23-Jun-2026 — alert on revoked Gmail tokens, stop destructive rescan, self-heal watch on reconnect

build 718 — commit a08e7f5

The staging Gmail inbox stopped importing after its OAuth refresh token hit Google's 7-day Testing-mode expiry and was rejected with invalid_grant. Three problems made the outage worse than it needed to be:

• A revoked token only updated a database field; nobody was told, so inbound mail silently stopped for a week. The daily health check and the poller now send a web-push alert to every inbox subscriber the first time a connection flips to token-revoked, deep-linking to the mail settings page to reconnect. Only the transition into token-revoked alerts, so it does not repeat every poll.

• rescan-general deleted every general thread and message before polling, so an auth failure wiped the threads and imported nothing (the "Removed 3 threads, no new messages" symptom). It now probes the token first and aborts without deleting when the connection is unhealthy, returning the error to the caller.

• The OAuth callback stored the new token but left the watch and backlog to the daily cron, up to 24h away. Reconnecting now resets the history cursor, polls the backlog immediately, and re-registers the Gmail watch.

The root-cause fix - publishing the OAuth consent screen to production so tokens stop expiring after 7 days - is a Google Cloud console action, not code.