Module control 

Local control channel: POST /control/{drain,reload,handoff}.

Lets a successor (a newer mail4agent, or a host such as a hatchery node) take this daemon over gracefully instead of killing it. Authentication is owner-only: a random token in a file only the owning user can read (control.token next to the database, or MAIL4AGENT_CONTROL_TOKEN_FILE). The file is created with mode 0600 on Unix; on Windows it lives in the per-user data directory, whose ACL admits only that user (and SYSTEM / administrators). The path is published in /health (not the token).

• drain: stop accepting new mail (/mail/send and the MCP tools answer 503); reads, acks and health keep working. {"draining": false} undoes it.
• reload: re-read the config file and report what changed; nothing is hot-swapped (the bind and db path need a handoff).
• handoff: drain, answer 202, then stop serving after release_after_ms so the successor can bind the same address. The process exits by itself.

Structs

Control

DrainBody

HandoffBody

Constants

CAPABILITIES

TOKEN_FILE_ENV

Functions

default_token_file

Default token file: control.token beside the database.

drain_gate

Refuse new mail while draining.

handle