# 23-Jun-2026 — alert on revoked Gmail tokens, stop destructive rescan, self-heal watch on reconnect

## [build 718](https://github.com/nbarrett/ngx-ramblers/actions/runs/28029913911) — [commit a08e7f5](https://github.com/nbarrett/ngx-ramblers/commit/a08e7f57ad7c088780d677b6a97967167d97e550)

_____

The staging Gmail inbox stopped importing after its OAuth refresh token hit
Google's 7-day Testing-mode expiry and was rejected with invalid_grant. Three
problems made the outage worse than it needed to be:

- A revoked token only updated a database field; nobody was told, so inbound
mail silently stopped for a week. The daily health check and the poller now
send a web-push alert to every inbox subscriber the first time a connection
flips to token-revoked, deep-linking to the mail settings page to reconnect.
Only the transition into token-revoked alerts, so it does not repeat every
poll.

- rescan-general deleted every general thread and message before polling, so an
auth failure wiped the threads and imported nothing (the "Removed 3 threads,
no new messages" symptom). It now probes the token first and aborts without
deleting when the connection is unhealthy, returning the error to the caller.

- The OAuth callback stored the new token but left the watch and backlog to the
daily cron, up to 24h away. Reconnecting now resets the history cursor, polls
the backlog immediately, and re-registers the Gmail watch.

The root-cause fix - publishing the OAuth consent screen to production so tokens
stop expiring after 7 days - is a Google Cloud console action, not code.