, "Hello".to_string()).await?;
    let sent_msg = alice1.pop_sent_msg().await;

-    // Second message is encrypted.
-    let message = sent_msg.load_from_db().await;
-    assert!(message.get_showpadlock());
-
    // Alice's second devices receives a copy of second outgoing message.
    alice2.recv_msg(&sent_msg).await;
-
-    assert_eq!(
-        alice2.get_config(Config::Selfstatus).await?,
-        Some("New status".to_string())
-    );
+    assert_eq!(alice2.get_config(Config::Selfstatus).await?, default_status);

    Ok(())
 }
@@ -915,9 +909,9 @@ async fn test_selfavatar_changed_event() -> Result<()> {
    // Alice has two devices.
    let alice1 = &tcm.alice().await;
    let alice2 = &tcm.alice().await;
-
-    // Bob has one device.
-    let bob = &tcm.bob().await;
+    for a in [alice1, alice2] {
+        a.set_config_bool(Config::SyncMsgs, true).await?;
+    }

    assert_eq!(alice1.get_config(Config::Selfavatar).await?, None);

@@ -933,17 +927,7 @@ async fn test_selfavatar_changed_event() -> Result<()> {
        .get_matching(|e| matches!(e, EventType::SelfavatarChanged))
        .await;

-    // Alice sends a message.
-    let alice1_chat_id = alice1.create_chat(bob).await.id;
-    send_text_msg(alice1, alice1_chat_id, "Hello".to_string()).await?;
-    let sent_msg = alice1.pop_sent_msg().await;
-
-    // The message is encrypted.
-    let message = sent_msg.load_from_db().await;
-    assert!(message.get_showpadlock());
-
-    // Alice's second device receives a copy of the outgoing message.
-    alice2.recv_msg(&sent_msg).await;
+    sync(alice1, alice2).await;

    // Alice's second device applies the selfavatar.
    assert!(alice2.get_config(Config::Selfavatar).await?.is_some());
@@ -5,7 +5,7 @@ use std::ffi::OsString;
 use std::ops::Deref;
 use std::path::{Path, PathBuf};
 use std::sync::atomic::AtomicBool;
-use std::sync::{Arc, OnceLock};
+use std::sync::{Arc, OnceLock, Weak};
 use std::time::Duration;

 use anyhow::{Context as _, Result, bail, ensure};
@@ -201,6 +201,25 @@ impl Deref for Context {
    }
 }

+/// A weak reference to a [`Context`]
+///
+/// Can be used to obtain a [`Context`]. An existing weak reference does not prevent the corresponding [`Context`] from being dropped.
+#[derive(Clone, Debug)]
+pub(crate) struct WeakContext {
+    inner: Weak<InnerContext>,
+}
+
+impl WeakContext {
+    /// Returns the [`Context`] if it is still available.
+    pub(crate) fn upgrade(&self) -> Result<Context> {
+        let inner = self
+            .inner
+            .upgrade()
+            .ok_or_else(|| anyhow::anyhow!("Inner struct has been dropped"))?;
+        Ok(Context { inner })
+    }
+}
+
 /// Actual context, expensive to clone.
 #[derive(Debug)]
 pub struct InnerContext {
@@ -385,6 +404,13 @@ impl Context {
        Ok(context)
    }

+    /// Returns a weak reference to this [`Context`].
+    pub(crate) fn get_weak_context(&self) -> WeakContext {
+        WeakContext {
+            inner: Arc::downgrade(&self.inner),
+        }
+    }
+
    /// Opens the database with the given passphrase.
    /// NB: Db encryption is deprecated, so `passphrase` should be empty normally. See
    /// [`ContextBuilder::with_password()`] for reasoning.
@@ -453,7 +479,7 @@ impl Context {
            translated_stockstrings: stockstrings,
            events,
            scheduler: SchedulerState::new(),
-            ratelimit: RwLock::new(Ratelimit::new(Duration::new(60, 0), 6.0)), // Allow at least 1 message every 10 seconds + a burst of 6.
+            ratelimit: RwLock::new(Ratelimit::new(Duration::new(3, 0), 3.0)), // Allow at least 1 message every second + a burst of 3.
            quota: RwLock::new(None),
            new_msgs_notify,
            server_id: RwLock::new(None),
@@ -485,12 +511,6 @@ impl Context {
            return;
        }

-        if self.is_chatmail().await.unwrap_or_default() {
-            let mut lock = self.ratelimit.write().await;
-            // Allow at least 1 message every second + a burst of 3.
-            *lock = Ratelimit::new(Duration::new(3, 0), 3.0);
-        }
-
        // The next line is mainly for iOS:
        // iOS starts a separate process for receiving notifications and if the user concurrently
        // starts the app, the UI process opens the database but waits with calling start_io()
@@ -802,6 +822,16 @@ impl Context {
            |(_transport_id, param)| param.to_string(),
        );
        let secondary_addrs = self.get_secondary_self_addrs().await?.join(", ");
+        let all_transports: Vec<String> = ConfiguredLoginParam::load_all(self)
+            .await?
+            .into_iter()
+            .map(|(transport_id, param)| format!("{transport_id}: {param}"))
+            .collect();
+        let all_transports = if all_transports.is_empty() {
+            "Not configured".to_string()
+        } else {
+            all_transports.join(",")
+        };
        let chats = get_chat_cnt(self).await?;
        let unblocked_msgs = message::get_unblocked_msg_cnt(self).await;
        let request_msgs = message::get_request_msg_cnt(self).await;
@@ -882,6 +912,7 @@ impl Context {
        res.insert("proxy_enabled", proxy_enabled.to_string());
        res.insert("entered_account_settings", l.to_string());
        res.insert("used_account_settings", l2);
+        res.insert("used_transport_settings", all_transports);

        if let Some(server_id) = &*self.server_id.read().await {
            res.insert("imap_server_id", format!("{server_id:?}"));
@@ -8,33 +8,27 @@ use mail_builder::mime::MimePart;
 use crate::aheader::{Aheader, EncryptPreference};
 use crate::context::Context;
 use crate::key::{SignedPublicKey, load_self_public_key, load_self_secret_key};
-use crate::pgp;
+use crate::pgp::{self, SeipdVersion};

 #[derive(Debug)]
 pub struct EncryptHelper {
-    pub prefer_encrypt: EncryptPreference,
    pub addr: String,
    pub public_key: SignedPublicKey,
 }

 impl EncryptHelper {
    pub async fn new(context: &Context) -> Result<EncryptHelper> {
-        let prefer_encrypt = EncryptPreference::Mutual;
        let addr = context.get_primary_self_addr().await?;
        let public_key = load_self_public_key(context).await?;

-        Ok(EncryptHelper {
-            prefer_encrypt,
-            addr,
-            public_key,
-        })
+        Ok(EncryptHelper { addr, public_key })
    }

    pub fn get_aheader(&self) -> Aheader {
        Aheader {
            addr: self.addr.clone(),
            public_key: self.public_key.clone(),
-            prefer_encrypt: self.prefer_encrypt,
+            prefer_encrypt: EncryptPreference::Mutual,
            verified: false,
        }
    }
@@ -47,6 +41,7 @@ impl EncryptHelper {
        mail_to_encrypt: MimePart<'static>,
        compress: bool,
        anonymous_recipients: bool,
+        seipd_version: SeipdVersion,
    ) -> Result<String> {
        let sign_key = load_self_secret_key(context).await?;

@@ -57,9 +52,10 @@ impl EncryptHelper {
        let ctext = pgp::pk_encrypt(
            raw_message,
            keyring,
-            Some(sign_key),
+            sign_key,
            compress,
            anonymous_recipients,
+            seipd_version,
        )
        .await?;

@@ -30,9 +30,10 @@ pub(crate) async fn emit_chatlist_item_changed_for_contact_chat(
    match ChatId::lookup_by_contact(context, contact_id).await {
        Ok(Some(chat_id)) => self::emit_chatlist_item_changed(context, chat_id),
        Ok(None) => {}
-        Err(error) => context.emit_event(EventType::Error(format!(
+        Err(error) => error!(
+            context,
            "failed to find chat id for contact for chatlist event: {error:?}"
-        ))),
+        ),
    }
 }

@@ -243,7 +243,7 @@ pub enum EventType {
        /// Progress.
        ///
        /// 0=error, 1-999=progress in permille, 1000=success and done
-        progress: usize,
+        progress: u16,

        /// Progress comment or error, something to display to the user.
        comment: Option<String>,
@@ -253,7 +253,7 @@ pub enum EventType {
    ///
    /// @param data1 (usize) 0=error, 1-999=progress in permille, 1000=success and done
    /// @param data2 0
-    ImexProgress(usize),
+    ImexProgress(u16),

    /// A file has been exported. A file has been written by imex().
    /// This event may be sent multiple times by a single call to imex().
@@ -280,7 +280,7 @@ pub enum EventType {
        chat_type: Chattype,

        /// Progress, always 1000.
-        progress: usize,
+        progress: u16,
    },

    /// Progress information of a secure-join handshake from the view of the joiner
@@ -295,7 +295,7 @@ pub enum EventType {
        /// 400=vg-/vc-request-with-auth sent, typically shown as "alice@addr verified, introducing myself."
        /// (Bob has verified alice and waits until Alice does the same for him)
        /// 1000=vg-member-added/vc-contact-confirm received
-        progress: usize,
+        progress: u16,
    },

    /// The connectivity to the server changed.
@@ -417,6 +417,15 @@ pub enum EventType {
        chat_id: ChatId,
    },

+    /// One or more transports has changed.
+    ///
+    /// This event is used for tests to detect when transport
+    /// synchronization messages arrives.
+    /// UIs don't need to use it, it is unlikely
+    /// that user modifies transports on multiple
+    /// devices simultaneously.
+    TransportsModified,
+
    /// Event for using in tests, e.g. as a fence between normally generated events.
    #[cfg(test)]
    Test,
@@ -79,7 +79,7 @@ pub(crate) struct Imap {
    pub(crate) idle_interrupt_receiver: Receiver<()>,

    /// Email address.
-    addr: String,
+    pub(crate) addr: String,

    /// Login parameters.
    lp: Vec<ConfiguredServerLoginParam>,
@@ -207,6 +207,7 @@ impl Client {
        hostname: &str,
        strict_tls: bool,
    ) -> Result<Self> {
+        let use_sni = true;
        let tcp_stream = connect_tcp_inner(addr).await?;
        let account_id = context.get_id();
        let events = context.events.clone();
@@ -215,6 +216,7 @@ impl Client {
            strict_tls,
            hostname,
            addr.port(),
+            use_sni,
            alpn(addr.port()),
            logging_stream,
            &context.tls_session_store,
@@ -251,6 +253,7 @@ impl Client {
        host: &str,
        strict_tls: bool,
    ) -> Result<Self> {
+        let use_sni = false;
        let tcp_stream = connect_tcp_inner(addr).await?;

        let account_id = context.get_id();
@@ -275,6 +278,7 @@ impl Client {
            strict_tls,
            host,
            addr.port(),
+            use_sni,
            "",
            tcp_stream,
            &context.tls_session_store,
@@ -294,6 +298,7 @@ impl Client {
        strict_tls: bool,
        proxy_config: ProxyConfig,
    ) -> Result<Self> {
+        let use_sni = true;
        let proxy_stream = proxy_config
            .connect(context, domain, port, strict_tls)
            .await?;
@@ -301,6 +306,7 @@ impl Client {
            strict_tls,
            domain,
            port,
+            use_sni,
            alpn(port),
            proxy_stream,
            &context.tls_session_store,
@@ -340,6 +346,7 @@ impl Client {
        proxy_config: ProxyConfig,
        strict_tls: bool,
    ) -> Result<Self> {
+        let use_sni = false;
        let proxy_stream = proxy_config
            .connect(context, hostname, port, strict_tls)
            .await?;
@@ -362,6 +369,7 @@ impl Client {
            strict_tls,
            hostname,
            port,
+            use_sni,
            "",
            proxy_stream,
            &context.tls_session_store,
@@ -1,5 +1,6 @@
 use super::*;
 use crate::test_utils::TestContext;
+use crate::transport::add_pseudo_transport;

 #[test]
 fn test_get_folder_meaning_by_name() {
@@ -271,12 +272,14 @@ async fn test_get_imap_search_command() -> Result<()> {
        r#"FROM "alice@example.org""#
    );

+    add_pseudo_transport(&t, "alice@another.com").await?;
    t.ctx.set_primary_self_addr("alice@another.com").await?;
    assert_eq!(
        get_imap_self_sent_search_command(&t.ctx).await?,
        r#"OR (FROM "alice@another.com") (FROM "alice@example.org")"#
    );

+    add_pseudo_transport(&t, "alice@third.com").await?;
    t.ctx.set_primary_self_addr("alice@third.com").await?;
    assert_eq!(
        get_imap_self_sent_search_command(&t.ctx).await?,
@@ -25,7 +25,8 @@ use crate::pgp;
 use crate::qr::DCBACKUP_VERSION;
 use crate::sql;
 use crate::tools::{
-    TempPathGuard, create_folder, delete_file, get_filesuffix_lc, read_file, time, write_file,
+    TempPathGuard, create_folder, delete_file, get_filesuffix_lc, read_file, time, usize_to_u64,
+    write_file,
 };

 mod key_transfer;
@@ -263,14 +264,14 @@ struct ProgressReader<R> {
    inner: R,

    /// Number of bytes successfully read from the internal reader.
-    read: usize,
+    read: u64,

    /// Total size of the backup .tar file expected to be read from the reader.
    /// Used to calculate the progress.
-    file_size: usize,
+    file_size: u64,

    /// Last progress emitted to avoid emitting the same progress value twice.
-    last_progress: usize,
+    last_progress: u16,

    /// Context for emitting progress events.
    context: Context,
@@ -281,7 +282,7 @@ impl<R> ProgressReader<R> {
        Self {
            inner: r,
            read: 0,
-            file_size: file_size as usize,
+            file_size,
            last_progress: 1,
            context,
        }
@@ -301,9 +302,11 @@ where
        let before = buf.filled().len();
        let res = this.inner.poll_read(cx, buf);
        if let std::task::Poll::Ready(Ok(())) = res {
-            *this.read = this.read.saturating_add(buf.filled().len() - before);
+            *this.read = this
+                .read
+                .saturating_add(usize_to_u64(buf.filled().len() - before));

-            let progress = std::cmp::min(1000 * *this.read / *this.file_size, 999);
+            let progress = std::cmp::min(1000 * *this.read / *this.file_size, 999) as u16;
            if progress > *this.last_progress {
                this.context.emit_event(EventType::ImexProgress(progress));
                *this.last_progress = progress;
@@ -490,14 +493,14 @@ struct ProgressWriter<W> {
    inner: W,

    /// Number of bytes successfully written into the internal writer.
-    written: usize,
+    written: u64,

    /// Total size of the backup .tar file expected to be written into the writer.
    /// Used to calculate the progress.
-    file_size: usize,
+    file_size: u64,

    /// Last progress emitted to avoid emitting the same progress value twice.
-    last_progress: usize,
+    last_progress: u16,

    /// Context for emitting progress events.
    context: Context,
@@ -508,7 +511,7 @@ impl<W> ProgressWriter<W> {
        Self {
            inner: w,
            written: 0,
-            file_size: file_size as usize,
+            file_size,
            last_progress: 1,
            context,
        }
@@ -527,9 +530,9 @@ where
        let this = self.project();
        let res = this.inner.poll_write(cx, buf);
        if let std::task::Poll::Ready(Ok(written)) = res {
-            *this.written = this.written.saturating_add(written);
+            *this.written = this.written.saturating_add(usize_to_u64(written));

-            let progress = std::cmp::min(1000 * *this.written / *this.file_size, 999);
+            let progress = std::cmp::min(1000 * *this.written / *this.file_size, 999) as u16;
            if progress > *this.last_progress {
                this.context.emit_event(EventType::ImexProgress(progress));
                *this.last_progress = progress;
@@ -15,16 +15,17 @@ use pin_project::pin_project;

 use crate::events::{Event, EventType, Events};
 use crate::net::session::SessionStream;
+use crate::tools::usize_to_u64;

 use tokio::io::{AsyncRead, AsyncWrite, ReadBuf};

 #[derive(Debug)]
 struct Metrics {
    /// Total number of bytes read.
-    pub total_read: usize,
+    pub total_read: u64,

    /// Total number of bytes written.
-    pub total_written: usize,
+    pub total_written: u64,
 }

 impl Metrics {
@@ -91,6 +92,11 @@ impl<S: SessionStream> AsyncRead for LoggingStream<S> {
                "Read error on stream {peer_addr:?} after reading {} and writing {} bytes: {err}.",
                this.metrics.total_read, this.metrics.total_written
            );
+            tracing::event!(
+                ::tracing::Level::WARN,
+                account_id = *this.account_id,
+                log_message
+            );
            this.events.emit(Event {
                id: *this.account_id,
                typ: EventType::Warning(log_message),
@@ -98,7 +104,7 @@ impl<S: SessionStream> AsyncRead for LoggingStream<S> {
        }

        let n = old_remaining - buf.remaining();
-        this.metrics.total_read = this.metrics.total_read.saturating_add(n);
+        this.metrics.total_read = this.metrics.total_read.saturating_add(usize_to_u64(n));

        res
    }
@@ -113,7 +119,7 @@ impl<S: SessionStream> AsyncWrite for LoggingStream<S> {
        let this = self.project();
        let res = this.inner.poll_write(cx, buf);
        if let Poll::Ready(Ok(n)) = res {
-            this.metrics.total_written = this.metrics.total_written.saturating_add(n);
+            this.metrics.total_written = this.metrics.total_written.saturating_add(usize_to_u64(n));
        }
        res
    }
@@ -140,7 +146,7 @@ impl<S: SessionStream> AsyncWrite for LoggingStream<S> {
        let this = self.project();
        let res = this.inner.poll_write_vectored(cx, bufs);
        if let Poll::Ready(Ok(n)) = res {
-            this.metrics.total_written = this.metrics.total_written.saturating_add(n);
+            this.metrics.total_written = this.metrics.total_written.saturating_add(usize_to_u64(n));
        }
        res
    }
@@ -2248,14 +2248,5 @@ impl Viewtype {
    }
 }

-/// Returns text for storing in the `msgs.txt_normalized` column (to make case-insensitive search
-/// possible for non-ASCII messages).
-pub(crate) fn normalize_text(text: &str) -> Option<String> {
-    if text.is_ascii() {
-        return None;
-    };
-    Some(text.to_lowercase()).filter(|t| t != text)
-}
-
 #[cfg(test)]
 mod message_tests;
@@ -9,7 +9,7 @@ use data_encoding::BASE32_NOPAD;
 use deltachat_contact_tools::sanitize_bidi_characters;
 use iroh_gossip::proto::TopicId;
 use mail_builder::headers::HeaderType;
-use mail_builder::headers::address::{Address, EmailAddress};
+use mail_builder::headers::address::Address;
 use mail_builder::mime::MimePart;
 use tokio::fs;

@@ -32,6 +32,7 @@ use crate::message::{Message, MsgId, Viewtype};
 use crate::mimeparser::{SystemMessage, is_hidden};
 use crate::param::Param;
 use crate::peer_channels::{create_iroh_header, get_iroh_topic_for_msg};
+use crate::pgp::SeipdVersion;
 use crate::simplify::escape_message_footer_marks;
 use crate::stock_str;
 use crate::tools::{
@@ -464,7 +465,11 @@ impl MimeFactory {
                .unwrap_or_default(),
            false => "".to_string(),
        };
-        let attach_selfavatar = Self::should_attach_selfavatar(context, &msg).await;
+        // We don't display avatars for address-contacts, so sending avatars w/o encryption is not
+        // useful and causes e.g. Outlook to reject a message with a big header, see
+        // https://support.delta.chat/t/invalid-mime-content-single-text-value-size-32822-exceeded-allowed-maximum-32768-for-the-chat-user-avatar-header/4067.
+        let attach_selfavatar =
+            Self::should_attach_selfavatar(context, &msg).await && encryption_pubkeys.is_some();

        ensure_and_debug_assert!(
            member_timestamps.is_empty()
@@ -993,24 +998,7 @@ impl MimeFactory {
            } else if header_name == "to" {
                protected_headers.push(header.clone());
                if is_encrypted {
-                    let mut to_without_names = to
-                        .clone()
-                        .into_iter()
-                        .filter_map(|header| match header {
-                            Address::Address(mb) => Some(Address::Address(EmailAddress {
-                                name: None,
-                                email: mb.email,
-                            })),
-                            _ => None,
-                        })
-                        .collect::<Vec<_>>();
-                    if to_without_names.is_empty() {
-                        to_without_names.push(hidden_recipients());
-                    }
-                    unprotected_headers.push((
-                        original_header_name,
-                        Address::new_list(to_without_names).into(),
-                    ));
+                    unprotected_headers.push(("To", hidden_recipients().into()));
                } else {
                    unprotected_headers.push(header.clone());
                }
@@ -1271,6 +1259,17 @@ impl MimeFactory {
            } else {
                // Asymmetric encryption

+                let seipd_version = if encryption_pubkeys.is_empty() {
+                    // If message is sent only to self,
+                    // use v2 SEIPD.
+                    SeipdVersion::V2
+                } else {
+                    // If message is sent to others,
+                    // they may not support v2 SEIPD yet,
+                    // so use v1 SEIPD.
+                    SeipdVersion::V1
+                };
+
                // Encrypt to self unconditionally,
                // even for a single-device setup.
                let mut encryption_keyring = vec![encrypt_helper.public_key.clone()];
@@ -1284,6 +1283,7 @@ impl MimeFactory {
                        message,
                        compress,
                        anonymous_recipients,
+                        seipd_version,
                    )
                    .await?
            };
@@ -1538,10 +1538,9 @@ impl MimeFactory {
                            .await?
                            .unwrap_or_default()
                    {
-                        placeholdertext = Some(stock_str::msg_group_left_remote(context).await);
+                        placeholdertext = Some("I left the group.".to_string());
                    } else {
-                        placeholdertext =
-                            Some(stock_str::msg_del_member_remote(context, email_to_remove).await);
+                        placeholdertext = Some(format!("I removed member {email_to_remove}."));
                    };

                    if !email_to_remove.is_empty() {
@@ -1564,8 +1563,7 @@ impl MimeFactory {
                    let email_to_add = msg.param.get(Param::Arg).unwrap_or_default();
                    let fingerprint_to_add = msg.param.get(Param::Arg4).unwrap_or_default();

-                    placeholdertext =
-                        Some(stock_str::msg_add_member_remote(context, email_to_add).await);
+                    placeholdertext = Some(format!("I added member {email_to_add}."));

                    if !email_to_add.is_empty() {
                        headers.push((
@@ -1601,7 +1599,7 @@ impl MimeFactory {
                        "Chat-Content",
                        mail_builder::headers::text::Text::new("group-avatar-changed").into(),
                    ));
-                    if grpimage.is_none() {
+                    if grpimage.is_none() && is_encrypted {
                        headers.push((
                            "Chat-Group-Avatar",
                            mail_builder::headers::raw::Raw::new("0").into(),
@@ -1728,7 +1726,9 @@ impl MimeFactory {
            _ => {}
        }

-        if let Some(grpimage) = grpimage {
+        if let Some(grpimage) = grpimage
+            && is_encrypted
+        {
            info!(context, "setting group image '{}'", grpimage);
            let avatar = build_avatar_file(context, grpimage)
                .await
@@ -6,7 +6,8 @@ use std::time::Duration;

 use super::*;
 use crate::chat::{
-    self, ChatId, add_contact_to_chat, create_group, remove_contact_from_chat, send_text_msg,
+    self, ChatId, add_contact_to_chat, create_group, create_group_unencrypted,
+    remove_contact_from_chat, send_text_msg,
 };
 use crate::chatlist::Chatlist;
 use crate::constants;
@@ -351,7 +352,7 @@ async fn test_subject_in_group() -> Result<()> {
    let mut tcm = TestContextManager::new();
    let t = tcm.alice().await;
    let bob = tcm.bob().await;
-    let group_id = chat::create_group(&t, "groupname").await.unwrap();
+    let group_id = create_group(&t, "groupname").await.unwrap();
    let bob_contact_id = t.add_or_lookup_contact_id(&bob).await;
    chat::add_contact_to_chat(&t, group_id, bob_contact_id).await?;

@@ -592,26 +593,6 @@ async fn test_selfavatar_unencrypted() -> anyhow::Result<()> {
    assert_eq!(outer.match_indices("Autocrypt:").count(), 1);
    assert_eq!(outer.match_indices("Chat-User-Avatar:").count(), 0);

-    assert_eq!(inner.match_indices("text/plain").count(), 1);
-    assert_eq!(inner.match_indices("Message-ID:").count(), 1);
-    assert_eq!(inner.match_indices("Chat-User-Avatar:").count(), 1);
-    assert_eq!(inner.match_indices("Subject:").count(), 0);
-
-    assert_eq!(body.match_indices("this is the text!").count(), 1);
-
-    // if another message is sent, that one must not contain the avatar
-    let sent_msg = t.send_msg(chat.id, &mut msg).await;
-    let mut payload = sent_msg.payload().splitn(3, "\r\n\r\n");
-    let outer = payload.next().unwrap();
-    let inner = payload.next().unwrap();
-    let body = payload.next().unwrap();
-
-    assert_eq!(outer.match_indices("multipart/mixed").count(), 1);
-    assert_eq!(outer.match_indices("Message-ID:").count(), 1);
-    assert_eq!(outer.match_indices("Subject:").count(), 1);
-    assert_eq!(outer.match_indices("Autocrypt:").count(), 1);
-    assert_eq!(outer.match_indices("Chat-User-Avatar:").count(), 0);
-
    assert_eq!(inner.match_indices("text/plain").count(), 1);
    assert_eq!(inner.match_indices("Message-ID:").count(), 1);
    assert_eq!(inner.match_indices("Chat-User-Avatar:").count(), 0);
@@ -670,7 +651,7 @@ async fn test_selfavatar_unencrypted_signed() {
    assert_eq!(part.match_indices("text/plain").count(), 1);
    assert_eq!(part.match_indices("From:").count(), 0);
    assert_eq!(part.match_indices("Message-ID:").count(), 1);
-    assert_eq!(part.match_indices("Chat-User-Avatar:").count(), 1);
+    assert_eq!(part.match_indices("Chat-User-Avatar:").count(), 0);
    assert_eq!(part.match_indices("Subject:").count(), 0);

    let body = payload.next().unwrap();
@@ -684,58 +665,6 @@ async fn test_selfavatar_unencrypted_signed() {
        .unwrap();
    let alice_contact = Contact::get_by_id(&bob.ctx, alice_id).await.unwrap();
    assert_eq!(alice_contact.is_key_contact(), false);
-    assert!(
-        alice_contact
-            .get_profile_image(&bob.ctx)
-            .await
-            .unwrap()
-            .is_some()
-    );
-
-    // if another message is sent, that one must not contain the avatar
-    let mut msg = Message::new_text("this is the text!".to_string());
-    let sent_msg = t.send_msg(chat.id, &mut msg).await;
-    let mut payload = sent_msg.payload().splitn(4, "\r\n\r\n");
-
-    let part = payload.next().unwrap();
-    assert_eq!(part.match_indices("multipart/signed").count(), 1);
-    assert_eq!(part.match_indices("From:").count(), 1);
-    assert_eq!(part.match_indices("Message-ID:").count(), 1);
-    assert_eq!(part.match_indices("Subject:").count(), 1);
-    assert_eq!(part.match_indices("Autocrypt:").count(), 1);
-    assert_eq!(part.match_indices("Chat-User-Avatar:").count(), 0);
-
-    let part = payload.next().unwrap();
-    assert_eq!(
-        part.match_indices("multipart/mixed; protected-headers=\"v1\"")
-            .count(),
-        1
-    );
-    assert_eq!(part.match_indices("From:").count(), 1);
-    assert_eq!(part.match_indices("Message-ID:").count(), 0);
-    assert_eq!(part.match_indices("Subject:").count(), 1);
-    assert_eq!(part.match_indices("Autocrypt:").count(), 1);
-    assert_eq!(part.match_indices("Chat-User-Avatar:").count(), 0);
-
-    let part = payload.next().unwrap();
-    assert_eq!(part.match_indices("text/plain").count(), 1);
-    assert_eq!(body.match_indices("From:").count(), 0);
-    assert_eq!(part.match_indices("Message-ID:").count(), 1);
-    assert_eq!(part.match_indices("Chat-User-Avatar:").count(), 0);
-    assert_eq!(part.match_indices("Subject:").count(), 0);
-
-    let body = payload.next().unwrap();
-    assert_eq!(body.match_indices("this is the text!").count(), 1);
-
-    bob.recv_msg(&sent_msg).await;
-    let alice_contact = Contact::get_by_id(&bob.ctx, alice_id).await.unwrap();
-    assert!(
-        alice_contact
-            .get_profile_image(&bob.ctx)
-            .await
-            .unwrap()
-            .is_some()
-    );
 }

 /// Test that removed member address does not go into the `To:` field.
@@ -743,17 +672,20 @@ async fn test_selfavatar_unencrypted_signed() {
 async fn test_remove_member_bcc() -> Result<()> {
    let mut tcm = TestContextManager::new();

-    // Alice creates a group with Bob and Claire and then removes Bob.
+    // Alice creates a group with Bob and Charlie and then removes Charlie.
+
    let alice = &tcm.alice().await;
    let bob = &tcm.bob().await;
    let charlie = &tcm.charlie().await;

-    let bob_id = alice.add_or_lookup_contact_id(bob).await;
-    let charlie_id = alice.add_or_lookup_contact_id(charlie).await;
-    let charlie_contact = Contact::get_by_id(alice, charlie_id).await?;
-    let charlie_addr = charlie_contact.get_addr();
+    let alice_addr = alice.get_config(Config::Addr).await?.unwrap();
+    let bob_addr = bob.get_config(Config::Addr).await?.unwrap();
+    let charlie_addr = charlie.get_config(Config::Addr).await?.unwrap();

-    let alice_chat_id = create_group(alice, "foo").await?;
+    let bob_id = alice.add_or_lookup_address_contact_id(bob).await;
+    let charlie_id = alice.add_or_lookup_address_contact_id(charlie).await;
+
+    let alice_chat_id = create_group_unencrypted(alice, "foo").await?;
    add_contact_to_chat(alice, alice_chat_id, bob_id).await?;
    add_contact_to_chat(alice, alice_chat_id, charlie_id).await?;
    send_text_msg(alice, alice_chat_id, "Creating a group".to_string()).await?;
@@ -770,8 +702,9 @@ async fn test_remove_member_bcc() -> Result<()> {
    for to_addr in to.iter() {
        match to_addr {
            mailparse::MailAddr::Single(info) => {
-                // Addresses should be of existing members (Alice and Bob) and not Charlie.
+                // Addresses should be of existing members and not Charlie.
                assert_ne!(info.addr, charlie_addr);
+                assert!(info.addr == alice_addr || info.addr == bob_addr);
            }
            mailparse::MailAddr::Group(_) => {
                panic!("Group addresses are not expected here");
@@ -131,11 +131,13 @@ pub(crate) async fn connect_tls_inner(
    alpn: &str,
    tls_session_store: &TlsSessionStore,
 ) -> Result<impl SessionStream + 'static> {
+    let use_sni = true;
    let tcp_stream = connect_tcp_inner(addr).await?;
    let tls_stream = wrap_tls(
        strict_tls,
        host,
        addr.port(),
+        use_sni,
        alpn,
        tcp_stream,
        tls_session_store,
@@ -74,19 +74,33 @@ where
        }
        "https" => {
            let port = parsed_url.port_u16().unwrap_or(443);
-            let load_cache = true;
+            let (use_sni, load_cache) = (true, true);

            if let Some(proxy_config) = proxy_config_opt {
                let proxy_stream = proxy_config
                    .connect(context, host, port, load_cache)
                    .await?;
-                let tls_stream =
-                    wrap_rustls(host, port, "", proxy_stream, &context.tls_session_store).await?;
+                let tls_stream = wrap_rustls(
+                    host,
+                    port,
+                    use_sni,
+                    "",
+                    proxy_stream,
+                    &context.tls_session_store,
+                )
+                .await?;
                Box::new(tls_stream)
            } else {
                let tcp_stream = crate::net::connect_tcp(context, host, port, load_cache).await?;
-                let tls_stream =
-                    wrap_rustls(host, port, "", tcp_stream, &context.tls_session_store).await?;
+                let tls_stream = wrap_rustls(
+                    host,
+                    port,
+                    use_sni,
+                    "",
+                    tcp_stream,
+                    &context.tls_session_store,
+                )
+                .await?;
                Box::new(tls_stream)
            }
        }
@@ -429,9 +429,11 @@ impl ProxyConfig {
                    load_cache,
                )
                .await?;
+                let use_sni = true;
                let tls_stream = wrap_rustls(
                    &https_config.host,
                    https_config.port,
+                    use_sni,
                    "",
                    tcp_stream,
                    &context.tls_session_store,
@@ -13,12 +13,14 @@ pub async fn wrap_tls<'a>(
    strict_tls: bool,
    hostname: &str,
    port: u16,
+    use_sni: bool,
    alpn: &str,
    stream: impl SessionStream + 'static,
    tls_session_store: &TlsSessionStore,
 ) -> Result<impl SessionStream + 'a> {
    if strict_tls {
-        let tls_stream = wrap_rustls(hostname, port, alpn, stream, tls_session_store).await?;
+        let tls_stream =
+            wrap_rustls(hostname, port, use_sni, alpn, stream, tls_session_store).await?;
        let boxed_stream: Box<dyn SessionStream> = Box::new(tls_stream);
        Ok(boxed_stream)
    } else {
@@ -32,6 +34,7 @@ pub async fn wrap_tls<'a>(
        };
        let tls = async_native_tls::TlsConnector::new()
            .min_protocol_version(Some(async_native_tls::Protocol::Tlsv12))
+            .use_sni(use_sni)
            .request_alpns(&alpns)
            .danger_accept_invalid_hostnames(true)
            .danger_accept_invalid_certs(true);
@@ -90,6 +93,7 @@ impl TlsSessionStore {
 pub async fn wrap_rustls<'a>(
    hostname: &str,
    port: u16,
+    use_sni: bool,
    alpn: &str,
    stream: impl SessionStream + 'a,
    tls_session_store: &TlsSessionStore,
@@ -117,6 +121,7 @@ pub async fn wrap_rustls<'a>(
    let resumption = tokio_rustls::rustls::client::Resumption::store(resumption_store)
        .tls12_resumption(tokio_rustls::rustls::client::Tls12Resumption::Disabled);
    config.resumption = resumption;
+    config.enable_sni = use_sni;

    let tls = tokio_rustls::TlsConnector::from(Arc::new(config));
    let name = rustls_pki_types::ServerName::try_from(hostname)?.to_owned();
@@ -433,6 +433,14 @@ impl Params {
        self.set(key, format!("{value}"));
        self
    }
+
+    pub fn steal(&mut self, src: &mut Self, key: Param) -> &mut Self {
+        let val = src.inner.remove(&key);
+        if let Some(val) = val {
+            self.inner.insert(key, val);
+        }
+        self
+    }
 }

 #[cfg(test)]
@@ -160,14 +160,29 @@ fn select_pk_for_encryption(key: &SignedPublicKey) -> Option<&SignedPublicSubKey
        .find(|subkey| subkey.is_encryption_key())
 }

+/// Version of SEIPD packet to use.
+///
+/// See
+/// <https://www.rfc-editor.org/rfc/rfc9580#name-avoiding-ciphertext-malleab>
+/// for the discussion on when v2 SEIPD should be used.
+#[derive(Debug)]
+pub enum SeipdVersion {
+    /// Use v1 SEIPD, for compatibility.
+    V1,
+
+    /// Use v2 SEIPD when we know that v2 SEIPD is supported.
+    V2,
+}
+
 /// Encrypts `plain` text using `public_keys_for_encryption`
 /// and signs it using `private_key_for_signing`.
 pub async fn pk_encrypt(
    plain: Vec<u8>,
    public_keys_for_encryption: Vec<SignedPublicKey>,
-    private_key_for_signing: Option<SignedSecretKey>,
+    private_key_for_signing: SignedSecretKey,
    compress: bool,
    anonymous_recipients: bool,
+    seipd_version: SeipdVersion,
 ) -> Result<String> {
    Handle::current()
        .spawn_blocking(move || {
@@ -178,23 +193,49 @@ pub async fn pk_encrypt(
                .filter_map(select_pk_for_encryption);

            let msg = MessageBuilder::from_bytes("", plain);
-            let mut msg = msg.seipd_v1(&mut rng, SYMMETRIC_KEY_ALGORITHM);
-            for pkey in pkeys {
-                if anonymous_recipients {
-                    msg.encrypt_to_key_anonymous(&mut rng, &pkey)?;
-                } else {
-                    msg.encrypt_to_key(&mut rng, &pkey)?;
-                }
-            }
+            let encoded_msg = match seipd_version {
+                SeipdVersion::V1 => {
+                    let mut msg = msg.seipd_v1(&mut rng, SYMMETRIC_KEY_ALGORITHM);

-            if let Some(ref skey) = private_key_for_signing {
-                msg.sign(&**skey, Password::empty(), HASH_ALGORITHM);
-                if compress {
-                    msg.compression(CompressionAlgorithm::ZLIB);
-                }
-            }
+                    for pkey in pkeys {
+                        if anonymous_recipients {
+                            msg.encrypt_to_key_anonymous(&mut rng, &pkey)?;
+                        } else {
+                            msg.encrypt_to_key(&mut rng, &pkey)?;
+                        }
+                    }

-            let encoded_msg = msg.to_armored_string(&mut rng, Default::default())?;
+                    msg.sign(&*private_key_for_signing, Password::empty(), HASH_ALGORITHM);
+                    if compress {
+                        msg.compression(CompressionAlgorithm::ZLIB);
+                    }
+
+                    msg.to_armored_string(&mut rng, Default::default())?
+                }
+                SeipdVersion::V2 => {
+                    let mut msg = msg.seipd_v2(
+                        &mut rng,
+                        SYMMETRIC_KEY_ALGORITHM,
+                        AeadAlgorithm::Ocb,
+                        ChunkSize::C8KiB,
+                    );
+
+                    for pkey in pkeys {
+                        if anonymous_recipients {
+                            msg.encrypt_to_key_anonymous(&mut rng, &pkey)?;
+                        } else {
+                            msg.encrypt_to_key(&mut rng, &pkey)?;
+                        }
+                    }
+
+                    msg.sign(&*private_key_for_signing, Password::empty(), HASH_ALGORITHM);
+                    if compress {
+                        msg.compression(CompressionAlgorithm::ZLIB);
+                    }
+
+                    msg.to_armored_string(&mut rng, Default::default())?
+                }
+            };

            Ok(encoded_msg)
        })
@@ -406,7 +447,7 @@ pub async fn symm_encrypt_message(
        };
        let mut msg = msg.seipd_v2(
            &mut rng,
-            SymmetricKeyAlgorithm::AES128,
+            SYMMETRIC_KEY_ALGORITHM,
            AeadAlgorithm::Ocb,
            ChunkSize::C8KiB,
        );
@@ -534,7 +575,6 @@ mod tests {
    static KEYS: LazyLock<TestKeys> = LazyLock::new(TestKeys::new);

    static CTEXT_SIGNED: OnceCell<String> = OnceCell::const_new();
-    static CTEXT_UNSIGNED: OnceCell<String> = OnceCell::const_new();

    /// A ciphertext encrypted to Alice & Bob, signed by Alice.
    async fn ctext_signed() -> &'static String {
@@ -547,30 +587,10 @@ mod tests {
                pk_encrypt(
                    CLEARTEXT.to_vec(),
                    keyring,
-                    Some(KEYS.alice_secret.clone()),
-                    compress,
-                    anonymous_recipients,
-                )
-                .await
-                .unwrap()
-            })
-            .await
-    }
-
-    /// A ciphertext encrypted to Alice & Bob, not signed.
-    async fn ctext_unsigned() -> &'static String {
-        let anonymous_recipients = true;
-        CTEXT_UNSIGNED
-            .get_or_init(|| async {
-                let keyring = vec![KEYS.alice_public.clone(), KEYS.bob_public.clone()];
-                let compress = true;
-
-                pk_encrypt(
-                    CLEARTEXT.to_vec(),
-                    keyring,
-                    None,
+                    KEYS.alice_secret.clone(),
                    compress,
                    anonymous_recipients,
+                    SeipdVersion::V2,
                )
                .await
                .unwrap()
@@ -588,16 +608,6 @@ mod tests {
        );
    }

-    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-    async fn test_encrypt_unsigned() {
-        assert!(!ctext_unsigned().await.is_empty());
-        assert!(
-            ctext_unsigned()
-                .await
-                .starts_with("-----BEGIN PGP MESSAGE-----")
-        );
-    }
-
    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
    async fn test_decrypt_singed() {
        // Check decrypting as Alice
@@ -652,9 +662,9 @@ mod tests {
    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
    async fn test_decrypt_unsigned() {
        let decrypt_keyring = vec![KEYS.bob_secret.clone()];
+        let ctext_unsigned = include_bytes!("../test-data/message/ctext_unsigned.asc");
        let (_msg, valid_signatures, content) =
-            pk_decrypt_and_validate(ctext_unsigned().await.as_bytes(), &decrypt_keyring, &[])
-                .unwrap();
+            pk_decrypt_and_validate(ctext_unsigned, &decrypt_keyring, &[]).unwrap();
        assert_eq!(content, CLEARTEXT);
        assert_eq!(valid_signatures.len(), 0);
    }
@@ -744,7 +754,15 @@ mod tests {
        let pk_for_encryption = load_self_public_key(alice).await?;

        // Encrypt a message, but only to self, not to Bob:
-        let ctext = pk_encrypt(plain, vec![pk_for_encryption], None, true, true).await?;
+        let ctext = pk_encrypt(
+            plain,
+            vec![pk_for_encryption],
+            KEYS.alice_secret.clone(),
+            true,
+            true,
+            SeipdVersion::V2,
+        )
+        .await?;

        // Trying to decrypt it should fail with an OK error message:
        let bob_private_keyring = crate::key::load_self_secret_keyring(bob).await?;
@@ -16,7 +16,6 @@ use serde::Deserialize;
 use crate::config::Config;
 use crate::contact::{Contact, ContactId, Origin};
 use crate::context::Context;
-use crate::events::EventType;
 use crate::key::Fingerprint;
 use crate::login_param::{EnteredCertificateChecks, EnteredLoginParam, EnteredServerLoginParam};
 use crate::net::http::post_empty;
@@ -42,7 +41,7 @@ pub(crate) const DCBACKUP_SCHEME_PREFIX: &str = "DCBACKUP";

 /// Version written to Backups and Backup-QR-Codes.
 /// Imports will fail when they have a larger version.
-pub(crate) const DCBACKUP_VERSION: i32 = 3;
+pub(crate) const DCBACKUP_VERSION: i32 = 4;

 /// Scanned QR code.
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -824,9 +823,10 @@ pub(crate) async fn login_param_from_account_qr(
        match serde_json::from_str::<CreateAccountErrorResponse>(&response_text) {
            Ok(error) => Err(anyhow!(error.reason)),
            Err(parse_error) => {
-                context.emit_event(EventType::Error(format!(
+                error!(
+                    context,
                    "Cannot create account, server response could not be parsed:\n{parse_error:#}\nraw response:\n{response_text}"
-                )));
+                );
                bail!("Cannot create account, unexpected server response:\n{response_text:?}")
            }
        }
@@ -991,42 +991,6 @@ Content-Disposition: reaction\n\
        Ok(())
    }

-    /// Regression test for reaction resetting self-status.
-    ///
-    /// Reactions do not contain the status,
-    /// but should not result in self-status being reset on other devices.
-    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-    async fn test_reaction_status_multidevice() -> Result<()> {
-        let mut tcm = TestContextManager::new();
-        let alice1 = tcm.alice().await;
-        let alice2 = tcm.alice().await;
-
-        alice1
-            .set_config(Config::Selfstatus, Some("New status"))
-            .await?;
-
-        let alice2_msg = tcm.send_recv(&alice1, &alice2, "Hi!").await;
-        assert_eq!(
-            alice2.get_config(Config::Selfstatus).await?.as_deref(),
-            Some("New status")
-        );
-
-        // Alice reacts to own message from second device,
-        // first device receives rection.
-        {
-            send_reaction(&alice2, alice2_msg.id, "👍").await?;
-            let msg = alice2.pop_sent_msg().await;
-            alice1.recv_msg_hidden(&msg).await;
-        }
-
-        // Check that the status is still the same.
-        assert_eq!(
-            alice1.get_config(Config::Selfstatus).await?.as_deref(),
-            Some("New status")
-        );
-        Ok(())
-    }
-
    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
    async fn test_send_reaction_multidevice() -> Result<()> {
        let mut tcm = TestContextManager::new();
@@ -43,7 +43,9 @@ use crate::simplify;
 use crate::stats::STATISTICS_BOT_EMAIL;
 use crate::stock_str;
 use crate::sync::Sync::*;
-use crate::tools::{self, buf_compress, remove_subject_prefix, validate_broadcast_secret};
+use crate::tools::{
+    self, buf_compress, normalize_text, remove_subject_prefix, validate_broadcast_secret,
+};
 use crate::{chatlist_events, ensure_and_debug_assert, ensure_and_debug_assert_eq, location};

 /// This is the struct that is returned after receiving one email (aka MIME message).
@@ -675,12 +677,22 @@ pub(crate) async fn receive_imf_inner(
        let res = if mime_parser.incoming {
            handle_securejoin_handshake(context, &mut mime_parser, from_id)
                .await
-                .context("error in Secure-Join message handling")?
+                .with_context(|| {
+                    format!(
+                        "Error in Secure-Join '{}' message handling",
+                        mime_parser.get_header(HeaderDef::SecureJoin).unwrap_or("")
+                    )
+                })?
        } else if let Some(to_id) = to_ids.first().copied().flatten() {
            // handshake may mark contacts as verified and must be processed before chats are created
            observe_securejoin_on_other_device(context, &mime_parser, to_id)
                .await
-                .context("error in Secure-Join watching")?
+                .with_context(|| {
+                    format!(
+                        "Error in Secure-Join '{}' watching",
+                        mime_parser.get_header(HeaderDef::SecureJoin).unwrap_or("")
+                    )
+                })?
        } else {
            securejoin::HandshakeMessage::Propagate
        };
@@ -827,6 +839,41 @@ pub(crate) async fn receive_imf_inner(
    if let Some(ref sync_items) = mime_parser.sync_items {
        if from_id == ContactId::SELF {
            if mime_parser.was_encrypted() {
+                // Receiving encrypted message from self updates primary transport.
+                let from_addr = &mime_parser.from.addr;
+
+                let transport_changed = context
+                    .sql
+                    .transaction(|transaction| {
+                        let transport_exists = transaction.query_row(
+                            "SELECT COUNT(*) FROM transports WHERE addr=?",
+                            (from_addr,),
+                            |row| {
+                                let count: i64 = row.get(0)?;
+                                Ok(count > 0)
+                            },
+                        )?;
+
+                        let transport_changed = if transport_exists {
+                            transaction.execute(
+                                "UPDATE config SET value=? WHERE keyname='configured_addr'",
+                                (from_addr,),
+                            )? > 0
+                        } else {
+                            warn!(
+                                context,
+                                "Received sync message from unknown address {from_addr:?}."
+                            );
+                            false
+                        };
+                        Ok(transport_changed)
+                    })
+                    .await?;
+                if transport_changed {
+                    info!(context, "Primary transport changed to {from_addr:?}.");
+                    context.sql.uncache_raw_config("configured_addr").await;
+                }
+
                context
                    .execute_sync_items(sync_items, mime_parser.timestamp_sent)
                    .await;
@@ -885,13 +932,11 @@ pub(crate) async fn receive_imf_inner(
    }

    if let Some(avatar_action) = &mime_parser.user_avatar
-        && from_id != ContactId::UNDEFINED
+        && !matches!(from_id, ContactId::UNDEFINED | ContactId::SELF)
        && context
            .update_contacts_timestamp(from_id, Param::AvatarTimestamp, mime_parser.timestamp_sent)
            .await?
-        && let Err(err) =
-            contact::set_profile_image(context, from_id, avatar_action, mime_parser.was_encrypted())
-                .await
+        && let Err(err) = contact::set_profile_image(context, from_id, avatar_action).await
    {
        warn!(context, "receive_imf cannot update profile image: {err:#}.");
    };
@@ -899,18 +944,11 @@ pub(crate) async fn receive_imf_inner(
    // Ignore footers from mailinglists as they are often created or modified by the mailinglist software.
    if let Some(footer) = &mime_parser.footer
        && !mime_parser.is_mailinglist_message()
-        && from_id != ContactId::UNDEFINED
+        && !matches!(from_id, ContactId::UNDEFINED | ContactId::SELF)
        && context
            .update_contacts_timestamp(from_id, Param::StatusTimestamp, mime_parser.timestamp_sent)
            .await?
-        && let Err(err) = contact::set_status(
-            context,
-            from_id,
-            footer.to_string(),
-            mime_parser.was_encrypted(),
-            mime_parser.has_chat_version(),
-        )
-        .await
+        && let Err(err) = contact::set_status(context, from_id, footer.to_string()).await
    {
        warn!(context, "Cannot update contact status: {err:#}.");
    }
@@ -2068,7 +2106,7 @@ RETURNING id
                    if trash { MessageState::Undefined } else { state },
                    if trash { MessengerMessage::No } else { is_dc_message },
                    if trash || hidden { "" } else { msg },
-                    if trash || hidden { None } else { message::normalize_text(msg) },
+                    if trash || hidden { None } else { normalize_text(msg) },
                    if trash || hidden { "" } else { &subject },
                    if trash {
                        "".to_string()
@@ -2480,10 +2518,11 @@ async fn lookup_or_create_adhoc_group(
                id INTEGER PRIMARY KEY
            ) STRICT",
            (),
-        )?;
+        )
+        .context("CREATE TEMP TABLE temp.contacts")?;
        let mut stmt = t.prepare("INSERT INTO temp.contacts(id) VALUES (?)")?;
        for &id in &contact_ids {
-            stmt.execute((id,))?;
+            stmt.execute((id,)).context("INSERT INTO temp.contacts")?;
        }
        let val = t
            .query_row(
@@ -2505,8 +2544,10 @@ async fn lookup_or_create_adhoc_group(
                    Ok((id, blocked))
                },
            )
-            .optional()?;
-        t.execute("DROP TABLE temp.contacts", ())?;
+            .optional()
+            .context("Select chat with matching name and members")?;
+        t.execute("DROP TABLE temp.contacts", ())
+            .context("DROP TABLE temp.contacts")?;
        Ok(val)
    };
    let query_only = true;
@@ -3062,7 +3103,10 @@ async fn apply_chat_name_and_avatar_changes(
            info!(context, "Updating grpname for chat {}.", chat.id);
            context
                .sql
-                .execute("UPDATE chats SET name=? WHERE id=?;", (grpname, chat.id))
+                .execute(
+                    "UPDATE chats SET name=?, name_normalized=? WHERE id=?",
+                    (grpname, normalize_text(grpname), chat.id),
+                )
                .await?;
            *send_event_chat_modified = true;
        }
@@ -3351,7 +3395,10 @@ async fn apply_mailinglist_changes(
        info!(context, "Updating listname for chat {chat_id}.");
        context
            .sql
-            .execute("UPDATE chats SET name=? WHERE id=?;", (new_name, chat_id))
+            .execute(
+                "UPDATE chats SET name=?, name_normalized=? WHERE id=?",
+                (&new_name, normalize_text(&new_name), chat_id),
+            )
            .await?;
        context.emit_event(EventType::ChatModified(chat_id));
    }
@@ -325,6 +325,8 @@ impl Drop for IoPausedGuard {

 #[derive(Debug)]
 struct SchedBox {
+    /// Hostname of used chatmail/email relay
+    host: String,
    meaning: FolderMeaning,
    conn_state: ImapConnectionState,

@@ -578,12 +580,19 @@ async fn fetch_idle(
                mvbox.as_deref().unwrap_or(&watch_folder)
            }
        };
-        session
-            .send_sync_msgs(ctx, syncbox)
-            .await
-            .context("fetch_idle: send_sync_msgs")
-            .log_err(ctx)
-            .ok();
+        if ctx
+            .get_config(Config::ConfiguredAddr)
+            .await?
+            .unwrap_or_default()
+            == connection.addr
+        {
+            session
+                .send_sync_msgs(ctx, syncbox)
+                .await
+                .context("fetch_idle: send_sync_msgs")
+                .log_err(ctx)
+                .ok();
+        }

        session
            .store_seen_flags_on_imap(ctx)
@@ -874,7 +883,14 @@ impl Scheduler {
                let ctx = ctx.clone();
                task::spawn(inbox_loop(ctx, inbox_start_send, inbox_handlers))
            };
+            let host = configured_login_param
+                .addr
+                .split("@")
+                .last()
+                .context("address has no host")?
+                .to_owned();
            let inbox = SchedBox {
+                host: host.clone(),
                meaning: FolderMeaning::Inbox,
                conn_state,
                handle,
@@ -890,6 +906,7 @@ impl Scheduler {
                let meaning = FolderMeaning::Mvbox;
                let handle = task::spawn(simple_imap_loop(ctx, start_send, handlers, meaning));
                oboxes.push(SchedBox {
+                    host,
                    meaning,
                    conn_state,
                    handle,
@@ -373,7 +373,13 @@ impl Context {
            InnerSchedulerState::Started(ref sched) => (
                sched
                    .boxes()
-                    .map(|b| (b.meaning, b.conn_state.state.connectivity.clone()))
+                    .map(|b| {
+                        (
+                            b.host.clone(),
+                            b.meaning,
+                            b.conn_state.state.connectivity.clone(),
+                        )
+                    })
                    .collect::<Vec<_>>(),
                sched.smtp.state.connectivity.clone(),
            ),
@@ -396,7 +402,7 @@ impl Context {
        let watched_folders = get_watched_folder_configs(self).await?;
        let incoming_messages = stock_str::incoming_messages(self).await;
        ret += &format!("<h3>{incoming_messages}</h3><ul>");
-        for (folder, state) in &folders_states {
+        for (host, folder, state) in &folders_states {
            let mut folder_added = false;

            if let Some(config) = folder.to_config().filter(|c| watched_folders.contains(c)) {
@@ -407,7 +413,11 @@ impl Context {
                    ret += "<li>";
                    ret += &*detailed.to_icon();
                    ret += " <b>";
-                    ret += &*escaper::encode_minimal(&foldername);
+                    if folder == &FolderMeaning::Inbox {
+                        ret += &*escaper::encode_minimal(host);
+                    } else {
+                        ret += &*escaper::encode_minimal(&foldername);
+                    }
                    ret += ":</b> ";
                    ret += &*escaper::encode_minimal(&detailed.to_string_imap(self).await);
                    ret += "</li>";
@@ -567,7 +567,7 @@ pub(crate) async fn handle_securejoin_handshake(
        "vc-contact-confirm" => {
            context.emit_event(EventType::SecurejoinJoinerProgress {
                contact_id,
-                progress: JoinerProgress::Succeeded.to_usize(),
+                progress: JoinerProgress::Succeeded.into_u16(),
            });
            Ok(HandshakeMessage::Ignore)
        }
@@ -590,7 +590,7 @@ pub(crate) async fn handle_securejoin_handshake(

            context.emit_event(EventType::SecurejoinJoinerProgress {
                contact_id,
-                progress: JoinerProgress::Succeeded.to_usize(),
+                progress: JoinerProgress::Succeeded.into_u16(),
            });
            Ok(HandshakeMessage::Propagate)
        }
@@ -43,17 +43,7 @@ pub(super) async fn start_protocol(context: &Context, invite: QrInvite) -> Resul
    // A 1:1 chat is needed to send messages to Alice.  When joining a group this chat is
    // hidden, if a user starts sending messages in it it will be unhidden in
    // receive_imf.
-    let hidden = match invite {
-        QrInvite::Contact { .. } => Blocked::Not,
-        QrInvite::Group { .. } => Blocked::Yes,
-        QrInvite::Broadcast { .. } => Blocked::Yes,
-    };
-
-    // The 1:1 chat with the inviter
-    let private_chat_id =
-        ChatId::create_for_contact_with_blocked(context, invite.contact_id(), hidden)
-            .await
-            .with_context(|| format!("can't create chat for contact {}", invite.contact_id()))?;
+    let private_chat_id = private_chat_id(context, &invite).await?;

    ContactId::scaleup_origin(context, &[invite.contact_id()], Origin::SecurejoinJoined).await?;
    context.emit_event(EventType::ContactsChanged(None));
@@ -94,7 +84,7 @@ pub(super) async fn start_protocol(context: &Context, invite: QrInvite) -> Resul
            // Even if Alice is not verified, we don't send anything.
            context.emit_event(EventType::SecurejoinJoinerProgress {
                contact_id: invite.contact_id(),
-                progress: JoinerProgress::Succeeded.to_usize(),
+                progress: JoinerProgress::Succeeded.into_u16(),
            });
            return Ok(joining_chat_id);
        } else if has_key
@@ -113,7 +103,7 @@ pub(super) async fn start_protocol(context: &Context, invite: QrInvite) -> Resul

            context.emit_event(EventType::SecurejoinJoinerProgress {
                contact_id: invite.contact_id(),
-                progress: JoinerProgress::RequestWithAuthSent.to_usize(),
+                progress: JoinerProgress::RequestWithAuthSent.into_u16(),
            });
        } else {
            send_handshake_message(context, &invite, private_chat_id, BobHandshakeMsg::Request)
@@ -175,6 +165,9 @@ pub(super) async fn start_protocol(context: &Context, invite: QrInvite) -> Resul
 ///
 /// Returns the ID of the newly inserted entry.
 async fn insert_new_db_entry(context: &Context, invite: QrInvite, chat_id: ChatId) -> Result<i64> {
+    // The `chat_id` isn't actually needed anymore,
+    // but we still save it;
+    // can be removed as a future improvement.
    context
        .sql
        .insert(
@@ -195,11 +188,10 @@ pub(super) async fn handle_auth_required(
    // Load all Bob states that expect `vc-auth-required` or `vg-auth-required`.
    let bob_states = context
        .sql
-        .query_map_vec("SELECT id, invite, chat_id FROM bobstate", (), |row| {
+        .query_map_vec("SELECT id, invite FROM bobstate", (), |row| {
            let row_id: i64 = row.get(0)?;
            let invite: QrInvite = row.get(1)?;
-            let chat_id: ChatId = row.get(2)?;
-            Ok((row_id, invite, chat_id))
+            Ok((row_id, invite))
        })
        .await?;

@@ -209,7 +201,7 @@ pub(super) async fn handle_auth_required(
    );

    let mut auth_sent = false;
-    for (bobstate_row_id, invite, chat_id) in bob_states {
+    for (bobstate_row_id, invite) in bob_states {
        if !encrypted_and_signed(context, message, invite.fingerprint()) {
            continue;
        }
@@ -220,6 +212,7 @@ pub(super) async fn handle_auth_required(
        }

        info!(context, "Fingerprint verified.",);
+        let chat_id = private_chat_id(context, &invite).await?;
        send_handshake_message(context, &invite, chat_id, BobHandshakeMsg::RequestWithAuth).await?;
        context
            .sql
@@ -240,7 +233,7 @@ pub(super) async fn handle_auth_required(

        context.emit_event(EventType::SecurejoinJoinerProgress {
            contact_id: invite.contact_id(),
-            progress: JoinerProgress::RequestWithAuthSent.to_usize(),
+            progress: JoinerProgress::RequestWithAuthSent.into_u16(),
        });

        auth_sent = true;
@@ -348,6 +341,22 @@ impl BobHandshakeMsg {
    }
 }

+/// Returns the 1:1 chat with the inviter.
+///
+/// This is the chat in which securejoin messages are sent.
+/// The 1:1 chat will be created if it does not yet exist.
+async fn private_chat_id(context: &Context, invite: &QrInvite) -> Result<ChatId> {
+    let hidden = match invite {
+        QrInvite::Contact { .. } => Blocked::Not,
+        QrInvite::Group { .. } => Blocked::Yes,
+        QrInvite::Broadcast { .. } => Blocked::Yes,
+    };
+
+    ChatId::create_for_contact_with_blocked(context, invite.contact_id(), hidden)
+        .await
+        .with_context(|| format!("can't create chat for contact {}", invite.contact_id()))
+}
+
 /// Returns the [`ChatId`] of the chat being joined.
 ///
 /// This is the chat in which you want to notify the user as well.
@@ -406,8 +415,7 @@ pub(crate) enum JoinerProgress {
 }

 impl JoinerProgress {
-    #[expect(clippy::wrong_self_convention)]
-    pub(crate) fn to_usize(self) -> usize {
+    pub(crate) fn into_u16(self) -> u16 {
        match self {
            JoinerProgress::RequestWithAuthSent => 400,
            JoinerProgress::Succeeded => 1000,
@@ -243,7 +243,7 @@ async fn test_setup_contact_ex(case: SetupContactCase) {
        .unwrap();
    match case {
        SetupContactCase::AliceHasName => assert_eq!(contact_alice.get_authname(), "Alice"),
-        _ => assert_eq!(contact_alice.get_authname(), "Alice Exampleorg"),
+        _ => assert_eq!(contact_alice.get_authname(), ""),
    };

    // Check Alice sent the right message to Bob.
@@ -228,6 +228,7 @@ async fn connect_secure_proxy(
    strict_tls: bool,
    proxy_config: ProxyConfig,
 ) -> Result<Box<dyn SessionBufStream>> {
+    let use_sni = true;
    let proxy_stream = proxy_config
        .connect(context, hostname, port, strict_tls)
        .await?;
@@ -235,6 +236,7 @@ async fn connect_secure_proxy(
        strict_tls,
        hostname,
        port,
+        use_sni,
        alpn(port),
        proxy_stream,
        &context.tls_session_store,
@@ -253,6 +255,7 @@ async fn connect_starttls_proxy(
    strict_tls: bool,
    proxy_config: ProxyConfig,
 ) -> Result<Box<dyn SessionBufStream>> {
+    let use_sni = false;
    let proxy_stream = proxy_config
        .connect(context, hostname, port, strict_tls)
        .await?;
@@ -266,6 +269,7 @@ async fn connect_starttls_proxy(
        strict_tls,
        hostname,
        port,
+        use_sni,
        "",
        tcp_stream,
        &context.tls_session_store,
@@ -316,6 +320,7 @@ async fn connect_starttls(
    strict_tls: bool,
    tls_session_store: &TlsSessionStore,
 ) -> Result<Box<dyn SessionBufStream>> {
+    let use_sni = false;
    let tcp_stream = connect_tcp_inner(addr).await?;

    // Run STARTTLS command and convert the client back into a stream.
@@ -327,6 +332,7 @@ async fn connect_starttls(
        strict_tls,
        host,
        addr.port(),
+        use_sni,
        "",
        tcp_stream,
        tls_session_store,
@@ -9,7 +9,6 @@ use rusqlite::{Connection, OpenFlags, Row, config::DbConfig, types::ValueRef};
 use tokio::sync::RwLock;

 use crate::blob::BlobObject;
-use crate::chat::add_device_msg;
 use crate::config::Config;
 use crate::constants::DC_CHAT_ID_TRASH;
 use crate::context::Context;
@@ -18,12 +17,11 @@ use crate::ephemeral::start_ephemeral_timers;
 use crate::imex::BLOBS_BACKUP_NAME;
 use crate::location::delete_orphaned_poi_locations;
 use crate::log::{LogExt, warn};
-use crate::message::{Message, MsgId};
+use crate::message::MsgId;
 use crate::net::dns::prune_dns_cache;
 use crate::net::http::http_cache_cleanup;
 use crate::net::prune_connection_history;
 use crate::param::{Param, Params};
-use crate::stock_str;
 use crate::tools::{SystemTime, Time, delete_file, time, time_elapsed};

 /// Extension to [`rusqlite::ToSql`] trait
@@ -216,26 +214,13 @@ impl Sql {
        // this should be done before updates that use high-level objects that
        // rely themselves on the low-level structure.

-        // `update_icons` is not used anymore, since it's not necessary anymore to "update" icons:
-        let (_update_icons, disable_server_delete, recode_avatar) = migrations::run(context, self)
+        let recode_avatar = migrations::run(context, self)
            .await
            .context("failed to run migrations")?;

        // (2) updates that require high-level objects
        // the structure is complete now and all objects are usable

-        if disable_server_delete {
-            // We now always watch all folders and delete messages there if delete_server is enabled.
-            // So, for people who have delete_server enabled, disable it and add a hint to the devicechat:
-            if context.get_config_delete_server_after().await?.is_some() {
-                let mut msg = Message::new_text(stock_str::delete_server_turned_off(context).await);
-                add_device_msg(context, None, Some(&mut msg)).await?;
-                context
-                    .set_config_internal(Config::DeleteServerAfter, Some("0"))
-                    .await?;
-            }
-        }
-
        if recode_avatar && let Some(avatar) = context.get_config(Config::Selfavatar).await? {
            let mut blob = BlobObject::from_path(context, Path::new(&avatar))?;
            match blob.recode_to_avatar_size(context).await {
@@ -19,7 +19,7 @@ use crate::log::warn;
 use crate::message::MsgId;
 use crate::provider::get_provider_info;
 use crate::sql::Sql;
-use crate::tools::{Time, inc_and_check, time_elapsed};
+use crate::tools::{Time, inc_and_check, normalize_text, time_elapsed};
 use crate::transport::ConfiguredLoginParam;

 const DBVERSION: i32 = 68;
@@ -31,7 +31,7 @@ tokio::task_local! {
    static STOP_MIGRATIONS_AT: i32;
 }

-pub async fn run(context: &Context, sql: &Sql) -> Result<(bool, bool, bool)> {
+pub async fn run(context: &Context, sql: &Sql) -> Result<bool> {
    let mut exists_before_update = false;
    let mut dbversion_before_update = DBVERSION;

@@ -68,8 +68,6 @@ pub async fn run(context: &Context, sql: &Sql) -> Result<(bool, bool, bool)> {
    }

    let dbversion = dbversion_before_update;
-    let mut update_icons = !exists_before_update;
-    let mut disable_server_delete = false;
    let mut recode_avatar = false;

    if dbversion < 1 {
@@ -299,7 +297,6 @@ CREATE INDEX devmsglabels_index1 ON devmsglabels (label);"#, 59)
            61,
        )
        .await?;
-        update_icons = true;
    }
    if dbversion < 62 {
        sql.execute_migration(
@@ -327,7 +324,6 @@ ALTER TABLE msgs ADD COLUMN ephemeral_timestamp INTEGER DEFAULT 0;"#,
        .await?;
    }
    if dbversion < 66 {
-        update_icons = true;
        sql.set_db_version(66).await?;
    }
    if dbversion < 67 {
@@ -445,17 +441,6 @@ CREATE TABLE imap_sync (folder TEXT PRIMARY KEY, uidvalidity INTEGER DEFAULT 0,
                }
            }
        }
-        if exists_before_update {
-            disable_server_delete = true;
-
-            // Don't disable server delete if it was on by default (Nauta):
-            if let Some(provider) = context.get_configured_provider().await?
-                && let Some(defaults) = &provider.config_defaults
-                && defaults.iter().any(|d| d.key == Config::DeleteServerAfter)
-            {
-                disable_server_delete = false;
-            }
-        }
        sql.set_db_version(73).await?;
    }
    if dbversion < 74 {
@@ -1445,6 +1430,80 @@ CREATE INDEX imap_sync_index ON imap_sync(transport_id, folder);
        .await?;
    }

+    inc_and_check(&mut migration_version, 141)?;
+    if dbversion < migration_version {
+        sql.execute_migration(
+            "CREATE INDEX imap_only_rfc724_mid ON imap(rfc724_mid)",
+            migration_version,
+        )
+        .await?;
+    }
+
+    inc_and_check(&mut migration_version, 142)?;
+    if dbversion < migration_version {
+        sql.execute_migration(
+            "ALTER TABLE transports
+             ADD COLUMN add_timestamp INTEGER NOT NULL DEFAULT 0;
+             CREATE TABLE removed_transports (
+                 addr TEXT NOT NULL,
+                 remove_timestamp INTEGER NOT NULL,
+                 UNIQUE(addr)
+             ) STRICT;",
+            migration_version,
+        )
+        .await?;
+    }
+
+    inc_and_check(&mut migration_version, 143)?;
+    if dbversion < migration_version {
+        let trans_fn = |t: &mut rusqlite::Transaction| {
+            t.execute_batch(
+                "
+ALTER TABLE chats ADD COLUMN name_normalized TEXT;
+ALTER TABLE contacts ADD COLUMN name_normalized TEXT;
+                ",
+            )?;
+
+            let mut stmt = t.prepare("UPDATE chats SET name_normalized=? WHERE id=?")?;
+            for res in t
+                .prepare("SELECT id, name FROM chats LIMIT 10000")?
+                .query_map((), |row| {
+                    let id: u32 = row.get(0)?;
+                    let name: String = row.get(1)?;
+                    Ok((id, name))
+                })?
+            {
+                let (id, name) = res?;
+                if let Some(name_normalized) = normalize_text(&name) {
+                    stmt.execute((name_normalized, id))?;
+                }
+            }
+
+            let mut stmt = t.prepare("UPDATE contacts SET name_normalized=? WHERE id=?")?;
+            for res in t
+                .prepare(
+                    "
+SELECT id, IIF(name='', authname, name) FROM contacts
+ORDER BY last_seen DESC LIMIT 10000
+                ",
+                )?
+                .query_map((), |row| {
+                    let id: u32 = row.get(0)?;
+                    let name: String = row.get(1)?;
+                    Ok((id, name))
+                })?
+            {
+                let (id, name) = res?;
+                if let Some(name_normalized) = normalize_text(&name) {
+                    stmt.execute((name_normalized, id))?;
+                }
+            }
+            Ok(())
+        };
+        sql.execute_migration_transaction(trans_fn, migration_version)
+            .await?;
+    }
+
    let new_version = sql
        .get_raw_config_int(VERSION_CFG)
        .await?
@@ -1459,7 +1518,7 @@ CREATE INDEX imap_sync_index ON imap_sync(transport_id, folder);
    }
    info!(context, "Database version: v{new_version}.");

-    Ok((update_icons, disable_server_delete, recode_avatar))
+    Ok(recode_avatar)
 }

 fn migrate_key_contacts(
@@ -160,9 +160,7 @@ async fn test_key_contacts_migration_verified() -> Result<()> {
    "#,
    )?)).await?;

-    STOP_MIGRATIONS_AT
-        .scope(133, t.sql.run_migrations(&t))
-        .await?;
+    t.sql.run_migrations(&t).await?;

    // Hidden address-contact can't be looked up.
    assert!(
@@ -1,4 +1,5 @@
 use super::*;
+use crate::message::Message;
 use crate::{EventType, test_utils::TestContext};

 #[test]
@@ -179,9 +180,7 @@ async fn test_migration_flags() -> Result<()> {
    // as migrations::run() was already executed on context creation,
    // another call should not result in any action needed.
    // this test catches some bugs where dbversion was forgotten to be persisted.
-    let (update_icons, disable_server_delete, recode_avatar) = migrations::run(&t, &t.sql).await?;
-    assert!(!update_icons);
-    assert!(!disable_server_delete);
+    let recode_avatar = migrations::run(&t, &t.sql).await?;
    assert!(!recode_avatar);

    info!(&t, "test_migration_flags: XXX END MARKER");
@@ -13,7 +13,7 @@ use crate::accounts::Accounts;
 use crate::blob::BlobObject;
 use crate::chat::{self, Chat, ChatId};
 use crate::config::Config;
-use crate::contact::{Contact, ContactId, Origin};
+use crate::contact::{Contact, ContactId};
 use crate::context::Context;
 use crate::message::{Message, Viewtype};
 use crate::param::Param;
@@ -155,13 +155,6 @@ pub enum StockMessage {
                    To use the \"Saved messages\" feature again, create a new chat with yourself."))]
    SelfDeletedMsgBody = 91,

-    #[strum(props(
-        fallback = "⚠️ The \"Delete messages from server\" feature now also deletes messages in folders other than Inbox, DeltaChat and Sent.\n\n\
-                    ℹ️ To avoid accidentally deleting messages, we turned it off for you. Please turn it on again at \
-                    Settings → \"Chats and Media\" → \"Delete messages from server\" to continue using it."
-    ))]
-    DeleteServerTurnedOff = 92,
-
    #[strum(props(fallback = "Forwarded"))]
    Forwarded = 97,

@@ -241,11 +234,6 @@ pub enum StockMessage {
    #[strum(props(fallback = "Not connected"))]
    NotConnected = 121,

-    #[strum(props(
-        fallback = "You changed your email address from %1$s to %2$s.\n\nIf you now send a message to a verified group, contacts there will automatically replace the old with your new address.\n\nIt's highly advised to set up your old email provider to forward all emails to your new email address. Otherwise you might miss messages of contacts who did not get your new address yet."
-    ))]
-    AeapExplanationAndLink = 123,
-
    #[strum(props(fallback = "You changed group name from \"%1$s\" to \"%2$s\"."))]
    MsgYouChangedGrpName = 124,

@@ -356,22 +344,9 @@ pub enum StockMessage {
    #[strum(props(fallback = "ℹ️ Account transferred to your second device."))]
    BackupTransferMsgBody = 163,

-    #[strum(props(fallback = "I added member %1$s."))]
-    MsgIAddMember = 164,
-
-    #[strum(props(fallback = "I removed member %1$s."))]
-    MsgIDelMember = 165,
-
-    #[strum(props(fallback = "I left the group."))]
-    MsgILeftGroup = 166,
-
    #[strum(props(fallback = "Messages are end-to-end encrypted."))]
    ChatProtectionEnabled = 170,

-    // deprecated 2025-07
-    #[strum(props(fallback = "%1$s sent a message from another device."))]
-    ChatProtectionDisabled = 171,
-
    #[strum(props(fallback = "Others will only see this group after you sent a first message."))]
    NewGroupSendFirstMessage = 172,

@@ -626,25 +601,6 @@ pub(crate) async fn msg_grp_img_changed(context: &Context, by_contact: ContactId
    }
 }

-/// Stock string: `I added member %1$s.`.
-/// This one is for sending in group chats.
-///
-/// The `added_member_addr` parameter should be an email address and is looked up in the
-/// contacts to combine with the authorized display name.
-pub(crate) async fn msg_add_member_remote(context: &Context, added_member_addr: &str) -> String {
-    let addr = added_member_addr;
-    let whom = &match Contact::lookup_id_by_addr(context, addr, Origin::Unknown).await {
-        Ok(Some(contact_id)) => Contact::get_by_id(context, contact_id)
-            .await
-            .map(|contact| contact.get_authname_or_addr())
-            .unwrap_or_else(|_| addr.to_string()),
-        _ => addr.to_string(),
-    };
-    translated(context, StockMessage::MsgIAddMember)
-        .await
-        .replace1(whom)
-}
-
 /// Stock string: `You added member %1$s.` or `Member %1$s added by %2$s.`.
 ///
 /// The `added_member_addr` parameter should be an email address and is looked up in the
@@ -671,24 +627,6 @@ pub(crate) async fn msg_add_member_local(
    }
 }

-/// Stock string: `I removed member %1$s.`.
-///
-/// The `removed_member_addr` parameter should be an email address and is looked up in
-/// the contacts to combine with the display name.
-pub(crate) async fn msg_del_member_remote(context: &Context, removed_member_addr: &str) -> String {
-    let addr = removed_member_addr;
-    let whom = &match Contact::lookup_id_by_addr(context, addr, Origin::Unknown).await {
-        Ok(Some(contact_id)) => Contact::get_by_id(context, contact_id)
-            .await
-            .map(|contact| contact.get_authname_or_addr())
-            .unwrap_or_else(|_| addr.to_string()),
-        _ => addr.to_string(),
-    };
-    translated(context, StockMessage::MsgIDelMember)
-        .await
-        .replace1(whom)
-}
-
 /// Stock string: `I added member %1$s.` or `Member %1$s removed by %2$s.`.
 ///
 /// The `removed_member_addr` parameter should be an email address and is looked up in
@@ -715,11 +653,6 @@ pub(crate) async fn msg_del_member_local(
    }
 }

-/// Stock string: `I left the group.`.
-pub(crate) async fn msg_group_left_remote(context: &Context) -> String {
-    translated(context, StockMessage::MsgILeftGroup).await
-}
-
 /// Stock string: `You left the group.` or `Group left by %1$s.`.
 pub(crate) async fn msg_group_left_local(context: &Context, by_contact: ContactId) -> String {
    if by_contact == ContactId::SELF {
@@ -1101,11 +1034,6 @@ pub(crate) async fn self_deleted_msg_body(context: &Context) -> String {
    translated(context, StockMessage::SelfDeletedMsgBody).await
 }

-/// Stock string: `⚠️ The "Delete messages from server" feature now also...`.
-pub(crate) async fn delete_server_turned_off(context: &Context) -> String {
-    translated(context, StockMessage::DeleteServerTurnedOff).await
-}
-
 /// Stock string: `Message deletion timer is set to %1$s minutes.`.
 pub(crate) async fn msg_ephemeral_timer_minutes(
    context: &Context,
@@ -1293,17 +1221,6 @@ pub(crate) async fn stats_msg_body(context: &Context) -> String {
    translated(context, StockMessage::StatsMsgBody).await
 }

-pub(crate) async fn aeap_explanation_and_link(
-    context: &Context,
-    old_addr: &str,
-    new_addr: &str,
-) -> String {
-    translated(context, StockMessage::AeapExplanationAndLink)
-        .await
-        .replace1(old_addr)
-        .replace2(new_addr)
-}
-
 /// Stock string: `Others will only see this group after you sent a first message.`.
 pub(crate) async fn new_group_send_first_message(context: &Context) -> String {
    translated(context, StockMessage::NewGroupSendFirstMessage).await
@@ -75,10 +75,6 @@ async fn test_stock_system_msg_add_member_by_me() {
    let alice_contact_id = Contact::create(&t, "Alice", "alice@example.org")
        .await
        .expect("failed to create contact");
-    assert_eq!(
-        msg_add_member_remote(&t, "alice@example.org").await,
-        "I added member alice@example.org."
-    );
    assert_eq!(
        msg_add_member_local(&t, alice_contact_id, ContactId::SELF).await,
        "You added member Alice."
@@ -91,10 +87,6 @@ async fn test_stock_system_msg_add_member_by_me_with_displayname() {
    let alice_contact_id = Contact::create(&t, "Alice", "alice@example.org")
        .await
        .expect("failed to create contact");
-    assert_eq!(
-        msg_add_member_remote(&t, "alice@example.org").await,
-        "I added member alice@example.org."
-    );
    assert_eq!(
        msg_add_member_local(&t, alice_contact_id, ContactId::SELF).await,
        "You added member Alice."
@@ -8,12 +8,12 @@ use humansize::{BINARY, format_size};
 #[derive(Debug)]
 pub struct StorageUsage {
    /// Total database size, subtract this from the backup size to estimate size of all blobs
-    pub db_size: usize,
+    pub db_size: u64,
    /// size and row count of the 10 biggest tables
-    pub largest_tables: Vec<(String, usize, Option<usize>)>,
+    pub largest_tables: Vec<(String, u64, Option<u64>)>,
    /// count and total size of status updates
    /// for the 10 webxdc apps with the most size usage in status updates
-    pub largest_webxdc_data: Vec<(MsgId, usize, usize)>,
+    pub largest_webxdc_data: Vec<(MsgId, u64, u64)>,
 }

 impl std::fmt::Display for StorageUsage {
@@ -46,12 +46,12 @@ impl std::fmt::Display for StorageUsage {

 /// Get storage usage information for the Context's database
 pub async fn get_storage_usage(ctx: &Context) -> Result<StorageUsage> {
-    let page_size: usize = ctx
+    let page_size: u64 = ctx
        .sql
        .query_get_value("PRAGMA page_size", ())
        .await?
        .unwrap_or_default();
-    let page_count: usize = ctx
+    let page_count: u64 = ctx
        .sql
        .query_get_value("PRAGMA page_count", ())
        .await?
@@ -68,7 +68,7 @@ pub async fn get_storage_usage(ctx: &Context) -> Result<StorageUsage> {
            (),
            |row| {
                let name: String = row.get(0)?;
-                let size: usize = row.get(1)?;
+                let size: u64 = row.get(1)?;
                Ok((name, size, None))
            },
        )
@@ -76,7 +76,7 @@ pub async fn get_storage_usage(ctx: &Context) -> Result<StorageUsage> {

    for row in &mut largest_tables {
        let name = &row.0;
-        let row_count: Result<Option<usize>> = ctx
+        let row_count: Result<Option<u64>> = ctx
            .sql
            // SECURITY: the table name comes from the db, not from the user
            .query_get_value(&format!("SELECT COUNT(*) FROM {name}"), ())
@@ -93,8 +93,8 @@ pub async fn get_storage_usage(ctx: &Context) -> Result<StorageUsage> {
            (),
            |row| {
                let msg_id: MsgId = row.get(0)?;
-                let size: usize = row.get(1)?;
-                let count: usize = row.get(2)?;
+                let size: u64 = row.get(1)?;
+                let count: u64 = row.get(2)?;

                Ok((msg_id, size, count))
            },
@@ -9,14 +9,15 @@ use crate::config::Config;
 use crate::constants::Blocked;
 use crate::contact::ContactId;
 use crate::context::Context;
-use crate::log::LogExt;
-use crate::log::warn;
+use crate::log::{LogExt as _, warn};
+use crate::login_param::EnteredLoginParam;
 use crate::message::{Message, MsgId, Viewtype};
 use crate::mimeparser::SystemMessage;
 use crate::param::Param;
 use crate::sync::SyncData::{AddQrToken, AlterChat, DeleteQrToken};
 use crate::token::Namespace;
 use crate::tools::time;
+use crate::transport::{ConfiguredLoginParamJson, sync_transports};
 use crate::{message, stock_str, token};
 use std::collections::HashSet;

@@ -52,6 +53,29 @@ pub(crate) struct QrTokenData {
    pub(crate) grpid: Option<String>,
 }

+#[derive(Debug, Serialize, Deserialize)]
+pub(crate) struct TransportData {
+    /// Configured login parameters.
+    pub(crate) configured: ConfiguredLoginParamJson,
+
+    /// Login parameters entered by the user.
+    ///
+    /// They can be used to reconfigure the transport.
+    pub(crate) entered: EnteredLoginParam,
+
+    /// Timestamp of when the transport was last time (re)configured.
+    pub(crate) timestamp: i64,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub(crate) struct RemovedTransportData {
+    /// Address of the removed transport.
+    pub(crate) addr: String,
+
+    /// Timestamp of when the transport was removed.
+    pub(crate) timestamp: i64,
+}
+
 #[derive(Debug, Serialize, Deserialize)]
 pub(crate) enum SyncData {
    AddQrToken(QrTokenData),
@@ -71,6 +95,28 @@ pub(crate) enum SyncData {
    DeleteMessages {
        msgs: Vec<String>, // RFC724 id (i.e. "Message-Id" header)
    },
+
+    /// Update transport configuration.
+    ///
+    /// This message contains a list of all added transports
+    /// together with their addition timestamp,
+    /// and all removed transports together with
+    /// the removal timestamp.
+    ///
+    /// In case of a tie, addition and removal timestamps
+    /// being the same, removal wins.
+    /// It is more likely that transport is added
+    /// and then removed within a second,
+    /// but unlikely the other way round
+    /// as adding new transport takes time
+    /// to run configuration.
+    Transports {
+        /// Active transports.
+        transports: Vec<TransportData>,
+
+        /// Removed transports with the timestamp of removal.
+        removed_transports: Vec<RemovedTransportData>,
+    },
 }

 #[derive(Debug, Serialize, Deserialize)]
@@ -274,6 +320,10 @@ impl Context {
                    SyncData::Config { key, val } => self.sync_config(key, val).await,
                    SyncData::SaveMessage { src, dest } => self.save_message(src, dest).await,
                    SyncData::DeleteMessages { msgs } => self.sync_message_deletion(msgs).await,
+                    SyncData::Transports {
+                        transports,
+                        removed_transports,
+                    } => sync_transports(self, transports, removed_transports).await,
                },
                SyncDataOrUnknown::Unknown(data) => {
                    warn!(self, "Ignored unknown sync item: {data}.");
@@ -33,6 +33,7 @@ use crate::context::Context;
 use crate::events::{Event, EventEmitter, EventType, Events};
 use crate::key::{self, DcKey, DcSecretKey, self_fingerprint};
 use crate::log::warn;
+use crate::login_param::EnteredLoginParam;
 use crate::message::{Message, MessageState, MsgId, update_msg_state};
 use crate::mimeparser::{MimeMessage, SystemMessage};
 use crate::pgp::KeyPair;
@@ -200,6 +201,18 @@ impl TestContextManager {
            "{} changes her self address and reconfigures",
            test_context.name()
        ));
+
+        // Insert a transport for the new address.
+        test_context.sql
+          .execute(
+            "INSERT OR IGNORE INTO transports (addr, entered_param, configured_param) VALUES (?, ?, ?)",
+               (
+                   new_addr,
+                   serde_json::to_string(&EnteredLoginParam::default()).unwrap(),
+                   format!(r#"{{"addr":"{new_addr}","imap":[],"imap_user":"","imap_password":"","smtp":[],"smtp_user":"","smtp_password":"","certificate_checks":"Automatic","oauth2":false}}"#)
+              ),
+          ).await.unwrap();
+
        test_context.set_primary_self_addr(new_addr).await.unwrap();
        // ensure_secret_key_exists() is called during configure
        crate::e2ee::ensure_secret_key_exists(test_context)
@@ -587,7 +600,7 @@ impl TestContext {
        self.ctx
            .set_config(Config::ConfiguredAddr, Some(addr))
            .await
-            .unwrap();
+            .expect("Failed to configure address");

        if let Some(name) = addr.split('@').next() {
            self.set_name(name);
@@ -922,9 +935,9 @@ impl TestContext {
    /// so may create a key-contact with a fingerprint
    /// but without the key.
    pub async fn get_chat(&self, other: &TestContext) -> Chat {
-        let contact = self.add_or_lookup_contact_id(other).await;
+        let contact = self.add_or_lookup_contact_no_key(other).await;

-        let chat_id = ChatIdBlocked::lookup_by_contact(&self.ctx, contact)
+        let chat_id = ChatIdBlocked::lookup_by_contact(&self.ctx, contact.id)
            .await
            .unwrap()
            .map(|chat_id_blocked| chat_id_blocked.id)
@@ -779,6 +779,15 @@ pub(crate) fn to_lowercase(s: &str) -> Cow<'_, str> {
    }
 }

+/// Returns text for storing in special db columns to make case-insensitive search possible for
+/// non-ASCII messages, chat and contact names.
+pub(crate) fn normalize_text(text: &str) -> Option<String> {
+    if text.is_ascii() {
+        return None;
+    };
+    Some(text.to_lowercase()).filter(|t| t != text)
+}
+
 /// Increments `*t` and checks that it equals to `expected` after that.
 pub(crate) fn inc_and_check<T: PrimInt + AddAssign + std::fmt::Debug>(
    t: &mut T,
@@ -789,6 +798,26 @@ pub(crate) fn inc_and_check<T: PrimInt + AddAssign + std::fmt::Debug>(
    Ok(())
 }

+/// Converts usize to u64 without using `as`.
+///
+/// This is needed for example to convert in-memory buffer sizes
+/// to u64 type used for counting all the bytes written.
+///
+/// On 32-bit systems it is possible to have files
+/// larger than 4 GiB or write more than 4 GiB to network connection,
+/// in which case we need a 64-bit total counter,
+/// but use 32-bit usize for buffer sizes.
+///
+/// This can only break if usize has more than 64 bits
+/// and this is not the case as of 2025 and is
+/// unlikely to change for general purpose computers.
+/// See <https://github.com/rust-lang/rust/issues/30495>
+/// and <https://users.rust-lang.org/t/cant-convert-usize-to-u64/6243>
+/// and <https://github.com/rust-lang/rust/issues/106050>.
+pub(crate) fn usize_to_u64(v: usize) -> u64 {
+    u64::try_from(v).unwrap_or(u64::MAX)
+}
+
 /// Returns early with an error if a condition is not satisfied.
 /// In non-optimized builds, panics instead if so.
 #[macro_export]
@@ -18,10 +18,12 @@ use crate::config::Config;
 use crate::configure::server_params::{ServerParams, expand_param_vector};
 use crate::constants::{DC_LP_AUTH_FLAGS, DC_LP_AUTH_OAUTH2};
 use crate::context::Context;
+use crate::events::EventType;
 use crate::login_param::EnteredLoginParam;
 use crate::net::load_connection_timestamp;
 use crate::provider::{Protocol, Provider, Socket, UsernamePattern, get_provider_by_id};
 use crate::sql::Sql;
+use crate::sync::{RemovedTransportData, SyncData, TransportData};

 #[derive(Copy, Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub(crate) enum ConnectionSecurity {
@@ -190,10 +192,10 @@ pub(crate) struct ConfiguredLoginParam {
    pub oauth2: bool,
 }

-/// The representation of ConfiguredLoginParam in the database,
-/// saved as Json.
+/// JSON representation of ConfiguredLoginParam
+/// for the database and sync messages.
 #[derive(Debug, Serialize, Deserialize)]
-struct ConfiguredLoginParamJson {
+pub(crate) struct ConfiguredLoginParamJson {
    pub addr: String,
    pub imap: Vec<ConfiguredServerLoginParam>,
    pub imap_user: String,
@@ -323,7 +325,10 @@ impl ConfiguredLoginParam {
            .unwrap_or_default();
        let oauth2 = matches!(server_flags & DC_LP_AUTH_FLAGS, DC_LP_AUTH_OAUTH2);

-        let provider = context.get_configured_provider().await?;
+        let provider = context
+            .get_config(Config::ConfiguredProvider)
+            .await?
+            .and_then(|cfg| get_provider_by_id(&cfg));

        let imap;
        let smtp;
@@ -554,35 +559,9 @@ impl ConfiguredLoginParam {
        self,
        context: &Context,
        entered_param: &EnteredLoginParam,
+        timestamp: i64,
    ) -> Result<()> {
-        let addr = addr_normalize(&self.addr);
-        let provider_id = self.provider.map(|provider| provider.id);
-        let configured_addr = context.get_config(Config::ConfiguredAddr).await?;
-        context
-            .sql
-            .execute(
-                "INSERT INTO transports (addr, entered_param, configured_param)
-                VALUES (?, ?, ?)
-                ON CONFLICT (addr)
-                DO UPDATE SET entered_param=excluded.entered_param, configured_param=excluded.configured_param",
-                (
-                    self.addr.clone(),
-                    serde_json::to_string(entered_param)?,
-                    self.into_json()?,
-                ),
-            )
-            .await?;
-        if configured_addr.is_none() {
-            // If there is no transport yet, set the new transport as the primary one
-            context
-                .sql
-                .set_raw_config(Config::ConfiguredProvider.as_ref(), provider_id)
-                .await?;
-            context
-                .sql
-                .set_raw_config(Config::ConfiguredAddr.as_ref(), Some(&addr))
-                .await?;
-        }
+        save_transport(context, entered_param, &self.into(), timestamp).await?;
        Ok(())
    }

@@ -606,18 +585,7 @@ impl ConfiguredLoginParam {
    }

    pub(crate) fn into_json(self) -> Result<String> {
-        let json = ConfiguredLoginParamJson {
-            addr: self.addr,
-            imap: self.imap,
-            imap_user: self.imap_user,
-            imap_password: self.imap_password,
-            smtp: self.smtp,
-            smtp_user: self.smtp_user,
-            smtp_password: self.smtp_password,
-            provider_id: self.provider.map(|p| p.id.to_string()),
-            certificate_checks: self.certificate_checks,
-            oauth2: self.oauth2,
-        };
+        let json: ConfiguredLoginParamJson = self.into();
        Ok(serde_json::to_string(&json)?)
    }

@@ -635,12 +603,181 @@ impl ConfiguredLoginParam {
    }
 }

+impl From<ConfiguredLoginParam> for ConfiguredLoginParamJson {
+    fn from(configured_login_param: ConfiguredLoginParam) -> Self {
+        Self {
+            addr: configured_login_param.addr,
+            imap: configured_login_param.imap,
+            imap_user: configured_login_param.imap_user,
+            imap_password: configured_login_param.imap_password,
+            smtp: configured_login_param.smtp,
+            smtp_user: configured_login_param.smtp_user,
+            smtp_password: configured_login_param.smtp_password,
+            provider_id: configured_login_param.provider.map(|p| p.id.to_string()),
+            certificate_checks: configured_login_param.certificate_checks,
+            oauth2: configured_login_param.oauth2,
+        }
+    }
+}
+
+/// Saves transport to the database.
+pub(crate) async fn save_transport(
+    context: &Context,
+    entered_param: &EnteredLoginParam,
+    configured: &ConfiguredLoginParamJson,
+    add_timestamp: i64,
+) -> Result<()> {
+    let addr = addr_normalize(&configured.addr);
+    let configured_addr = context.get_config(Config::ConfiguredAddr).await?;
+
+    context
+        .sql
+        .execute(
+            "INSERT INTO transports (addr, entered_param, configured_param, add_timestamp)
+             VALUES (?, ?, ?, ?)
+             ON CONFLICT (addr)
+             DO UPDATE SET entered_param=excluded.entered_param,
+                           configured_param=excluded.configured_param,
+                           add_timestamp=excluded.add_timestamp",
+            (
+                &addr,
+                serde_json::to_string(entered_param)?,
+                serde_json::to_string(configured)?,
+                add_timestamp,
+            ),
+        )
+        .await?;
+
+    if configured_addr.is_none() {
+        // If there is no transport yet, set the new transport as the primary one
+        context
+            .sql
+            .set_raw_config(Config::ConfiguredAddr.as_ref(), Some(&addr))
+            .await?;
+    }
+    Ok(())
+}
+
+/// Sends a sync message to synchronize transports across devices.
+pub(crate) async fn send_sync_transports(context: &Context) -> Result<()> {
+    info!(context, "Sending transport synchronization message.");
+
+    // Synchronize all transport configurations.
+    //
+    // Transport with ID 1 is never synchronized
+    // because it can only be created during initial configuration.
+    // This also guarantees that credentials for the first
+    // transport are never sent in sync messages,
+    // so this is not worse than when not using multi-transport.
+    // If transport ID 1 is reconfigured,
+    // likely because the password has changed,
+    // user has to reconfigure it manually on all devices.
+    let transports = context
+        .sql
+        .query_map_vec(
+            "SELECT entered_param, configured_param, add_timestamp
+             FROM transports WHERE id>1",
+            (),
+            |row| {
+                let entered_json: String = row.get(0)?;
+                let entered: EnteredLoginParam = serde_json::from_str(&entered_json)?;
+                let configured_json: String = row.get(1)?;
+                let configured: ConfiguredLoginParamJson = serde_json::from_str(&configured_json)?;
+                let timestamp: i64 = row.get(2)?;
+                Ok(TransportData {
+                    configured,
+                    entered,
+                    timestamp,
+                })
+            },
+        )
+        .await?;
+    let removed_transports = context
+        .sql
+        .query_map_vec(
+            "SELECT addr, remove_timestamp FROM removed_transports",
+            (),
+            |row| {
+                let addr: String = row.get(0)?;
+                let timestamp: i64 = row.get(1)?;
+                Ok(RemovedTransportData { addr, timestamp })
+            },
+        )
+        .await?;
+    context
+        .add_sync_item(SyncData::Transports {
+            transports,
+            removed_transports,
+        })
+        .await?;
+    context.scheduler.interrupt_inbox().await;
+
+    Ok(())
+}
+
+/// Process received data for transport synchronization.
+pub(crate) async fn sync_transports(
+    context: &Context,
+    transports: &[TransportData],
+    removed_transports: &[RemovedTransportData],
+) -> Result<()> {
+    for TransportData {
+        configured,
+        entered,
+        timestamp,
+    } in transports
+    {
+        save_transport(context, entered, configured, *timestamp).await?;
+    }
+
+    context
+        .sql
+        .transaction(|transaction| {
+            for RemovedTransportData { addr, timestamp } in removed_transports {
+                transaction.execute(
+                    "DELETE FROM transports
+                     WHERE addr=? AND add_timestamp<=?",
+                    (addr, timestamp),
+                )?;
+                transaction.execute(
+                    "INSERT INTO removed_transports (addr, remove_timestamp)
+                     VALUES (?, ?)
+                     ON CONFLICT (addr) DO
+                     UPDATE SET remove_timestamp = excluded.remove_timestamp
+                     WHERE excluded.remove_timestamp > remove_timestamp",
+                    (addr, timestamp),
+                )?;
+            }
+            Ok(())
+        })
+        .await?;
+
+    context.emit_event(EventType::TransportsModified);
+    Ok(())
+}
+
+/// Adds transport entry to the `transports` table with empty configuration.
+pub(crate) async fn add_pseudo_transport(context: &Context, addr: &str) -> Result<()> {
+    context.sql
+        .execute(
+            "INSERT INTO transports (addr, entered_param, configured_param) VALUES (?, ?, ?)",
+            (
+                addr,
+                serde_json::to_string(&EnteredLoginParam::default())?,
+                format!(r#"{{"addr":"{addr}","imap":[],"imap_user":"","imap_password":"","smtp":[],"smtp_user":"","smtp_password":"","certificate_checks":"Automatic","oauth2":false}}"#)
+            ),
+        )
+        .await?;
+    Ok(())
+}
+
 #[cfg(test)]
 mod tests {
    use super::*;
    use crate::log::LogExt as _;
    use crate::provider::get_provider_by_id;
    use crate::test_utils::TestContext;
+    use crate::tools::time;

    #[test]
    fn test_configured_certificate_checks_display() {
@@ -685,7 +822,7 @@ mod tests {

        param
            .clone()
-            .save_to_transports_table(&t, &EnteredLoginParam::default())
+            .save_to_transports_table(&t, &EnteredLoginParam::default(), time())
            .await?;
        let expected_param = r#"{"addr":"alice@example.org","imap":[{"connection":{"host":"imap.example.com","port":123,"security":"Starttls"},"user":"alice"}],"imap_user":"","imap_password":"foo","smtp":[{"connection":{"host":"smtp.example.com","port":456,"security":"Tls"},"user":"alice@example.org"}],"smtp_user":"","smtp_password":"bar","provider_id":null,"certificate_checks":"Strict","oauth2":false}"#;
        assert_eq!(
@@ -903,7 +1040,7 @@ mod tests {
            certificate_checks: ConfiguredCertificateChecks::Automatic,
            oauth2: false,
        }
-        .save_to_transports_table(&t, &EnteredLoginParam::default())
+        .save_to_transports_table(&t, &EnteredLoginParam::default(), time())
        .await?;

        let (_transport_id, loaded) = ConfiguredLoginParam::load(&t).await?.unwrap();
@@ -1289,7 +1289,7 @@ async fn test_get_webxdc_info() -> Result<()> {
    let info = instance.get_webxdc_info(&t).await?;
    assert_eq!(info.name, "minimal.xdc");
    assert_eq!(info.icon, WEBXDC_DEFAULT_ICON.to_string());
-    assert_eq!(info.send_update_interval, 10000);
+    assert_eq!(info.send_update_interval, 1000);
    assert_eq!(info.send_update_max_size, RECOMMENDED_FILE_SIZE as usize);

    let mut instance = create_webxdc_instance(
@@ -0,0 +1,13 @@
+-----BEGIN PGP MESSAGE-----
+
+wU4DAAAAAAAAAAASAQdA4GtzIk21tMpcktf+k47Gn8iSt8JMJgu/hEf7wJLUGgsg
+/dQ8eBSe4/PoEoNQ2mHnHWSdPH4zvS142R86iiyGe3jBwEwDAAAAAAAAAAABB/9l
+dteYjCvGpJxjgm8dGcb3lY9jVj76HLu72KWLZy2p/Ch/mxGW2GtgWNipFA2plCLQ
+Dzutak20lbYXkBL+zEnioHc5aAixruQQa2yZSRqePxPmkC/eTiedNeVJCOcrJBbj
+k8kQ+CPXLxx6mWS28s0tQkbpH9oJ2Esy0J6FNl0DMTWG50FWuo+Mh/gQ7Su3S1Il
+MYa7n58LhMjNGwD0ckp+Ig1XPNnnyauA+0kU/yDy7aA9NH4CtdqeobitEnn2aK4c
+sge0008GzZ/p1UWAyIVCqXuB1cNQY0UMVLohV3v343Xf9vS6ZQ8Bi8L+DiS+WpSt
+2fYGJ7Iqq6joatv6wPgS0j8BTbOcCygy/V1NvwzZpXnOawiGYJaCFU33vr2p1SrK
+YB5YCwFI4499aXUGhokyAW0xy6+N7o2Ps1qS4L3cqu0=
+=Ytf8
+-----END PGP MESSAGE-----
@@ -1 +1 @@
 -11-23
 -12-05