diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..0f38372
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,53 @@
+name: build mailpress.exe
+
+on:
+  push:
+    branches: [main]
+    tags: ["v*"]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  build:
+    name: build on windows
+    runs-on: windows-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: setup node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          # No cache: requires a committed lockfile, which we don't ship.
+
+      - name: install build deps
+        # Pin versions inline since there's no package-lock.json in the repo.
+        run: npm install --no-save esbuild@^0.25.0 postject@^1.0.0-alpha.6 resedit@^3.0.0
+
+      - name: build mailpress.exe
+        run: node scripts/build.mjs
+
+      - name: upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: mailpress-windows-x64
+          path: |
+            dist/mailpress.exe
+            dist/print-files.ps1
+            dist/install-task.ps1
+            dist/config.example.json
+
+      - name: release (on tag)
+        if: startsWith(github.ref, 'refs/tags/v')
+        uses: softprops/action-gh-release@v2
+        with:
+          files: |
+            dist/mailpress.exe
+            dist/print-files.ps1
+            dist/install-task.ps1
+            dist/config.example.json
+          draft: false
+          generate_release_notes: true
diff --git a/.gitignore b/.gitignore
index 58904ec..63985be 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,4 +3,6 @@ config.local.json
 .local-token.json
 spool/
 mailpress.log
+mailpress-setup.log
 *.log
+dist/
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..bd857d5
--- /dev/null
+++ b/README.md
@@ -0,0 +1,120 @@
+# mailpress
+
+Polls a Gmail inbox and prints every new email's body + attachments on a
+wired Windows printer. Runs as a Scheduled Task on the office PC.
+
+## Install (the easy way)
+
+1. Download `mailpress.exe`, `print-files.ps1`, `install-task.ps1`, and
+   `config.example.json` from the latest [GitHub Release][releases]. Put
+   them all in the same folder, e.g. `C:\mailpress\`.
+2. Double-click `mailpress.exe`. The setup wizard runs the first time
+   there's no config: it lists installed printers, walks you through the
+   Google OAuth client creation, runs the consent flow in your browser,
+   does a test print, and installs itself as a Scheduled Task.
+3. Done. Send a test email to the office inbox and confirm it prints.
+
+[releases]: https://github.com/turetsky/mailpress/releases
+
+The only step Google does NOT let an installer automate is creating the
+OAuth client itself — the wizard prints the exact links and steps.
+
+## Install from source (no .exe)
+
+```
+git clone https://github.com/turetsky/mailpress.git
+cd mailpress
+node cli.mjs            # launches the wizard if no config
+```
+
+## Commands
+
+```
+mailpress              # poll forever (or run wizard if not configured)
+mailpress --setup      # re-run the interactive setup wizard
+mailpress --test       # interactive: switch printer, test print any file
+mailpress --once       # process current unread and exit
+mailpress --doctor     # run health checks and report what's broken
+mailpress --consent    # just re-do the OAuth consent (token died)
+mailpress --uninstall  # remove the Scheduled Task
+mailpress --help
+```
+
+`--test` opens an interactive menu where you can:
+- print the mailpress test page
+- print any file you specify (drop in a path to a .docx / .xlsx / .pdf to
+  verify Word/Excel/PDF conversion works through the Print verb)
+- switch the active printer (saves to config.local.json)
+- send the test page to every installed printer at once
+
+Useful when the printer changes, a driver flakes, or you just want to
+confirm the spool still works without sending real email.
+
+Exit codes:
+- `0` — success (or `--once` completed)
+- `1` — generic failure (see `mailpress.log`)
+- `2` — fatal auth failure; re-run `mailpress --consent` or `--setup`
+
+Set `MAILPRESS_DEBUG=1` for verbose logs. Set `MAILPRESS_HOME=<dir>` to
+override where config + token + logs live (defaults to the exe's folder).
+
+## Troubleshooting
+
+The wizard writes a detailed log to `mailpress-setup.log` next to the
+exe. The polling loop writes `mailpress.log`. Both are gitignored. If
+something breaks, run `mailpress --doctor` first — it identifies which
+subsystem failed (config, token, Gmail API, printer presence, scheduled
+task) and what to do about each.
+
+Common cases:
+
+- **"refresh token failed / invalid_grant"** — token expired or was
+  revoked. Run `mailpress --consent`.
+- **"printer not found"** — the printer name changed in Windows. Run
+  `mailpress --setup` and pick it again.
+- **"This app isn't verified"** in the browser — expected for an
+  un-published OAuth client. Click Advanced → Go to <app> (unsafe).
+  Add your Gmail as a Test user on the OAuth consent screen.
+- **Refresh token missing on consent** — Google only returns it on
+  first consent per client. Revoke at
+  <https://myaccount.google.com/permissions> and re-run setup.
+
+## Build
+
+```
+node scripts/build.mjs
+```
+
+Produces `dist/mailpress.exe` (or `dist/mailpress` on non-Windows) using
+Node's [Single Executable Applications][sea]. Needs Node >= 20.12.
+CI builds on every push and publishes the exe to GitHub Releases on
+version tags (`v*`).
+
+[sea]: https://nodejs.org/api/single-executable-applications.html
+
+## Architecture
+
+```
+cli.mjs                 # entry point — arg parsing, routing, top-level catch
+lib/
+  config.mjs            # load/save/validate config.local.json
+  log.mjs               # leveled console + file logger
+  prompt.mjs            # readline wrapper (ask/confirm/choose)
+  gmail.mjs             # OAuth refresh + Gmail API client + MIME helpers
+  printer.mjs           # Windows printer enumeration + printing + test print
+  oauth.mjs             # interactive OAuth consent flow
+  task.mjs              # Windows Scheduled Task install/uninstall
+  poll.mjs              # main polling loop
+  doctor.mjs            # diagnostic mode
+  wizard.mjs            # first-run interactive setup
+  test.mjs              # post-install test menu (--test)
+index.mjs               # back-compat shim → poll.mjs
+consent.mjs             # back-compat shim → oauth.mjs
+print-files.ps1         # PowerShell helper: print one or more files
+install-task.ps1        # legacy: install Scheduled Task from source
+assets/
+  icon.svg              # source icon (envelope on slant + speed lines)
+  icon.ico              # multi-size .ico embedded into mailpress.exe
+scripts/build.mjs       # Node SEA build pipeline (icon embed via resedit)
+.github/workflows/release.yml  # CI builds + tag releases
+```
diff --git a/assets/icon-preview-256.png b/assets/icon-preview-256.png
new file mode 100644
index 0000000..2c0a5cc
Binary files /dev/null and b/assets/icon-preview-256.png differ
diff --git a/assets/icon.ico b/assets/icon.ico
new file mode 100644
index 0000000..c7ee761
Binary files /dev/null and b/assets/icon.ico differ
diff --git a/assets/icon.svg b/assets/icon.svg
new file mode 100644
index 0000000..7fdd2d6
--- /dev/null
+++ b/assets/icon.svg
@@ -0,0 +1,22 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 256">
+  <!-- Background: rounded square -->
+  <rect x="0" y="0" width="256" height="256" rx="44" fill="#1d4ed8"/>
+
+  <!-- Motion lines behind the envelope (the "moving fast" hint) -->
+  <g stroke="#ffffff" stroke-linecap="round" opacity="0.95">
+    <line x1="20"  y1="92"  x2="92"  y2="92"  stroke-width="14"/>
+    <line x1="36"  y1="132" x2="108" y2="132" stroke-width="14"/>
+    <line x1="20"  y1="172" x2="92"  y2="172" stroke-width="14"/>
+  </g>
+
+  <!-- Envelope, tilted forward as if flying right -->
+  <g transform="rotate(-10 168 128)">
+    <!-- envelope body -->
+    <rect x="80" y="64" width="148" height="116" rx="6"
+          fill="#ffffff" stroke="#0b2a6b" stroke-width="6"/>
+    <!-- flap (V) -->
+    <path d="M 80 64 L 154 134 L 228 64"
+          fill="none" stroke="#0b2a6b" stroke-width="6"
+          stroke-linejoin="round" stroke-linecap="round"/>
+  </g>
+</svg>
diff --git a/cli.mjs b/cli.mjs
new file mode 100644
index 0000000..a8f2155
--- /dev/null
+++ b/cli.mjs
@@ -0,0 +1,161 @@
+#!/usr/bin/env node
+// mailpress entry point. Handles arg parsing and routes to the wizard,
+// poll loop, or doctor. Single top-level try/catch so unexpected errors
+// land in the log instead of crashing silently.
+
+import { createLogger } from "./lib/log.mjs";
+import { loadConfig, validateConfig, resolveInRoot, configPath } from "./lib/config.mjs";
+
+const USAGE = `\
+mailpress — Gmail-to-printer relay
+
+Usage:
+  mailpress              run setup wizard if not configured, otherwise poll
+  mailpress --setup      (re)run the interactive setup wizard
+  mailpress --test       interactive: test print, switch printer, etc.
+  mailpress --once       process current unread messages and exit
+  mailpress --doctor     run diagnostic checks and exit
+  mailpress --consent    just re-do the OAuth consent flow
+  mailpress --uninstall  remove the Windows scheduled task
+  mailpress --help       this message
+  mailpress --version    print version and exit
+
+Environment:
+  MAILPRESS_HOME         override the install root (where config + logs live)
+`;
+
+function parseArgs(argv) {
+  const flags = new Set(argv.slice(2));
+  if (flags.has("--help") || flags.has("-h")) return { cmd: "help" };
+  if (flags.has("--version") || flags.has("-v")) return { cmd: "version" };
+  if (flags.has("--setup")) return { cmd: "setup" };
+  if (flags.has("--doctor")) return { cmd: "doctor" };
+  if (flags.has("--consent")) return { cmd: "consent" };
+  if (flags.has("--uninstall")) return { cmd: "uninstall" };
+  if (flags.has("--test")) return { cmd: "test" };
+  if (flags.has("--once")) return { cmd: "once" };
+  return { cmd: "auto" };
+}
+
+async function main() {
+  const args = parseArgs(process.argv);
+
+  if (args.cmd === "help") {
+    process.stdout.write(USAGE);
+    return 0;
+  }
+  if (args.cmd === "version") {
+    process.stdout.write("mailpress 0.2.0\n");
+    return 0;
+  }
+
+  // Load config first so we know which log file to write to. Wizard mode
+  // gets its own setup log. Poll mode gets the main log.
+  let cfg = null;
+  try { cfg = loadConfig(); } catch (e) {
+    // Config corrupt — wizard can repair, others should fail loudly.
+    if (args.cmd !== "setup" && args.cmd !== "doctor" && args.cmd !== "auto") {
+      process.stderr.write(`config error: ${e.message}\n`);
+      return 2;
+    }
+  }
+
+  const isWizard = args.cmd === "setup" || args.cmd === "consent" || (args.cmd === "auto" && !cfg);
+  const logPath = isWizard
+    ? resolveInRoot(cfg?.setupLogPath || "./mailpress-setup.log")
+    : resolveInRoot(cfg?.logPath || "./mailpress.log");
+  const log = createLogger({ filePath: logPath, minLevel: process.env.MAILPRESS_DEBUG ? "DEBUG" : "INFO", pretty: true });
+
+  log.debug(`mailpress cli: cmd=${args.cmd} platform=${process.platform} node=${process.versions.node}`);
+  log.debug(`config path: ${configPath()}`);
+  log.debug(`log path: ${logPath}`);
+
+  try {
+    switch (args.cmd) {
+      case "setup": {
+        const { runWizard } = await import("./lib/wizard.mjs");
+        await runWizard({ log });
+        return 0;
+      }
+      case "consent": {
+        const cfgNow = loadConfig();
+        const errs = validateConfig(cfgNow);
+        if (errs.length) {
+          log.error("config invalid:", errs.join("; "));
+          log.say("Run `mailpress --setup` first.");
+          return 2;
+        }
+        const { runConsent } = await import("./lib/oauth.mjs");
+        const { GmailClient } = await import("./lib/gmail.mjs");
+        log.heading("OAuth consent");
+        const tok = await runConsent({
+          clientId: cfgNow.googleClientId,
+          clientSecret: cfgNow.googleClientSecret,
+          gmailAddress: cfgNow.gmailAddress,
+          log,
+        });
+        new GmailClient(cfgNow, { log }).saveToken(tok);
+        log.success("token saved");
+        return 0;
+      }
+      case "doctor": {
+        const { runDoctor } = await import("./lib/doctor.mjs");
+        const { failed } = await runDoctor({ log });
+        return failed === 0 ? 0 : 1;
+      }
+      case "uninstall": {
+        const { uninstallTask } = await import("./lib/task.mjs");
+        const out = await uninstallTask();
+        log.success(`scheduled task: ${out}`);
+        return 0;
+      }
+      case "test": {
+        const { runTest } = await import("./lib/test.mjs");
+        return await runTest({ log });
+      }
+      case "once":
+      case "auto": {
+        const { GmailClient } = await import("./lib/gmail.mjs");
+        const needsWizard =
+          !cfg ||
+          validateConfig(cfg).length > 0 ||
+          !new GmailClient(cfg, { log }).hasToken();
+        if (needsWizard) {
+          const { runWizard } = await import("./lib/wizard.mjs");
+          await runWizard({ log });
+          try { cfg = loadConfig(); }
+          catch (e) {
+            log.error("post-wizard config still unreadable:", e.message);
+            return 2;
+          }
+          if (!cfg || validateConfig(cfg).length > 0) {
+            log.error("setup did not complete; aborting");
+            return 2;
+          }
+        }
+        const { runPoll } = await import("./lib/poll.mjs");
+        await runPoll(cfg, { log, runOnce: args.cmd === "once" });
+        return 0;
+      }
+      default:
+        process.stdout.write(USAGE);
+        return 1;
+    }
+  } catch (e) {
+    log.fatal(e);
+    process.stderr.write(`\nFatal: ${e.message}\nSee log: ${logPath}\n`);
+    // Exit 2 means "re-run --setup or --consent"; preserved from the original
+    // index.mjs so Scheduled Task / monitoring scripts can distinguish.
+    const { GmailAuthError } = await import("./lib/gmail.mjs");
+    if (e instanceof GmailAuthError && e.fatal) return 2;
+    return 1;
+  }
+}
+
+main().then(
+  (code) => process.exit(code ?? 0),
+  (e) => {
+    process.stderr.write(`Unhandled: ${e.stack || e.message}\n`);
+    process.exit(1);
+  },
+);
diff --git a/consent.mjs b/consent.mjs
index 82a581b..53e5aac 100644
--- a/consent.mjs
+++ b/consent.mjs
@@ -1,120 +1,39 @@
 #!/usr/bin/env node
-// One-shot OAuth consent flow to mint a refresh token for the office Gmail.
-//
-// Usage:
-//   1. cp config.example.json config.local.json
-//   2. Fill in googleClientId + googleClientSecret + gmailAddress.
-//      (Reuse the existing client from /home/yaakov/code/gauth/.local-credentials.json
-//       — same client works for any Gmail account, you just sign in as the office one.)
-//   3. node consent.mjs
-//   4. Browser opens → sign in as the OFFICE Gmail account → grant gmail.modify.
-//   5. Refresh token is written to ./.local-token.json (gitignored).
-//
-// Only needs to be done once. If the token ever dies (password change, manual
-// revocation, 6-month dormancy) re-run this script.
-
-import { createServer } from "node:http";
-import { readFileSync, writeFileSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-import { dirname, resolve } from "node:path";
-import { exec } from "node:child_process";
-
-const HERE = dirname(fileURLToPath(import.meta.url));
-const CONFIG_PATH = resolve(HERE, "config.local.json");
-
-let config;
-try {
-  config = JSON.parse(readFileSync(CONFIG_PATH, "utf8"));
-} catch (e) {
-  console.error(`Cannot read ${CONFIG_PATH}: ${e.message}`);
-  console.error("Copy config.example.json -> config.local.json and fill it in first.");
-  process.exit(1);
+// Thin shim that runs the OAuth consent flow against config.local.json.
+// Equivalent to `node cli.mjs --consent`. Kept so existing docs/muscle
+// memory still work.
+
+import { createLogger } from "./lib/log.mjs";
+import { loadConfig, validateConfig, resolveInRoot } from "./lib/config.mjs";
+import { runConsent } from "./lib/oauth.mjs";
+import { GmailClient } from "./lib/gmail.mjs";
+
+async function main() {
+  const cfg = loadConfig();
+  const errors = cfg ? validateConfig(cfg) : ["config.local.json is missing"];
+  if (errors.length) {
+    console.error("Config errors:");
+    for (const e of errors) console.error("  -", e);
+    console.error("\nRun `node cli.mjs --setup` to launch the setup wizard.");
+    process.exit(2);
+  }
+  const log = createLogger({
+    filePath: resolveInRoot(cfg.setupLogPath || "./mailpress-setup.log"),
+    minLevel: "INFO",
+    pretty: true,
+  });
+  log.heading("OAuth consent");
+  const tok = await runConsent({
+    clientId: cfg.googleClientId,
+    clientSecret: cfg.googleClientSecret,
+    gmailAddress: cfg.gmailAddress,
+    log,
+  });
+  new GmailClient(cfg, { log }).saveToken(tok);
+  log.success("token saved");
 }
 
-if (!config.googleClientId || config.googleClientId.startsWith("FILL_IN")) {
-  console.error("googleClientId is not set in config.local.json");
+main().catch((e) => {
+  console.error("FATAL", e.stack || e.message);
   process.exit(1);
-}
-
-const TOKEN_PATH = resolve(HERE, config.tokenPath || "./.local-token.json");
-
-// gmail.modify covers: read messages + remove UNREAD label. That's all we need.
-const SCOPES = ["https://www.googleapis.com/auth/gmail.modify"].join(" ");
-
-const PORT = 8765;
-const REDIRECT_URI = `http://localhost:${PORT}`;
-
-const authUrl = new URL("https://accounts.google.com/o/oauth2/v2/auth");
-authUrl.searchParams.set("client_id", config.googleClientId);
-authUrl.searchParams.set("redirect_uri", REDIRECT_URI);
-authUrl.searchParams.set("response_type", "code");
-authUrl.searchParams.set("scope", SCOPES);
-authUrl.searchParams.set("access_type", "offline");
-authUrl.searchParams.set("prompt", "consent");
-if (config.gmailAddress && !config.gmailAddress.startsWith("FILL_IN")) {
-  authUrl.searchParams.set("login_hint", config.gmailAddress);
-}
-
-console.log("\n=== STEP 1: open this URL in your browser ===\n");
-console.log(authUrl.toString());
-console.log(`\n=== STEP 2: sign in as ${config.gmailAddress || "the OFFICE Gmail account"} ===`);
-console.log("  - If 'This app isn't verified' → Advanced → Go to <appname> (unsafe).");
-console.log("  - Grant Gmail modify permission.");
-console.log(`\nWaiting for redirect on http://localhost:${PORT} ...\n`);
-
-// Best-effort: try to auto-open the browser. Works on macOS/Linux/Windows.
-const opener = process.platform === "darwin" ? "open"
-  : process.platform === "win32" ? "start \"\""
-  : "xdg-open";
-exec(`${opener} "${authUrl.toString()}"`, () => { /* ignore failures */ });
-
-const server = createServer(async (req, res) => {
-  const u = new URL(req.url, REDIRECT_URI);
-  if (!u.searchParams.has("code") && !u.searchParams.has("error")) {
-    res.writeHead(404).end("not the redirect");
-    return;
-  }
-  if (u.searchParams.has("error")) {
-    const err = u.searchParams.get("error");
-    res.writeHead(200, { "content-type": "text/plain" })
-      .end(`oauth error: ${err}\nyou can close this tab.`);
-    console.error("oauth error:", err);
-    server.close();
-    process.exit(1);
-  }
-  const code = u.searchParams.get("code");
-  res.writeHead(200, { "content-type": "text/plain" })
-    .end("success — you can close this tab and return to the terminal.");
-
-  const tokenRes = await fetch("https://oauth2.googleapis.com/token", {
-    method: "POST",
-    headers: { "content-type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      code,
-      client_id: config.googleClientId,
-      client_secret: config.googleClientSecret,
-      redirect_uri: REDIRECT_URI,
-      grant_type: "authorization_code",
-    }),
-  });
-  if (!tokenRes.ok) {
-    console.error("token exchange failed:", tokenRes.status, await tokenRes.text());
-    server.close();
-    process.exit(1);
-  }
-  const tok = await tokenRes.json();
-  if (!tok.refresh_token) {
-    console.error("No refresh_token in response — Google only returns one on first consent.");
-    console.error("Revoke the app at https://myaccount.google.com/permissions then re-run.");
-    server.close();
-    process.exit(1);
-  }
-  writeFileSync(TOKEN_PATH, JSON.stringify(tok, null, 2));
-  console.log("\n=== SUCCESS ===");
-  console.log("Refresh token saved to:", TOKEN_PATH);
-  console.log("Scopes granted:", tok.scope);
-  console.log("\nNext: run `npm start` (or `node index.mjs`) on the office PC.");
-  server.close();
 });
-
-server.listen(PORT);
diff --git a/index.mjs b/index.mjs
index a1226e0..74f4579 100644
--- a/index.mjs
+++ b/index.mjs
@@ -1,321 +1,49 @@
 #!/usr/bin/env node
-// mailpress — poll a Gmail inbox, print each new message body + attachments
-// on a Windows-attached printer, mark printed messages as read.
-//
-// Usage:
-//   node index.mjs           # run forever, poll on config.pollIntervalMs
-//   node index.mjs --once    # process current unread, exit (useful for testing)
-//
-// Prereqs:
-//   - config.local.json filled in (see config.example.json)
-//   - .local-token.json present (run `node consent.mjs` once)
-//   - Office PC with the printer wired up + MS Office (or LibreOffice) installed
-//   - This script run on Windows (PowerShell is invoked for the print step)
+// Thin shim that delegates to lib/poll. Keeps `node index.mjs` and the
+// existing Scheduled Task working. Exit codes match the original:
+//   0 = clean exit (--once only)
+//   1 = generic failure
+//   2 = auth failure (re-run setup/consent)
 
-import { readFileSync, writeFileSync, mkdirSync, rmSync, existsSync, appendFileSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-import { dirname, resolve, join } from "node:path";
-import { spawn } from "node:child_process";
-
-const HERE = dirname(fileURLToPath(import.meta.url));
-const CONFIG_PATH = resolve(HERE, "config.local.json");
-
-const config = JSON.parse(readFileSync(CONFIG_PATH, "utf8"));
-const TOKEN_PATH = resolve(HERE, config.tokenPath || "./.local-token.json");
-const SPOOL_DIR  = resolve(HERE, config.spoolDir  || "./spool");
-const LOG_PATH   = resolve(HERE, config.logPath   || "./mailpress.log");
-const POLL_MS    = config.pollIntervalMs ?? 300_000;
-const MAX_BYTES  = config.maxAttachmentBytes ?? 25 * 1024 * 1024;
-const PRINT_PS1  = resolve(HERE, "print-files.ps1");
-
-if (!existsSync(SPOOL_DIR)) mkdirSync(SPOOL_DIR, { recursive: true });
+import { createLogger } from "./lib/log.mjs";
+import { loadConfig, validateConfig, resolveInRoot } from "./lib/config.mjs";
+import { runPoll } from "./lib/poll.mjs";
+import { GmailAuthError } from "./lib/gmail.mjs";
 
 const runOnce = process.argv.includes("--once");
 
-function log(level, ...parts) {
-  const line = `${new Date().toISOString()} ${level} ${parts.join(" ")}`;
-  console.log(line);
-  try { appendFileSync(LOG_PATH, line + "\n"); } catch { /* best-effort */ }
-}
-
-// ---------- OAuth: refresh access token ----------
-
-let cachedAccessToken = null;
-let cachedAccessExpiry = 0;
-
-async function getAccessToken() {
-  if (cachedAccessToken && Date.now() < cachedAccessExpiry - 30_000) {
-    return cachedAccessToken;
-  }
-  const tok = JSON.parse(readFileSync(TOKEN_PATH, "utf8"));
-  if (!tok.refresh_token) throw new Error("No refresh_token in token file. Re-run consent.mjs.");
-  const res = await fetch("https://oauth2.googleapis.com/token", {
-    method: "POST",
-    headers: { "content-type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      client_id: config.googleClientId,
-      client_secret: config.googleClientSecret,
-      refresh_token: tok.refresh_token,
-      grant_type: "refresh_token",
-    }),
-  });
-  if (!res.ok) {
-    const text = await res.text();
-    throw new Error(`refresh token failed ${res.status}: ${text}`);
-  }
-  const j = await res.json();
-  cachedAccessToken = j.access_token;
-  cachedAccessExpiry = Date.now() + (j.expires_in * 1000);
-  return cachedAccessToken;
-}
-
-// ---------- Gmail helpers ----------
-
-async function gmail(path, init = {}) {
-  const token = await getAccessToken();
-  const url = `https://gmail.googleapis.com/gmail/v1/users/me${path}`;
-  const res = await fetch(url, {
-    ...init,
-    headers: {
-      ...(init.headers || {}),
-      Authorization: `Bearer ${token}`,
-      "Content-Type": "application/json",
-    },
-  });
-  if (!res.ok) throw new Error(`gmail ${path}: ${res.status} ${await res.text()}`);
-  return res.json();
-}
-
-function headerVal(headers, name) {
-  const h = headers?.find((x) => x.name.toLowerCase() === name.toLowerCase());
-  return h ? h.value : "";
-}
-
-// Decode Gmail's url-safe base64 to a Buffer.
-function b64urlToBuffer(s) {
-  if (!s) return Buffer.alloc(0);
-  const std = s.replace(/-/g, "+").replace(/_/g, "/");
-  const pad = std.length % 4 ? "=".repeat(4 - (std.length % 4)) : "";
-  return Buffer.from(std + pad, "base64");
-}
-
-// Walk the MIME tree, returning { bodyText, bodyHtml, attachments[] }.
-// attachments: [{ filename, mimeType, attachmentId, size }]
-function walkMime(payload) {
-  let bodyText = "";
-  let bodyHtml = "";
-  const attachments = [];
-
-  function walk(part) {
-    if (!part) return;
-    const filename = part.filename || "";
-    const mimeType = part.mimeType || "";
-    const body = part.body || {};
-    const disposition = (headerVal(part.headers, "content-disposition") || "").toLowerCase();
-    const isAttachment = !!filename && (body.attachmentId || disposition.startsWith("attachment"));
-
-    if (isAttachment) {
-      attachments.push({
-        filename,
-        mimeType,
-        attachmentId: body.attachmentId,
-        size: body.size || 0,
-      });
-    } else if (mimeType === "text/plain" && body.data && !bodyText) {
-      bodyText = b64urlToBuffer(body.data).toString("utf8");
-    } else if (mimeType === "text/html" && body.data && !bodyHtml) {
-      bodyHtml = b64urlToBuffer(body.data).toString("utf8");
-    }
-
-    if (Array.isArray(part.parts)) {
-      for (const sub of part.parts) walk(sub);
-    }
-  }
-  walk(payload);
-  return { bodyText, bodyHtml, attachments };
-}
-
-// Very rough HTML -> text fallback when an email is HTML-only.
-function htmlToText(html) {
-  return html
-    .replace(/<style[\s\S]*?<\/style>/gi, "")
-    .replace(/<script[\s\S]*?<\/script>/gi, "")
-    .replace(/<br\s*\/?>/gi, "\n")
-    .replace(/<\/p>/gi, "\n\n")
-    .replace(/<[^>]+>/g, "")
-    .replace(/&nbsp;/gi, " ")
-    .replace(/&amp;/gi, "&")
-    .replace(/&lt;/gi, "<")
-    .replace(/&gt;/gi, ">")
-    .replace(/&quot;/gi, '"')
-    .replace(/&#39;/gi, "'")
-    .replace(/\n{3,}/g, "\n\n")
-    .trim();
-}
-
-// Sanitize a filename for the filesystem.
-function safeName(name, fallback = "attachment") {
-  const cleaned = (name || "").replace(/[\\/:*?"<>|\r\n]+/g, "_").trim();
-  return cleaned || fallback;
-}
-
-// ---------- Print step (PowerShell shell-out) ----------
-
-function printFiles(files) {
-  return new Promise((resolveP, rejectP) => {
-    const args = [
-      "-NoProfile",
-      "-ExecutionPolicy", "Bypass",
-      "-File", PRINT_PS1,
-      "-PrinterName", config.printerName,
-      "-Files", files.join(","),
-      "-SleepMs", String(config.perPrintSleepMs ?? 3000),
-    ];
-    const ps = spawn("powershell.exe", args, { stdio: ["ignore", "pipe", "pipe"] });
-    let stdout = "", stderr = "";
-    ps.stdout.on("data", (d) => { stdout += d.toString(); });
-    ps.stderr.on("data", (d) => { stderr += d.toString(); });
-    ps.on("close", (code) => {
-      if (stdout) log("INFO", "powershell:", stdout.trim().replace(/\n/g, " | "));
-      if (stderr) log("WARN", "powershell stderr:", stderr.trim().replace(/\n/g, " | "));
-      if (code === 0) resolveP();
-      else rejectP(new Error(`print-files.ps1 exited ${code}`));
-    });
-    ps.on("error", rejectP);
-  });
-}
-
-// ---------- Notify on failure ----------
-
-async function sendNotify(subject, body) {
-  if (!config.notifyEmail || !config.notifyFromAddress) return;
+async function main() {
+  let cfg;
   try {
-    const raw = [
-      `From: ${config.notifyFromAddress}`,
-      `To: ${config.notifyEmail}`,
-      `Subject: [mailpress] ${subject}`,
-      `MIME-Version: 1.0`,
-      `Content-Type: text/plain; charset=UTF-8`,
-      ``,
-      body,
-    ].join("\r\n");
-    const b64 = Buffer.from(raw, "utf8").toString("base64")
-      .replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-    await gmail("/messages/send", {
-      method: "POST",
-      body: JSON.stringify({ raw: b64 }),
-    });
-    log("INFO", "notify sent:", subject);
+    cfg = loadConfig();
   } catch (e) {
-    log("WARN", "notify send failed:", e.message);
-  }
-}
-
-// ---------- Per-message processing ----------
-
-async function processMessage(id) {
-  const msg = await gmail(`/messages/${id}?format=full`);
-  const headers = msg.payload?.headers || [];
-  const subject = headerVal(headers, "Subject") || "(no subject)";
-  const from    = headerVal(headers, "From") || "(unknown)";
-  const date    = headerVal(headers, "Date") || "";
-  log("INFO", `msg ${id} | from=${from} | subj=${subject}`);
-
-  const { bodyText, bodyHtml, attachments } = walkMime(msg.payload);
-
-  const msgDir = join(SPOOL_DIR, id);
-  mkdirSync(msgDir, { recursive: true });
-  const filesToPrint = [];
-
-  // ---- Body: write as .txt and print via Notepad /p ----
-  const bodyHeader =
-    `From: ${from}\r\n` +
-    `Date: ${date}\r\n` +
-    `Subject: ${subject}\r\n` +
-    `${"-".repeat(70)}\r\n\r\n`;
-  const bodyContent = (bodyText && bodyText.trim())
-    ? bodyText
-    : (bodyHtml ? htmlToText(bodyHtml) : "(no body)");
-  const bodyPath = join(msgDir, "body.txt");
-  writeFileSync(bodyPath, bodyHeader + bodyContent, "utf8");
-  filesToPrint.push(bodyPath);
-
-  // ---- Attachments ----
-  for (let i = 0; i < attachments.length; i++) {
-    const a = attachments[i];
-    if (!a.attachmentId) {
-      log("WARN", `msg ${id}: attachment ${a.filename} has no attachmentId, skip`);
-      continue;
-    }
-    if (a.size > MAX_BYTES) {
-      log("WARN", `msg ${id}: attachment ${a.filename} too big (${a.size}b), skip`);
-      continue;
-    }
-    const data = await gmail(`/messages/${id}/attachments/${a.attachmentId}`);
-    const buf = b64urlToBuffer(data.data);
-    const filename = `${String(i + 1).padStart(2, "0")}_${safeName(a.filename)}`;
-    const filePath = join(msgDir, filename);
-    writeFileSync(filePath, buf);
-    filesToPrint.push(filePath);
-    log("INFO", `msg ${id}: staged ${filename} (${buf.length}b, ${a.mimeType})`);
-  }
-
-  // ---- Send to printer ----
-  await printFiles(filesToPrint);
-
-  // ---- Mark as read (remove UNREAD label) ----
-  await gmail(`/messages/${id}/modify`, {
-    method: "POST",
-    body: JSON.stringify({ removeLabelIds: ["UNREAD"] }),
+    console.error("Config error:", e.message);
+    console.error("Run `node cli.mjs --setup` to repair.");
+    process.exit(2);
+  }
+  const errors = cfg ? validateConfig(cfg) : ["config.local.json is missing"];
+  if (errors.length) {
+    console.error("Config errors:");
+    for (const e of errors) console.error("  -", e);
+    console.error("\nRun `node cli.mjs --setup` to launch the setup wizard.");
+    process.exit(2);
+  }
+  const log = createLogger({
+    filePath: resolveInRoot(cfg.logPath || "./mailpress.log"),
+    minLevel: process.env.MAILPRESS_DEBUG ? "DEBUG" : "INFO",
+    pretty: true,
   });
-
-  // ---- Cleanup spool ----
-  try { rmSync(msgDir, { recursive: true, force: true }); }
-  catch (e) { log("WARN", `cleanup ${msgDir}: ${e.message}`); }
-
-  log("INFO", `msg ${id}: printed ${filesToPrint.length} file(s), marked read`);
-}
-
-// ---------- Main poll loop ----------
-
-async function tick() {
-  const q = encodeURIComponent(config.gmailQuery || "in:inbox category:primary is:unread");
-  const list = await gmail(`/messages?q=${q}&maxResults=25`);
-  const ids = (list.messages || []).map((m) => m.id);
-  if (ids.length === 0) {
-    log("DEBUG", "no new messages");
-    return;
-  }
-  log("INFO", `found ${ids.length} new message(s)`);
-  for (const id of ids) {
-    try {
-      await processMessage(id);
-    } catch (e) {
-      log("ERROR", `msg ${id} failed: ${e.message}`);
-      await sendNotify(`error processing message ${id}`, `${e.message}\n\n${e.stack || ""}`);
-    }
-  }
-}
-
-async function main() {
-  log("INFO", `mailpress starting; query="${config.gmailQuery}"; poll=${POLL_MS}ms; printer="${config.printerName}"`);
-  while (true) {
-    try {
-      await tick();
-    } catch (e) {
-      log("ERROR", `tick failed: ${e.message}`);
-      // Auth failures get a notification so user knows to re-run consent.
-      if (/refresh token failed|invalid_grant/i.test(e.message)) {
-        await sendNotify("auth failure — re-run consent.mjs", e.message);
-        process.exit(2);
-      }
-    }
-    if (runOnce) break;
-    await new Promise((r) => setTimeout(r, POLL_MS));
+  try {
+    await runPoll(cfg, { log, runOnce });
+  } catch (e) {
+    log.fatal(e);
+    if (e instanceof GmailAuthError && e.fatal) process.exit(2);
+    process.exit(1);
   }
 }
 
 main().catch((e) => {
-  log("FATAL", e.stack || e.message);
+  // Pre-logger failures only.
+  console.error("FATAL", e.stack || e.message);
   process.exit(1);
 });
diff --git a/lib/config.mjs b/lib/config.mjs
new file mode 100644
index 0000000..6c78325
--- /dev/null
+++ b/lib/config.mjs
@@ -0,0 +1,112 @@
+// Config load/save/validate. Resolves paths against the install root, which
+// is the directory containing the exe (or the project root when running
+// from source). All other modules go through this so file locations stay
+// consistent between dev runs and the bundled exe.
+
+import { readFileSync, writeFileSync, existsSync, renameSync, chmodSync } from "node:fs";
+import { dirname, resolve, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+export const DEFAULTS = {
+  gmailQuery: "in:inbox category:primary is:unread",
+  pollIntervalMs: 300_000,
+  tokenPath: "./.local-token.json",
+  spoolDir: "./spool",
+  logPath: "./mailpress.log",
+  setupLogPath: "./mailpress-setup.log",
+  maxAttachmentBytes: 26_214_400,
+  perPrintSleepMs: 3000,
+};
+
+const REQUIRED_FIELDS = [
+  "googleClientId",
+  "googleClientSecret",
+  "gmailAddress",
+  "printerName",
+];
+
+// Install root: where config.local.json, the spool, logs, and PowerShell
+// helpers live. When packaged as a SEA exe, process.execPath points at the
+// exe and there is no script arg. When running from source via
+// `node /path/to/cli.mjs`, argv[1] is the script.
+//
+// We distinguish "running from source" by checking that the basename of the
+// executable IS a node binary (node, node.exe), not by trusting argv[1] to
+// end in .mjs — a SEA binary invoked with `mailpress.exe foo.mjs` would
+// otherwise resolve install root to wherever foo.mjs lives.
+export function installRoot() {
+  if (process.env.MAILPRESS_HOME) return resolve(process.env.MAILPRESS_HOME);
+  const execBase = (process.execPath.split(/[\\\/]/).pop() || "").toLowerCase();
+  const isNode = execBase === "node" || execBase === "node.exe";
+  const argv1 = process.argv[1];
+  if (isNode && argv1 && (argv1.endsWith(".mjs") || argv1.endsWith(".js") || argv1.endsWith(".cjs"))) {
+    return dirname(resolve(argv1));
+  }
+  return dirname(process.execPath);
+}
+
+export function configPath() {
+  return join(installRoot(), "config.local.json");
+}
+
+export function examplePath() {
+  // The example ships beside the source files. When running from a SEA exe,
+  // it may not be on disk — callers should handle ENOENT.
+  return join(installRoot(), "config.example.json");
+}
+
+export function resolveInRoot(p) {
+  return resolve(installRoot(), p);
+}
+
+export function loadConfig() {
+  const path = configPath();
+  if (!existsSync(path)) return null;
+  const raw = readFileSync(path, "utf8");
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (e) {
+    throw new Error(`config.local.json is not valid JSON: ${e.message}`);
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(`config.local.json must be a JSON object, got ${Array.isArray(parsed) ? "array" : typeof parsed}`);
+  }
+  return { ...DEFAULTS, ...parsed };
+}
+
+export function saveConfig(cfg) {
+  const path = configPath();
+  const tmp = path + ".tmp";
+  // Strip our private comment field if it's still there from the example.
+  const { _comment, ...clean } = cfg;
+  writeFileSync(tmp, JSON.stringify(clean, null, 2), "utf8");
+  // 0600 — config has the OAuth client secret in it.
+  try { chmodSync(tmp, 0o600); } catch { /* Windows: ignore */ }
+  renameSync(tmp, path);
+}
+
+export function validateConfig(cfg) {
+  const errors = [];
+  if (!cfg || typeof cfg !== "object") {
+    return ["config is missing or unreadable"];
+  }
+  for (const field of REQUIRED_FIELDS) {
+    const v = cfg[field];
+    if (!v || typeof v !== "string" || v.startsWith("FILL_IN")) {
+      errors.push(`${field} is not set`);
+    }
+  }
+  if (cfg.pollIntervalMs != null && (!Number.isFinite(cfg.pollIntervalMs) || cfg.pollIntervalMs < 10_000)) {
+    errors.push("pollIntervalMs must be a number >= 10000");
+  }
+  if (cfg.gmailAddress && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(cfg.gmailAddress)) {
+    errors.push(`gmailAddress doesn't look like an email: ${cfg.gmailAddress}`);
+  }
+  return errors;
+}
+
+export function isConfigured() {
+  const cfg = loadConfig();
+  return cfg && validateConfig(cfg).length === 0;
+}
diff --git a/lib/doctor.mjs b/lib/doctor.mjs
new file mode 100644
index 0000000..41585b1
--- /dev/null
+++ b/lib/doctor.mjs
@@ -0,0 +1,125 @@
+// Diagnostic mode. Runs every subsystem check independently and prints a
+// pass/fail report. Designed so you can run `mailpress.exe --doctor` and
+// see exactly what's broken without re-running the whole wizard.
+
+import { existsSync } from "node:fs";
+import { loadConfig, validateConfig, configPath, resolveInRoot } from "./config.mjs";
+import { GmailClient } from "./gmail.mjs";
+import { isWindows, listPrinters, printerExists } from "./printer.mjs";
+import { taskExists, TASK_NAME } from "./task.mjs";
+
+// A check returns { name, pass, message, fix? }. `fix` is a hint for the
+// user about what to do — printed dimly under the failure line.
+async function check(name, fn) {
+  try {
+    const result = await fn();
+    if (result === true || result === undefined) return { name, pass: true };
+    if (typeof result === "object") return { name, pass: !!result.pass, ...result };
+    return { name, pass: false, message: String(result) };
+  } catch (e) {
+    return { name, pass: false, message: e.message };
+  }
+}
+
+export async function runDoctor({ log } = {}) {
+  const results = [];
+
+  results.push(await check("platform is Windows", () => {
+    if (isWindows()) return true;
+    return { pass: false, message: `running on ${process.platform}`, fix: "Run this on the Windows office PC. mailpress relies on PowerShell + Windows printers." };
+  }));
+
+  results.push(await check("node version >= 18", () => {
+    const major = parseInt(process.versions.node.split(".")[0], 10);
+    if (major >= 18) return true;
+    return { pass: false, message: `node ${process.versions.node}`, fix: "Install Node.js 18 or newer from https://nodejs.org" };
+  }));
+
+  results.push(await check("config.local.json exists", () => {
+    if (existsSync(configPath())) return true;
+    return { pass: false, message: `not found: ${configPath()}`, fix: "Run mailpress with no arguments to launch the setup wizard." };
+  }));
+
+  const config = (() => { try { return loadConfig(); } catch { return null; } })();
+
+  results.push(await check("config.local.json is valid", () => {
+    if (!config) return { pass: false, message: "could not read config" };
+    const errors = validateConfig(config);
+    if (errors.length === 0) return true;
+    return { pass: false, message: errors.join("; "), fix: "Re-run setup or edit config.local.json by hand." };
+  }));
+
+  if (config) {
+    const tokenPath = resolveInRoot(config.tokenPath || "./.local-token.json");
+    results.push(await check("OAuth refresh token exists", () => {
+      if (existsSync(tokenPath)) return true;
+      return { pass: false, message: `not found: ${tokenPath}`, fix: "Re-run setup to re-authorize Gmail access." };
+    }));
+
+    if (existsSync(tokenPath) && validateConfig(config).length === 0) {
+      const gmail = new GmailClient(config, { log });
+      results.push(await check("Gmail API reachable + token works", async () => {
+        const prof = await gmail.profile();
+        if (prof.emailAddress) {
+          return { pass: true, message: `as ${prof.emailAddress}` };
+        }
+        return { pass: false, message: "no emailAddress in profile response" };
+      }));
+
+      results.push(await check("authenticated as configured gmailAddress", async () => {
+        const prof = await gmail.profile();
+        if (prof.emailAddress?.toLowerCase() === config.gmailAddress?.toLowerCase()) return true;
+        return {
+          pass: false,
+          message: `token belongs to ${prof.emailAddress}, config says ${config.gmailAddress}`,
+          fix: "Re-run setup and sign in as the correct Gmail account.",
+        };
+      }));
+    }
+
+    if (isWindows()) {
+      results.push(await check(`printer "${config.printerName}" exists`, async () => {
+        const found = await printerExists(config.printerName);
+        if (found) return true;
+        const printers = await listPrinters().catch(() => []);
+        return {
+          pass: false,
+          message: `not found among ${printers.length} installed printer(s)`,
+          fix: `Available: ${printers.map((p) => p.Name).join(", ") || "(none)"}. Re-run setup or update printerName.`,
+        };
+      }));
+    }
+  }
+
+  if (isWindows()) {
+    results.push(await check(`scheduled task "${TASK_NAME}" installed`, async () => {
+      const exists = await taskExists();
+      if (exists) return true;
+      return {
+        pass: false,
+        message: "not installed",
+        fix: "Re-run setup and accept the 'install scheduled task' step (so mailpress runs at login).",
+      };
+    }));
+  }
+
+  // Report
+  log.heading("Diagnostic report");
+  let failed = 0;
+  for (const r of results) {
+    if (r.pass) {
+      log.success(`${r.name}${r.message ? " — " + r.message : ""}`);
+    } else {
+      failed++;
+      log.failure(`${r.name} — ${r.message || "failed"}`);
+      if (r.fix) log.say("    " + r.fix);
+    }
+  }
+  log.say("");
+  if (failed === 0) {
+    log.success(`All ${results.length} checks passed.`);
+  } else {
+    log.failure(`${failed} of ${results.length} checks failed.`);
+  }
+  return { results, failed };
+}
diff --git a/lib/gmail.mjs b/lib/gmail.mjs
new file mode 100644
index 0000000..c068e53
--- /dev/null
+++ b/lib/gmail.mjs
@@ -0,0 +1,226 @@
+// Gmail API client. Owns the access-token refresh cache and the small
+// surface of Gmail endpoints we use. MIME parsing helpers live here too so
+// the wizard, doctor, and poll loop all share one implementation.
+
+import { readFileSync, writeFileSync, existsSync } from "node:fs";
+import { resolveInRoot } from "./config.mjs";
+
+const TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
+const API_BASE = "https://gmail.googleapis.com/gmail/v1/users/me";
+
+export class GmailAuthError extends Error {
+  constructor(message, { status, body, fatal = false } = {}) {
+    super(message);
+    this.name = "GmailAuthError";
+    this.status = status;
+    this.body = body;
+    this.fatal = fatal; // true means "user has to re-consent"
+  }
+}
+
+export class GmailClient {
+  constructor(config, { log } = {}) {
+    this.config = config;
+    this.log = log;
+    this.tokenPath = resolveInRoot(config.tokenPath || "./.local-token.json");
+    this._cachedToken = null;
+    this._cachedExpiry = 0;
+  }
+
+  hasToken() {
+    if (!existsSync(this.tokenPath)) return false;
+    try {
+      const t = JSON.parse(readFileSync(this.tokenPath, "utf8"));
+      return !!t.refresh_token;
+    } catch {
+      return false;
+    }
+  }
+
+  saveToken(token) {
+    writeFileSync(this.tokenPath, JSON.stringify(token, null, 2), "utf8");
+  }
+
+  loadToken() {
+    return JSON.parse(readFileSync(this.tokenPath, "utf8"));
+  }
+
+  async getAccessToken() {
+    if (this._cachedToken && Date.now() < this._cachedExpiry - 30_000) {
+      return this._cachedToken;
+    }
+    if (!existsSync(this.tokenPath)) {
+      throw new GmailAuthError(`token file missing: ${this.tokenPath}`, { fatal: true });
+    }
+    let tok;
+    try {
+      tok = this.loadToken();
+    } catch (e) {
+      throw new GmailAuthError(`token file is corrupt: ${e.message}`, { fatal: true });
+    }
+    if (!tok || typeof tok !== "object" || !tok.refresh_token) {
+      throw new GmailAuthError("no refresh_token in token file", { fatal: true });
+    }
+    const res = await fetch(TOKEN_ENDPOINT, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        client_id: this.config.googleClientId,
+        client_secret: this.config.googleClientSecret,
+        refresh_token: tok.refresh_token,
+        grant_type: "refresh_token",
+      }),
+    });
+    if (!res.ok) {
+      const text = await res.text();
+      const fatal = res.status === 400 || res.status === 401 || /invalid_grant|invalid_client/i.test(text);
+      throw new GmailAuthError(`refresh token failed (${res.status}): ${text}`, {
+        status: res.status, body: text, fatal,
+      });
+    }
+    const j = await res.json();
+    if (typeof j.access_token !== "string" || !j.access_token) {
+      throw new GmailAuthError(`refresh response missing access_token: ${JSON.stringify(j)}`, { fatal: true });
+    }
+    // Default to 1h if Google ever omits expires_in. A small positive number
+    // is safer than NaN (which would cause refresh-on-every-call).
+    const expiresInSec = Number.isFinite(j.expires_in) && j.expires_in > 0 ? j.expires_in : 3600;
+    this._cachedToken = j.access_token;
+    this._cachedExpiry = Date.now() + expiresInSec * 1000;
+    return this._cachedToken;
+  }
+
+  async request(path, init = {}) {
+    const token = await this.getAccessToken();
+    const res = await fetch(API_BASE + path, {
+      ...init,
+      headers: {
+        ...(init.headers || {}),
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json",
+      },
+    });
+    if (!res.ok) {
+      const body = await res.text();
+      const err = new Error(`gmail ${path}: ${res.status} ${body}`);
+      err.status = res.status;
+      err.body = body;
+      throw err;
+    }
+    return res.json();
+  }
+
+  listMessages(query, maxResults = 25) {
+    const q = encodeURIComponent(query);
+    return this.request(`/messages?q=${q}&maxResults=${maxResults}`);
+  }
+
+  getMessage(id) {
+    return this.request(`/messages/${id}?format=full`);
+  }
+
+  getAttachment(messageId, attachmentId) {
+    return this.request(`/messages/${messageId}/attachments/${attachmentId}`);
+  }
+
+  markRead(id) {
+    return this.request(`/messages/${id}/modify`, {
+      method: "POST",
+      body: JSON.stringify({ removeLabelIds: ["UNREAD"] }),
+    });
+  }
+
+  // Send a plain-text email via Gmail. Used for failure notifications.
+  async sendPlain(from, to, subject, body) {
+    const raw = [
+      `From: ${from}`,
+      `To: ${to}`,
+      `Subject: ${subject}`,
+      `MIME-Version: 1.0`,
+      `Content-Type: text/plain; charset=UTF-8`,
+      ``,
+      body,
+    ].join("\r\n");
+    const b64 = Buffer.from(raw, "utf8").toString("base64")
+      .replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+    return this.request("/messages/send", {
+      method: "POST",
+      body: JSON.stringify({ raw: b64 }),
+    });
+  }
+
+  // Sanity: get the profile. Cheapest endpoint to verify auth works.
+  profile() {
+    return this.request("/profile");
+  }
+}
+
+// ---------- MIME helpers (pure functions, no API access) ----------
+
+export function headerVal(headers, name) {
+  const h = headers?.find((x) => x.name.toLowerCase() === name.toLowerCase());
+  return h ? h.value : "";
+}
+
+export function b64urlToBuffer(s) {
+  if (!s) return Buffer.alloc(0);
+  const std = s.replace(/-/g, "+").replace(/_/g, "/");
+  const pad = std.length % 4 ? "=".repeat(4 - (std.length % 4)) : "";
+  return Buffer.from(std + pad, "base64");
+}
+
+export function walkMime(payload) {
+  let bodyText = "";
+  let bodyHtml = "";
+  const attachments = [];
+
+  function walk(part) {
+    if (!part) return;
+    const filename = part.filename || "";
+    const mimeType = part.mimeType || "";
+    const body = part.body || {};
+    const disposition = (headerVal(part.headers, "content-disposition") || "").toLowerCase();
+    const isAttachment = !!filename && (body.attachmentId || disposition.startsWith("attachment"));
+
+    if (isAttachment) {
+      attachments.push({
+        filename,
+        mimeType,
+        attachmentId: body.attachmentId,
+        size: body.size || 0,
+      });
+    } else if (mimeType === "text/plain" && body.data && !bodyText) {
+      bodyText = b64urlToBuffer(body.data).toString("utf8");
+    } else if (mimeType === "text/html" && body.data && !bodyHtml) {
+      bodyHtml = b64urlToBuffer(body.data).toString("utf8");
+    }
+
+    if (Array.isArray(part.parts)) {
+      for (const sub of part.parts) walk(sub);
+    }
+  }
+  walk(payload);
+  return { bodyText, bodyHtml, attachments };
+}
+
+export function htmlToText(html) {
+  return html
+    .replace(/<style[\s\S]*?<\/style>/gi, "")
+    .replace(/<script[\s\S]*?<\/script>/gi, "")
+    .replace(/<br\s*\/?>/gi, "\n")
+    .replace(/<\/p>/gi, "\n\n")
+    .replace(/<[^>]+>/g, "")
+    .replace(/&nbsp;/gi, " ")
+    .replace(/&amp;/gi, "&")
+    .replace(/&lt;/gi, "<")
+    .replace(/&gt;/gi, ">")
+    .replace(/&quot;/gi, '"')
+    .replace(/&#39;/gi, "'")
+    .replace(/\n{3,}/g, "\n\n")
+    .trim();
+}
+
+export function safeName(name, fallback = "attachment") {
+  const cleaned = (name || "").replace(/[\\/:*?"<>|\r\n]+/g, "_").trim();
+  return cleaned || fallback;
+}
diff --git a/lib/log.mjs b/lib/log.mjs
new file mode 100644
index 0000000..e30a7cc
--- /dev/null
+++ b/lib/log.mjs
@@ -0,0 +1,93 @@
+// Leveled logger. Writes to console (pretty) and to a log file (structured).
+// The setup log is the single source of truth when the wizard misbehaves —
+// it captures every step, every command, every error.
+
+import { appendFileSync, mkdirSync } from "node:fs";
+import { dirname } from "node:path";
+
+const LEVELS = { DEBUG: 10, INFO: 20, WARN: 30, ERROR: 40, FATAL: 50 };
+
+const COLORS = {
+  DEBUG: "\x1b[90m",
+  INFO:  "\x1b[36m",
+  WARN:  "\x1b[33m",
+  ERROR: "\x1b[31m",
+  FATAL: "\x1b[91m",
+  RESET: "\x1b[0m",
+  BOLD:  "\x1b[1m",
+  DIM:   "\x1b[2m",
+};
+
+function ts() {
+  return new Date().toISOString();
+}
+
+function safeAppend(path, line) {
+  try {
+    mkdirSync(dirname(path), { recursive: true });
+    appendFileSync(path, line + "\n");
+  } catch {
+    // best-effort: never let logging crash the caller
+  }
+}
+
+export function createLogger({ filePath, minLevel = "INFO", pretty = true } = {}) {
+  const min = LEVELS[minLevel] ?? LEVELS.INFO;
+  const useColor = pretty && process.stdout.isTTY;
+
+  function emit(level, parts) {
+    const text = parts.map((p) => (p instanceof Error ? (p.stack || p.message) : String(p))).join(" ");
+    const fileLine = `${ts()} ${level.padEnd(5)} ${text}`;
+    if (filePath) safeAppend(filePath, fileLine);
+    if (LEVELS[level] < min) return;
+    if (useColor) {
+      const c = COLORS[level] || "";
+      console.log(`${c}${level.padEnd(5)}${COLORS.RESET} ${text}`);
+    } else {
+      console.log(fileLine);
+    }
+  }
+
+  return {
+    debug: (...a) => emit("DEBUG", a),
+    info:  (...a) => emit("INFO",  a),
+    warn:  (...a) => emit("WARN",  a),
+    error: (...a) => emit("ERROR", a),
+    fatal: (...a) => emit("FATAL", a),
+
+    // Pretty helpers for the wizard. These bypass the level filter and don't
+    // tag the line with a level — they're for user-facing prose.
+    say(text) {
+      if (filePath) safeAppend(filePath, `${ts()} UI    ${text}`);
+      console.log(text);
+    },
+    heading(text) {
+      // Only use Unicode box-drawing chars when the terminal is modern
+      // enough to render them. Windows cmd.exe in cp437/cp1252 mangles
+      // them into mojibake.
+      const lineChar = useColor ? "─" : "-";
+      const line = lineChar.repeat(Math.min(text.length + 2, 60));
+      const out = useColor
+        ? `\n${COLORS.BOLD}${text}${COLORS.RESET}\n${COLORS.DIM}${line}${COLORS.RESET}`
+        : `\n${text}\n${line}`;
+      if (filePath) safeAppend(filePath, `${ts()} UI    === ${text} ===`);
+      console.log(out);
+    },
+    success(text) {
+      const out = useColor ? `${COLORS.INFO}✓${COLORS.RESET} ${text}` : `OK  ${text}`;
+      if (filePath) safeAppend(filePath, `${ts()} UI    OK ${text}`);
+      console.log(out);
+    },
+    failure(text) {
+      const out = useColor ? `${COLORS.ERROR}✗${COLORS.RESET} ${text}` : `FAIL ${text}`;
+      if (filePath) safeAppend(filePath, `${ts()} UI    FAIL ${text}`);
+      console.log(out);
+    },
+    setFile(p) {
+      filePath = p;
+    },
+    file() {
+      return filePath;
+    },
+  };
+}
diff --git a/lib/oauth.mjs b/lib/oauth.mjs
new file mode 100644
index 0000000..c664a10
--- /dev/null
+++ b/lib/oauth.mjs
@@ -0,0 +1,186 @@
+// Interactive OAuth consent flow. Spins up a localhost listener, opens the
+// user's browser at Google's auth URL, exchanges the code for a refresh
+// token, returns the token object. Caller is responsible for persisting it.
+
+import { createServer } from "node:http";
+import { spawn } from "node:child_process";
+
+const SCOPES = [
+  "https://www.googleapis.com/auth/gmail.modify",
+  "https://www.googleapis.com/auth/gmail.send",
+].join(" ");
+
+const DEFAULT_PORT = 8765;
+const PORT_FALLBACKS = [8766, 8767, 8768, 8769, 0]; // 0 = ephemeral
+const TIMEOUT_MS = 10 * 60 * 1000;
+
+// Bind the OAuth callback server, trying preferred port first then
+// fallbacks. Returns the live server bound to a free port. Avoids the
+// probe-then-bind TOCTOU race: only one bind per port, and the returned
+// server IS the bound one.
+function bindServer(handler, preferred) {
+  const candidates = [preferred, ...PORT_FALLBACKS.filter((p) => p !== preferred)];
+  return new Promise((resolveOuter, rejectOuter) => {
+    let i = 0;
+    const tryNext = () => {
+      if (i >= candidates.length) {
+        rejectOuter(new Error("could not bind any local port for OAuth callback"));
+        return;
+      }
+      const port = candidates[i++];
+      const server = createServer(handler);
+      const onError = () => {
+        server.removeListener("listening", onListening);
+        try { server.close(); } catch { /* */ }
+        tryNext();
+      };
+      const onListening = () => {
+        server.removeListener("error", onError);
+        resolveOuter({ server, port: server.address().port });
+      };
+      server.once("error", onError);
+      server.once("listening", onListening);
+      server.listen(port);
+    };
+    tryNext();
+  });
+}
+
+// Open the user's default browser at `url`. Uses spawn with an argv array
+// to avoid any shell-metachar interpretation of the URL (&, %, etc.).
+function openBrowser(url) {
+  try {
+    if (process.platform === "darwin") {
+      spawn("open", [url], { detached: true, stdio: "ignore" }).unref();
+    } else if (process.platform === "win32") {
+      // cmd /c start "" "<url>" — the empty quoted string is the window title.
+      // Using cmd /c with an argv array avoids re-parsing the URL through shell.
+      spawn("cmd", ["/c", "start", "", url], { detached: true, stdio: "ignore" }).unref();
+    } else {
+      spawn("xdg-open", [url], { detached: true, stdio: "ignore" }).unref();
+    }
+  } catch { /* best-effort; user can paste the URL by hand */ }
+}
+
+// runConsent({ clientId, clientSecret, gmailAddress }) -> tokenJson
+// Resolves to the raw Google token JSON (refresh_token, access_token, scope,
+// expires_in, token_type). Rejects on error/timeout.
+export async function runConsent({ clientId, clientSecret, gmailAddress, port = DEFAULT_PORT, log }) {
+  if (!clientId || !clientSecret) {
+    throw new Error("clientId and clientSecret are required");
+  }
+
+  let resolveOuter, rejectOuter;
+  const outer = new Promise((res, rej) => { resolveOuter = res; rejectOuter = rej; });
+
+  let finished = false;
+  let server, timer, redirectUri;
+  const finish = (err, value) => {
+    if (finished) return;
+    finished = true;
+    if (timer) clearTimeout(timer);
+    try { server && server.close(); } catch { /* */ }
+    err ? rejectOuter(err) : resolveOuter(value);
+  };
+
+  const safeWrite = (res, status, headers, body) => {
+    try {
+      if (res.headersSent) return;
+      res.writeHead(status, headers).end(body);
+    } catch { /* response may already be torn down */ }
+  };
+
+  const handler = async (req, res) => {
+    try {
+      const u = new URL(req.url, redirectUri);
+      if (u.pathname === "/favicon.ico") {
+        safeWrite(res, 404, {}, "");
+        return;
+      }
+      if (!u.searchParams.has("code") && !u.searchParams.has("error")) {
+        // Not the redirect — could be a stale browser tab probing the port.
+        // Reply 404 so it's distinguishable from the real callback page.
+        safeWrite(res, 404, { "content-type": "text/plain" }, "not the redirect");
+        return;
+      }
+      if (u.searchParams.has("error")) {
+        const err = u.searchParams.get("error");
+        safeWrite(res, 200, { "content-type": "text/plain" },
+          `OAuth error: ${err}\nYou can close this tab.`);
+        finish(new Error(`OAuth error from Google: ${err}`));
+        return;
+      }
+      const code = u.searchParams.get("code");
+      const tokenRes = await fetch("https://oauth2.googleapis.com/token", {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          code,
+          client_id: clientId,
+          client_secret: clientSecret,
+          redirect_uri: redirectUri,
+          grant_type: "authorization_code",
+        }),
+      });
+      if (!tokenRes.ok) {
+        const text = await tokenRes.text();
+        safeWrite(res, 200, { "content-type": "text/plain" },
+          "Token exchange failed. Return to the terminal for details.");
+        finish(new Error(`token exchange failed (${tokenRes.status}): ${text}`));
+        return;
+      }
+      const tok = await tokenRes.json();
+      if (!tok.refresh_token) {
+        safeWrite(res, 200, { "content-type": "text/plain" },
+          "Got an access token, but Google didn't return a refresh token.\n" +
+          "Google only returns refresh_token on first consent. Revoke the app\n" +
+          "at https://myaccount.google.com/permissions and re-run setup.");
+        finish(new Error(
+          "no refresh_token in Google's response. Revoke the app at " +
+          "https://myaccount.google.com/permissions and re-run setup.",
+        ));
+        return;
+      }
+      safeWrite(res, 200, { "content-type": "text/html" },
+        `<html><body style="font-family:sans-serif;padding:2em">` +
+        `<h2>Done.</h2><p>You can close this tab and return to the terminal.</p>` +
+        `</body></html>`);
+      finish(null, tok);
+    } catch (e) {
+      safeWrite(res, 500, {}, "internal error");
+      finish(e);
+    }
+  };
+
+  const bound = await bindServer(handler, port);
+  server = bound.server;
+  redirectUri = `http://localhost:${bound.port}`;
+  if (log && bound.port !== port) log.debug(`port ${port} busy, using ${bound.port}`);
+
+  // Surface any later server errors as a finish so callers see them.
+  server.on("error", (e) => finish(e));
+
+  timer = setTimeout(() => {
+    finish(new Error(`OAuth timed out after ${TIMEOUT_MS / 60000} minutes`));
+  }, TIMEOUT_MS);
+
+  const authUrl = new URL("https://accounts.google.com/o/oauth2/v2/auth");
+  authUrl.searchParams.set("client_id", clientId);
+  authUrl.searchParams.set("redirect_uri", redirectUri);
+  authUrl.searchParams.set("response_type", "code");
+  authUrl.searchParams.set("scope", SCOPES);
+  authUrl.searchParams.set("access_type", "offline");
+  authUrl.searchParams.set("prompt", "consent");
+  if (gmailAddress) authUrl.searchParams.set("login_hint", gmailAddress);
+
+  if (log) {
+    log.say(`Opening browser. If it doesn't open automatically, paste this URL:`);
+    log.say("  " + authUrl.toString());
+    log.say(`Waiting for Google to redirect to ${redirectUri} ...`);
+  }
+  openBrowser(authUrl.toString());
+
+  return outer;
+}
+
+export { SCOPES };
diff --git a/lib/poll.mjs b/lib/poll.mjs
new file mode 100644
index 0000000..ce1fbcd
--- /dev/null
+++ b/lib/poll.mjs
@@ -0,0 +1,123 @@
+// The main polling loop. Mirrors the original index.mjs flow but built on
+// the shared lib/* modules so it shares OAuth, Gmail, MIME, and printer
+// code with the wizard and doctor.
+
+import { mkdirSync, writeFileSync, rmSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { GmailClient, GmailAuthError, walkMime, htmlToText, headerVal, safeName, b64urlToBuffer } from "./gmail.mjs";
+
+export { GmailAuthError };
+import { printFiles } from "./printer.mjs";
+import { resolveInRoot } from "./config.mjs";
+
+async function sendNotify(gmail, config, subject, body, log) {
+  if (!config.notifyEmail || !config.notifyFromAddress) return;
+  try {
+    await gmail.sendPlain(config.notifyFromAddress, config.notifyEmail, `[mailpress] ${subject}`, body);
+    log.info("notify sent:", subject);
+  } catch (e) {
+    log.warn("notify send failed:", e.message);
+  }
+}
+
+async function processMessage(gmail, config, log, id) {
+  const msg = await gmail.getMessage(id);
+  const headers = msg.payload?.headers || [];
+  const subject = headerVal(headers, "Subject") || "(no subject)";
+  const from    = headerVal(headers, "From") || "(unknown)";
+  const date    = headerVal(headers, "Date") || "";
+  log.info(`msg ${id} | from=${from} | subj=${subject}`);
+
+  const { bodyText, bodyHtml, attachments } = walkMime(msg.payload);
+
+  const spoolDir = resolveInRoot(config.spoolDir || "./spool");
+  if (!existsSync(spoolDir)) mkdirSync(spoolDir, { recursive: true });
+  const msgDir = join(spoolDir, id);
+  mkdirSync(msgDir, { recursive: true });
+  const filesToPrint = [];
+
+  // Body
+  const bodyHeader =
+    `From: ${from}\r\n` +
+    `Date: ${date}\r\n` +
+    `Subject: ${subject}\r\n` +
+    `${"-".repeat(70)}\r\n\r\n`;
+  const bodyContent = (bodyText && bodyText.trim())
+    ? bodyText
+    : (bodyHtml ? htmlToText(bodyHtml) : "(no body)");
+  const bodyPath = join(msgDir, "body.txt");
+  writeFileSync(bodyPath, bodyHeader + bodyContent, "utf8");
+  filesToPrint.push(bodyPath);
+
+  // Attachments
+  const maxBytes = config.maxAttachmentBytes ?? 25 * 1024 * 1024;
+  for (let i = 0; i < attachments.length; i++) {
+    const a = attachments[i];
+    if (!a.attachmentId) {
+      log.warn(`msg ${id}: attachment ${a.filename} has no attachmentId, skip`);
+      continue;
+    }
+    if (a.size > maxBytes) {
+      log.warn(`msg ${id}: attachment ${a.filename} too big (${a.size}b), skip`);
+      continue;
+    }
+    const data = await gmail.getAttachment(id, a.attachmentId);
+    const buf = b64urlToBuffer(data.data);
+    const filename = `${String(i + 1).padStart(2, "0")}_${safeName(a.filename)}`;
+    const filePath = join(msgDir, filename);
+    writeFileSync(filePath, buf);
+    filesToPrint.push(filePath);
+    log.info(`msg ${id}: staged ${filename} (${buf.length}b, ${a.mimeType})`);
+  }
+
+  await printFiles(filesToPrint, config, { log });
+  await gmail.markRead(id);
+
+  try { rmSync(msgDir, { recursive: true, force: true }); }
+  catch (e) { log.warn(`cleanup ${msgDir}: ${e.message}`); }
+
+  log.info(`msg ${id}: printed ${filesToPrint.length} file(s), marked read`);
+}
+
+async function tick(gmail, config, log) {
+  const list = await gmail.listMessages(config.gmailQuery || "in:inbox category:primary is:unread", 25);
+  const ids = (list.messages || []).map((m) => m.id);
+  if (ids.length === 0) {
+    log.debug("no new messages");
+    return;
+  }
+  log.info(`found ${ids.length} new message(s)`);
+  for (const id of ids) {
+    try {
+      await processMessage(gmail, config, log, id);
+    } catch (e) {
+      // Fatal auth errors mid-batch must bubble up: spamming notifications
+      // for every remaining message won't help, and the loop's outer catch
+      // is what triggers the "re-run setup" exit code.
+      if (e instanceof GmailAuthError && e.fatal) throw e;
+      log.error(`msg ${id} failed:`, e);
+      await sendNotify(gmail, config, `error processing message ${id}`, `${e.message}\n\n${e.stack || ""}`, log);
+    }
+  }
+}
+
+// Run the poll loop until process is killed. Returns only if runOnce is true.
+export async function runPoll(config, { log, runOnce = false } = {}) {
+  const gmail = new GmailClient(config, { log });
+  const pollMs = config.pollIntervalMs ?? 300_000;
+  log.info(`mailpress starting; query="${config.gmailQuery}"; poll=${pollMs}ms; printer="${config.printerName}"`);
+
+  while (true) {
+    try {
+      await tick(gmail, config, log);
+    } catch (e) {
+      log.error("tick failed:", e);
+      if (e instanceof GmailAuthError && e.fatal) {
+        await sendNotify(gmail, config, "auth failure — re-run setup", e.message, log);
+        throw e; // bubble up so caller can exit with non-zero
+      }
+    }
+    if (runOnce) break;
+    await new Promise((r) => setTimeout(r, pollMs));
+  }
+}
diff --git a/lib/printer.mjs b/lib/printer.mjs
new file mode 100644
index 0000000..71127ce
--- /dev/null
+++ b/lib/printer.mjs
@@ -0,0 +1,188 @@
+// Printer helpers. Windows-only at runtime — on other platforms these throw
+// with a clear message. List, validate, print a batch, print a test page.
+
+import { spawn } from "node:child_process";
+import { writeFileSync, mkdtempSync, rmSync, existsSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { resolveInRoot } from "./config.mjs";
+
+const PRINT_PS1_NAME = "print-files.ps1";
+
+export function isWindows() {
+  return process.platform === "win32";
+}
+
+function powershellPath() {
+  // Prefer Windows PowerShell over pwsh — print-files.ps1 has `#requires -version 5.1`.
+  return "powershell.exe";
+}
+
+// Run a PowerShell snippet and return { code, stdout, stderr }.
+// Times out so a hung PowerShell doesn't deadlock the wizard.
+function runPs(args, { input, timeoutMs = 30_000 } = {}) {
+  return new Promise((resolve, reject) => {
+    if (!isWindows()) {
+      reject(new Error("PowerShell is only available on Windows"));
+      return;
+    }
+    const ps = spawn(powershellPath(), args, { stdio: ["pipe", "pipe", "pipe"] });
+    let stdout = "", stderr = "";
+    const killer = setTimeout(() => {
+      try { ps.kill("SIGKILL"); } catch { /* */ }
+      reject(new Error(`PowerShell timed out after ${timeoutMs}ms`));
+    }, timeoutMs);
+    ps.stdout.on("data", (d) => { stdout += d.toString(); });
+    ps.stderr.on("data", (d) => { stderr += d.toString(); });
+    ps.on("error", (e) => { clearTimeout(killer); reject(e); });
+    ps.on("close", (code) => {
+      clearTimeout(killer);
+      resolve({ code, stdout, stderr });
+    });
+    if (input) {
+      ps.stdin.write(input);
+      ps.stdin.end();
+    } else {
+      ps.stdin.end();
+    }
+  });
+}
+
+export async function listPrinters() {
+  if (!isWindows()) return [];
+  const { code, stdout, stderr } = await runPs([
+    "-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass",
+    "-Command", "Get-Printer | Select-Object Name,DriverName,PortName,PrinterStatus | ConvertTo-Json -Compress",
+  ]);
+  if (code !== 0) {
+    throw new Error(`Get-Printer failed (${code}): ${stderr.trim() || stdout.trim()}`);
+  }
+  // Windows PowerShell 5.1 sometimes prepends a UTF-8 BOM on pipe-captured
+  // output; JSON.parse chokes on it.
+  const clean = stdout.replace(/^/, "").trim();
+  if (!clean) return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(clean);
+  } catch (e) {
+    throw new Error(`Could not parse Get-Printer output: ${e.message}`);
+  }
+  // ConvertTo-Json returns an object (single printer) or array (many). Normalize.
+  return Array.isArray(parsed) ? parsed : [parsed];
+}
+
+export async function printerExists(name) {
+  if (!name) return false;
+  try {
+    const printers = await listPrinters();
+    return printers.some((p) => p.Name === name);
+  } catch {
+    return false;
+  }
+}
+
+// Time budget per file (rough): launch app + spool + sleep gap. Generous
+// because Word/Excel cold start is slow. Adjust via config.perPrintTimeoutMs.
+const DEFAULT_PER_FILE_TIMEOUT_MS = 120_000;
+
+export function printFiles(files, config, { log } = {}) {
+  return new Promise((resolveP, rejectP) => {
+    if (!isWindows()) {
+      rejectP(new Error("printing requires Windows"));
+      return;
+    }
+    if (!files.length) {
+      resolveP();
+      return;
+    }
+    const ps1 = resolveInRoot(PRINT_PS1_NAME);
+    if (!existsSync(ps1)) {
+      rejectP(new Error(`print helper missing: ${ps1}`));
+      return;
+    }
+    // Filenames with commas would split incorrectly with -Files "a,b,c". Pass
+    // them as one PowerShell array argument by quoting each as a separate
+    // -Files token (PowerShell collects repeated values for [string[]] params
+    // when given comma-separated, so we feed via a delimiter unlikely to
+    // appear in paths). Simpler: use the pipe character which is illegal in
+    // Windows filenames, and split on it inside the PS1.
+    const args = [
+      "-NoProfile",
+      "-ExecutionPolicy", "Bypass",
+      "-File", ps1,
+      "-PrinterName", config.printerName,
+      "-FilesDelimited", files.join("|"),
+      "-SleepMs", String(config.perPrintSleepMs ?? 3000),
+    ];
+    const timeoutMs = Math.max(
+      30_000,
+      (config.perPrintTimeoutMs ?? DEFAULT_PER_FILE_TIMEOUT_MS) * files.length,
+    );
+    const ps = spawn(powershellPath(), args, { stdio: ["ignore", "pipe", "pipe"] });
+    let stdout = "", stderr = "", done = false;
+    const finishOk = () => { if (!done) { done = true; clearTimeout(timer); resolveP(); } };
+    const finishErr = (e) => { if (!done) { done = true; clearTimeout(timer); rejectP(e); } };
+    const timer = setTimeout(() => {
+      try { ps.kill("SIGKILL"); } catch { /* */ }
+      finishErr(new Error(`print-files.ps1 timed out after ${timeoutMs}ms (printer offline? spooler hung? app dialog waiting?)`));
+    }, timeoutMs);
+    ps.stdout.on("data", (d) => { stdout += d.toString(); });
+    ps.stderr.on("data", (d) => { stderr += d.toString(); });
+    ps.on("close", (code) => {
+      if (stdout && log) log.info("powershell:", stdout.trim().replace(/\n/g, " | "));
+      if (stderr && log) log.warn("powershell stderr:", stderr.trim().replace(/\n/g, " | "));
+      if (code === 0) finishOk();
+      else finishErr(new Error(`print-files.ps1 exited ${code}`));
+    });
+    ps.on("error", finishErr);
+  });
+}
+
+// Interactive printer picker. Lists installed printers and asks the user to
+// choose one. Returns the chosen name. Shared by the wizard and the
+// --test menu so both flows behave identically.
+export async function pickPrinter({ prompter, current, log, dim }) {
+  if (!isWindows()) {
+    return prompter.ask("Printer name (free text — can't enumerate on non-Windows):", {
+      default: current,
+      validate: (v) => v ? null : "required",
+    });
+  }
+  log.say("Enumerating installed printers...");
+  const printers = await listPrinters();
+  if (printers.length === 0) {
+    throw new Error("Get-Printer returned no printers. Plug in / install the printer first, then retry.");
+  }
+  const options = printers.map((p) => ({
+    label: `${p.Name}${p.PortName && dim ? dim(`  (${p.PortName})`) : (p.PortName ? `  (${p.PortName})` : "")}`,
+    value: p.Name,
+  }));
+  if (current && printers.some((p) => p.Name === current)) {
+    options.unshift({ label: `${current} ${dim ? dim("(current)") : "(current)"}`, value: current });
+  }
+  return prompter.choose("Which printer should mailpress send to?", options);
+}
+
+// Write a tiny test page to a temp file and print it. Returns the temp path
+// so the caller can clean up after confirming the print landed.
+export async function testPrint(config, { log } = {}) {
+  const dir = mkdtempSync(join(tmpdir(), "mailpress-test-"));
+  const file = join(dir, "mailpress-test-page.txt");
+  const stamp = new Date().toISOString();
+  const content =
+    `MAILPRESS TEST PAGE\r\n` +
+    `${"=".repeat(40)}\r\n` +
+    `\r\n` +
+    `If you're reading this on paper, your printer is wired up correctly.\r\n` +
+    `\r\n` +
+    `Printer : ${config.printerName}\r\n` +
+    `Time    : ${stamp}\r\n` +
+    `\r\n` +
+    `You can throw this page away.\r\n`;
+  writeFileSync(file, content, "utf8");
+  try {
+    await printFiles([file], config, { log });
+  } finally {
+    try { rmSync(dir, { recursive: true, force: true }); } catch { /* */ }
+  }
+}
diff --git a/lib/prompt.mjs b/lib/prompt.mjs
new file mode 100644
index 0000000..90ee9fb
--- /dev/null
+++ b/lib/prompt.mjs
@@ -0,0 +1,63 @@
+// Small wrapper around node:readline used by wizard, test mode, and any
+// future interactive command. Logs every prompt + answer to the file
+// logger so debugging a confused user session is just "show me the log".
+
+import { createInterface } from "node:readline/promises";
+import { stdin as input, stdout as output } from "node:process";
+
+const BOLD = "\x1b[1m", DIM = "\x1b[2m", RESET = "\x1b[0m";
+
+export function bold(s) { return process.stdout.isTTY ? `${BOLD}${s}${RESET}` : s; }
+export function dim(s)  { return process.stdout.isTTY ? `${DIM}${s}${RESET}`  : s; }
+
+export class Prompter {
+  constructor(log) {
+    this.log = log;
+    this.rl = createInterface({ input, output });
+  }
+  close() {
+    try { this.rl.close(); } catch { /* already closed */ }
+  }
+
+  async ask(question, { default: def, secret = false, validate } = {}) {
+    while (true) {
+      const hasDefault = def !== undefined && def !== null && def !== "";
+      const suffix = hasDefault ? dim(` [${secret ? "(unchanged)" : def}]`) : "";
+      const raw = (await this.rl.question(`${question}${suffix} `)).trim();
+      const value = raw !== "" ? raw : (hasDefault ? def : "");
+      this.log.debug(`prompt: ${question} -> ${secret ? "***" : value}`);
+      if (validate) {
+        const err = validate(value);
+        if (err) {
+          this.log.say(dim(`  ${err}`));
+          continue;
+        }
+      }
+      return value;
+    }
+  }
+
+  async confirm(question, { default: def = true } = {}) {
+    const hint = def ? "[Y/n]" : "[y/N]";
+    const a = (await this.rl.question(`${question} ${hint} `)).trim().toLowerCase();
+    this.log.debug(`confirm: ${question} -> ${a}`);
+    if (!a) return def;
+    return a.startsWith("y");
+  }
+
+  async choose(question, options) {
+    this.log.say(question);
+    for (let i = 0; i < options.length; i++) {
+      this.log.say(`  ${i + 1}. ${options[i].label}`);
+    }
+    while (true) {
+      const a = (await this.rl.question(dim(`Pick 1-${options.length}: `))).trim();
+      const n = parseInt(a, 10);
+      if (Number.isInteger(n) && n >= 1 && n <= options.length) {
+        this.log.debug(`choose: ${question} -> ${options[n - 1].label}`);
+        return options[n - 1].value;
+      }
+      this.log.say(dim(`  enter a number 1-${options.length}`));
+    }
+  }
+}
diff --git a/lib/task.mjs b/lib/task.mjs
new file mode 100644
index 0000000..4936162
--- /dev/null
+++ b/lib/task.mjs
@@ -0,0 +1,115 @@
+// Windows Scheduled Task helpers. Installs mailpress as a "run at login,
+// restart on failure" task pointing at the current exe (or `node index.mjs`
+// when running from source).
+
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { resolveInRoot, installRoot } from "./config.mjs";
+import { isWindows } from "./printer.mjs";
+
+const TASK_NAME = "mailpress";
+
+function runPs(script, { timeoutMs = 60_000 } = {}) {
+  return new Promise((resolve, reject) => {
+    if (!isWindows()) {
+      reject(new Error("Scheduled Tasks are Windows-only"));
+      return;
+    }
+    const ps = spawn("powershell.exe", [
+      "-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass",
+      "-Command", script,
+    ], { stdio: ["ignore", "pipe", "pipe"] });
+    let stdout = "", stderr = "";
+    const killer = setTimeout(() => {
+      try { ps.kill("SIGKILL"); } catch { /* */ }
+      reject(new Error(`PowerShell timed out after ${timeoutMs}ms`));
+    }, timeoutMs);
+    ps.stdout.on("data", (d) => { stdout += d.toString(); });
+    ps.stderr.on("data", (d) => { stderr += d.toString(); });
+    ps.on("error", (e) => { clearTimeout(killer); reject(e); });
+    ps.on("close", (code) => {
+      clearTimeout(killer);
+      if (code !== 0) {
+        reject(new Error(`PowerShell exited ${code}: ${stderr.trim() || stdout.trim()}`));
+      } else {
+        resolve(stdout.trim());
+      }
+    });
+  });
+}
+
+export async function taskExists() {
+  try {
+    const out = await runPs(
+      `if (Get-ScheduledTask -TaskName '${TASK_NAME}' -ErrorAction SilentlyContinue) { 'yes' } else { 'no' }`,
+    );
+    return out.trim() === "yes";
+  } catch {
+    return false;
+  }
+}
+
+// What command should the Scheduled Task run? When packaged as a SEA exe,
+// argv[0] points at mailpress.exe. When running from source, we register
+// `node index.mjs` (NOT cli.mjs — see note below).
+//
+// Note: from source the task runs index.mjs, not cli.mjs. index.mjs is a
+// pure poll loop; if config goes bad it exits non-zero and the task's
+// RestartCount handles backoff. cli.mjs would auto-launch the wizard which
+// needs interactive stdin — useless from a scheduled-task context.
+function actionTarget() {
+  const root = installRoot();
+  const execPath = process.execPath;
+  const baseName = execPath.split(/[\\\/]/).pop().toLowerCase();
+  const isSea = baseName === "mailpress.exe" || baseName === "mailpress";
+  if (isSea) {
+    return { execute: execPath, argument: null, workingDir: root };
+  }
+  // Pass the script path as a single arg WITHOUT manual surrounding quotes —
+  // Register-ScheduledTask handles quoting internally; embedded quotes end
+  // up as literal characters in argv[1] which then doesn't resolve as a file.
+  return { execute: execPath, argument: resolveInRoot("index.mjs"), workingDir: root };
+}
+
+export async function installTask() {
+  const { execute, argument, workingDir } = actionTarget();
+  if (!existsSync(execute)) {
+    throw new Error(`scheduled task target does not exist: ${execute}`);
+  }
+  // PowerShell single-quoted strings only need '' to escape a single quote.
+  // Path-safe: backslashes, $ , `, " all pass through as literal.
+  const esc = (s) => String(s).replace(/'/g, "''");
+  const script = `
+$ErrorActionPreference = 'Stop'
+$taskName = '${TASK_NAME}'
+$existing = Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue
+if ($existing) {
+  # Stop first; Unregister of a running task can fail or leave the process orphaned.
+  try { Stop-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue } catch {}
+  Unregister-ScheduledTask -TaskName $taskName -Confirm:$false
+}
+$action = New-ScheduledTaskAction -Execute '${esc(execute)}' ${argument != null ? `-Argument '${esc(argument)}'` : ""} -WorkingDirectory '${esc(workingDir)}'
+$trigger = New-ScheduledTaskTrigger -AtLogOn -User $env:USERNAME
+$settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -RestartCount 999 -RestartInterval (New-TimeSpan -Minutes 1) -ExecutionTimeLimit (New-TimeSpan -Days 0) -MultipleInstances IgnoreNew
+$principal = New-ScheduledTaskPrincipal -UserId $env:USERNAME -LogonType Interactive -RunLevel Limited
+Register-ScheduledTask -TaskName $taskName -Action $action -Trigger $trigger -Settings $settings -Principal $principal -Description 'mailpress - Gmail to printer relay' | Out-Null
+Start-ScheduledTask -TaskName $taskName
+Write-Output 'installed'
+`.trim();
+  return runPs(script);
+}
+
+export async function uninstallTask() {
+  return runPs(`
+$ErrorActionPreference = 'Stop'
+if (Get-ScheduledTask -TaskName '${TASK_NAME}' -ErrorAction SilentlyContinue) {
+  Stop-ScheduledTask -TaskName '${TASK_NAME}' -ErrorAction SilentlyContinue
+  Unregister-ScheduledTask -TaskName '${TASK_NAME}' -Confirm:$false
+  Write-Output 'removed'
+} else {
+  Write-Output 'absent'
+}
+`.trim());
+}
+
+export { TASK_NAME };
diff --git a/lib/test.mjs b/lib/test.mjs
new file mode 100644
index 0000000..d11b73d
--- /dev/null
+++ b/lib/test.mjs
@@ -0,0 +1,137 @@
+// Interactive test menu. Run with `mailpress --test`. Lets the operator:
+//   - print the mailpress-generated test page
+//   - print any file they pick (so they can verify .docx, .xlsx, .pdf etc.)
+//   - switch the configured printer (persists to config.local.json)
+//   - quit
+//
+// Designed to be safe to run on a configured production install — the only
+// mutation is saving a new printer choice, which it confirms first.
+
+import { existsSync, statSync, writeFileSync, mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, basename, extname, resolve } from "node:path";
+import { loadConfig, saveConfig, validateConfig } from "./config.mjs";
+import { isWindows, pickPrinter, printFiles, testPrint } from "./printer.mjs";
+import { Prompter, dim, bold } from "./prompt.mjs";
+
+const MENU = [
+  { label: "Print the mailpress test page (auto-generated)",         value: "testpage" },
+  { label: "Print a file I pick (.txt, .pdf, .docx, .xlsx, image)",  value: "file" },
+  { label: "Switch the active printer (and save to config)",         value: "switch" },
+  { label: "Print the test page on EACH installed printer",          value: "all" },
+  { label: "Quit",                                                   value: "quit" },
+];
+
+async function actionTestPage(config, log) {
+  log.say(`Printing test page to "${config.printerName}"...`);
+  await testPrint(config, { log });
+  log.success("test page sent to the spooler");
+}
+
+async function actionFile(config, log, prompter) {
+  log.say("Drop in a full path to any file you want to test-print.");
+  log.say(dim("  Examples:  C:\\Users\\you\\Desktop\\sample.docx"));
+  log.say(dim("             C:\\Users\\you\\Downloads\\invoice.pdf"));
+  const path = await prompter.ask("File path:", {
+    validate: (v) => {
+      if (!v) return "required";
+      if (!existsSync(v)) return `not found: ${v}`;
+      try {
+        if (!statSync(v).isFile()) return "not a file";
+      } catch (e) { return e.message; }
+      return null;
+    },
+  });
+  const ext = extname(path).toLowerCase();
+  log.say(`File: ${basename(path)} (${ext || "(no ext)"})`);
+  log.say(`Printer: ${config.printerName}`);
+  log.say("");
+  if (ext && ![".txt", ".pdf", ".docx", ".doc", ".xlsx", ".xls", ".pptx", ".ppt", ".png", ".jpg", ".jpeg", ".gif", ".html", ".htm"].includes(ext)) {
+    log.say(dim(`  Note: print-files.ps1 will try the Print verb. If no app is registered`));
+    log.say(dim(`  to print ${ext}, Windows will fall back to Open and you'll see a dialog.`));
+  }
+  await printFiles([resolve(path)], config, { log });
+  log.success("send to printer complete (check the tray for the page)");
+}
+
+async function actionSwitch(config, log, prompter) {
+  const chosen = await pickPrinter({ prompter, current: config.printerName, log, dim });
+  if (chosen === config.printerName) {
+    log.say("(same printer — no change)");
+    return;
+  }
+  const ok = await prompter.confirm(
+    `Update config.local.json:  printerName = "${chosen}"  ?`, { default: true });
+  if (!ok) {
+    log.say(dim("  not saved"));
+    return;
+  }
+  const fresh = loadConfig() || {};
+  fresh.printerName = chosen;
+  saveConfig(fresh);
+  config.printerName = chosen;
+  log.success(`printer switched to "${chosen}" and saved`);
+  log.say(dim("  Restart the mailpress scheduled task to pick up the change:"));
+  log.say(dim(`    powershell -c "Stop-ScheduledTask mailpress; Start-ScheduledTask mailpress"`));
+}
+
+async function actionAll(config, log, prompter) {
+  if (!isWindows()) {
+    log.say("Can't enumerate printers off Windows.");
+    return;
+  }
+  const { listPrinters } = await import("./printer.mjs");
+  const printers = await listPrinters();
+  if (printers.length === 0) {
+    log.say("No printers found.");
+    return;
+  }
+  log.say(`Found ${printers.length} printer(s). Will send a test page to each in turn.`);
+  const ok = await prompter.confirm(`Proceed?`, { default: false });
+  if (!ok) return;
+  for (const p of printers) {
+    log.say("");
+    log.say(`-> ${p.Name}`);
+    try {
+      await testPrint({ ...config, printerName: p.Name }, { log });
+      log.success(`sent to ${p.Name}`);
+    } catch (e) {
+      log.failure(`${p.Name}: ${e.message}`);
+    }
+  }
+}
+
+export async function runTest({ log }) {
+  const cfg = loadConfig();
+  const errors = cfg ? validateConfig(cfg) : ["config.local.json is missing"];
+  if (errors.length) {
+    log.failure("Config not ready: " + errors.join("; "));
+    log.say("Run `mailpress --setup` first.");
+    return 2;
+  }
+  const config = { ...cfg };
+  const prompter = new Prompter(log);
+  log.heading("mailpress test menu");
+  log.say(`Current printer: ${bold(config.printerName)}`);
+  log.say(dim(`(safe to run while the scheduled task is polling — no Gmail traffic)`));
+
+  try {
+    while (true) {
+      log.say("");
+      const choice = await prompter.choose("What do you want to do?", MENU);
+      try {
+        if (choice === "quit") break;
+        if (choice === "testpage") await actionTestPage(config, log);
+        else if (choice === "file") await actionFile(config, log, prompter);
+        else if (choice === "switch") await actionSwitch(config, log, prompter);
+        else if (choice === "all") await actionAll(config, log, prompter);
+      } catch (e) {
+        log.failure(e.message);
+        log.debug(e.stack || e.message);
+      }
+    }
+  } finally {
+    prompter.close();
+  }
+  return 0;
+}
diff --git a/lib/wizard.mjs b/lib/wizard.mjs
new file mode 100644
index 0000000..6968453
--- /dev/null
+++ b/lib/wizard.mjs
@@ -0,0 +1,282 @@
+// First-run wizard. Walks the user through every setup step interactively.
+//
+// Design rules:
+//   - Every step is wrapped so a failure offers retry/skip/quit instead of
+//     dumping a stack trace and exiting. The user wants this to be robust.
+//   - Every prompt, every external call, every error is written to the
+//     setup log so we can diagnose problems after the fact.
+//   - We never lose progress: completed steps update config.local.json /
+//     .local-token.json immediately so re-running picks up where we left off.
+
+import { existsSync, rmSync } from "node:fs";
+import { loadConfig, saveConfig, validateConfig, resolveInRoot, DEFAULTS } from "./config.mjs";
+import { GmailClient } from "./gmail.mjs";
+import { runConsent } from "./oauth.mjs";
+import { isWindows, listPrinters, testPrint, pickPrinter } from "./printer.mjs";
+import { installTask, taskExists } from "./task.mjs";
+import { Prompter, bold, dim } from "./prompt.mjs";
+
+async function tryVerifyExistingToken(gmail, config, log) {
+  try {
+    const prof = await gmail.profile();
+    if (prof.emailAddress?.toLowerCase() === config.gmailAddress.toLowerCase()) return true;
+    log.debug(`existing token belongs to ${prof.emailAddress}, want ${config.gmailAddress}`);
+    return false;
+  } catch (e) {
+    log.debug(`existing token verify failed: ${e.message}`);
+    return false;
+  }
+}
+
+function deleteToken(path, log) {
+  try { rmSync(path, { force: true }); log.debug(`deleted token: ${path}`); }
+  catch (e) { log.warn(`could not delete token ${path}: ${e.message}`); }
+}
+
+// Run a wizard step. On failure, offer the user retry/skip/quit so a bad
+// step doesn't sink the whole wizard. Returns the step's value or null
+// if skipped/aborted.
+async function step(prompter, log, name, fn, { allowSkip = false } = {}) {
+  log.heading(name);
+  while (true) {
+    try {
+      return await fn();
+    } catch (e) {
+      log.failure(`${name}: ${e.message}`);
+      log.debug(e.stack || e.message);
+      const choices = allowSkip
+        ? [{ label: "retry", value: "retry" }, { label: "skip this step", value: "skip" }, { label: "quit setup", value: "quit" }]
+        : [{ label: "retry", value: "retry" }, { label: "quit setup", value: "quit" }];
+      const choice = await prompter.choose("How do you want to handle this?", choices);
+      if (choice === "skip") return null;
+      if (choice === "quit") throw new Error("setup aborted by user");
+    }
+  }
+}
+
+// ---------- the wizard ----------
+
+export async function runWizard({ log }) {
+  const prompter = new Prompter(log);
+
+  log.heading("mailpress setup");
+  log.say("This wizard will set up Gmail-to-printer relaying on this PC.");
+  log.say(`Detailed log: ${dim(log.file() || "(no file)")}`);
+  log.say("");
+
+  // Pull anything we've already configured so re-running is idempotent.
+  // Tolerate a corrupt config file — the whole point of running the wizard
+  // is to repair broken state, so we treat parse errors as "start fresh"
+  // and warn the user that the existing file will be overwritten.
+  let existing = {};
+  try {
+    existing = loadConfig() || {};
+  } catch (e) {
+    log.warn(`existing config.local.json is unreadable (${e.message}); starting fresh`);
+  }
+  const config = { ...DEFAULTS, ...existing };
+  const startingClientId = config.googleClientId;
+  const startingGmailAddress = config.gmailAddress;
+
+  try {
+    // ---- Step 1: system check ----
+    await step(prompter, log, "Step 1 of 6 — system check", async () => {
+      if (!isWindows()) {
+        log.failure(`platform is ${process.platform}, not win32`);
+        log.say("mailpress prints through Windows PowerShell. It can be configured");
+        log.say("here but won't actually print until run on the Windows office PC.");
+        const proceed = await prompter.confirm("Continue setup anyway?", { default: false });
+        if (!proceed) throw new Error("aborted: not running on Windows");
+      } else {
+        log.success(`platform: ${process.platform}`);
+      }
+      const major = parseInt(process.versions.node.split(".")[0], 10);
+      if (major < 18) throw new Error(`Node ${process.versions.node} is too old; need >= 18`);
+      log.success(`Node: ${process.versions.node}`);
+    });
+
+    // ---- Step 2: pick a printer ----
+    await step(prompter, log, "Step 2 of 6 — pick a printer", async () => {
+      const chosen = await pickPrinter({ prompter, current: config.printerName, log, dim });
+      config.printerName = chosen;
+      log.success(`printer: ${chosen}`);
+    });
+
+    // ---- Step 3: Gmail OAuth client + Gmail address ----
+    await step(prompter, log, "Step 3 of 6 — Google OAuth client", async () => {
+      log.say("mailpress needs a Google Cloud OAuth client to access Gmail.");
+      log.say("This is the one step Google doesn't let an installer automate.");
+      log.say("");
+      log.say(bold("  Manual steps in your browser:"));
+      log.say("    1. Go to https://console.cloud.google.com/projectcreate");
+      log.say("       (create a new project — name it whatever, e.g. \"mailpress\")");
+      log.say("    2. Enable the Gmail API:");
+      log.say("       https://console.cloud.google.com/apis/library/gmail.googleapis.com");
+      log.say("       → click \"Enable\"");
+      log.say("    3. Configure OAuth consent screen (left sidebar → APIs & Services");
+      log.say("       → OAuth consent screen):");
+      log.say("       - User type: External");
+      log.say("       - Add your Gmail as a Test user");
+      log.say("       - Add scopes: gmail.modify and gmail.send");
+      log.say("    4. Create credentials → OAuth client ID → Application type:");
+      log.say("       \"Desktop app\". Click Create.");
+      log.say("    5. Copy the Client ID and Client secret from the dialog.");
+      log.say("");
+      log.say("Documentation: https://developers.google.com/workspace/guides/create-credentials");
+      log.say("");
+      const ready = await prompter.confirm("Done? Have the client ID and secret ready?", { default: true });
+      if (!ready) throw new Error("come back when the OAuth client is created");
+
+      config.googleClientId = await prompter.ask("Google Client ID:", {
+        default: !config.googleClientId?.startsWith("FILL_IN") ? config.googleClientId : undefined,
+        validate: (v) => v ? null : "required",
+      });
+      config.googleClientSecret = await prompter.ask("Google Client Secret:", {
+        default: !config.googleClientSecret?.startsWith("FILL_IN") ? config.googleClientSecret : undefined,
+        secret: true,
+        validate: (v) => v ? null : "required",
+      });
+      config.gmailAddress = await prompter.ask("Office Gmail address (the inbox to monitor):", {
+        default: !config.gmailAddress?.startsWith("FILL_IN") ? config.gmailAddress : undefined,
+        validate: (v) => /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(v) ? null : "doesn't look like an email",
+      });
+      const sameNotify = await prompter.confirm(
+        `Send error notifications from ${config.gmailAddress}?`, { default: true });
+      config.notifyFromAddress = sameNotify ? config.gmailAddress : await prompter.ask(
+        "From address for error notifications:", {
+          default: config.notifyFromAddress,
+          validate: (v) => /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(v) ? null : "doesn't look like an email",
+        });
+      config.notifyEmail = await prompter.ask("Email to send error notifications TO:", {
+        default: config.notifyEmail || config.gmailAddress,
+        validate: (v) => /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(v) ? null : "doesn't look like an email",
+      });
+
+      // Persist before the consent flow so if it fails we don't lose creds.
+      saveConfig(config);
+      log.success("config saved");
+    });
+
+    // ---- Step 4: OAuth consent flow ----
+    await step(prompter, log, "Step 4 of 6 — authorize Gmail access", async () => {
+      const gmail = new GmailClient(config, { log });
+      const credsChanged =
+        config.googleClientId !== startingClientId ||
+        config.gmailAddress !== startingGmailAddress;
+      if (gmail.hasToken() && !credsChanged) {
+        // Only offer to reuse if the existing token was actually verifiable
+        // against the configured account. Otherwise force re-consent.
+        const ok = await tryVerifyExistingToken(gmail, config, log);
+        if (ok) {
+          const reuse = await prompter.confirm(
+            "An existing valid token was found. Skip re-authorization?", { default: true });
+          if (reuse) {
+            log.success("kept existing token");
+            return;
+          }
+        } else {
+          log.say(dim("  existing token is invalid or mismatched — re-authorizing"));
+        }
+      } else if (gmail.hasToken() && credsChanged) {
+        log.say(dim("  credentials changed since last run — re-authorizing"));
+        deleteToken(gmail.tokenPath, log);
+      }
+      log.say("A browser window will open. Sign in as " + bold(config.gmailAddress) + ".");
+      log.say("If you see \"This app isn't verified\" → Advanced → Go to <app> (unsafe).");
+      log.say("");
+      const tok = await runConsent({
+        clientId: config.googleClientId,
+        clientSecret: config.googleClientSecret,
+        gmailAddress: config.gmailAddress,
+        log,
+      });
+
+      // Verify the token belongs to the right account BEFORE persisting it.
+      // We have to construct a temporary client that reads from memory rather
+      // than from disk; simplest is to write to a temp path, verify, then
+      // promote on success.
+      const verifyClient = new GmailClient(config, { log });
+      verifyClient._cachedToken = tok.access_token;
+      verifyClient._cachedExpiry = Date.now() + (tok.expires_in || 3600) * 1000;
+      const prof = await verifyClient.profile();
+      if (prof.emailAddress?.toLowerCase() !== config.gmailAddress.toLowerCase()) {
+        throw new Error(
+          `signed in as ${prof.emailAddress} but config says ${config.gmailAddress}. ` +
+          `Revoke at https://myaccount.google.com/permissions and retry, or run --setup again ` +
+          `and update the configured Gmail address.`,
+        );
+      }
+      // Verified — now it's safe to write.
+      gmail.saveToken(tok);
+      log.success(`token saved (scopes: ${tok.scope})`);
+      log.success(`authenticated as ${prof.emailAddress}`);
+    });
+
+    // ---- Step 5: test print ----
+    await step(prompter, log, "Step 5 of 6 — test print", async () => {
+      if (!isWindows()) {
+        log.say("Skipping test print: not on Windows.");
+        return;
+      }
+      const doIt = await prompter.confirm(
+        `Print a one-page test to "${config.printerName}" now?`, { default: true });
+      if (!doIt) {
+        log.say(dim("  skipped"));
+        return;
+      }
+      log.say("Sending test page... (this can take a few seconds)");
+      await testPrint(config, { log });
+      const ok = await prompter.confirm("Did the page come out of the printer?", { default: true });
+      if (!ok) {
+        throw new Error("test page didn't print. Check the printer is on, has paper, and isn't in an error state.");
+      }
+      log.success("printer works");
+    }, { allowSkip: true });
+
+    // ---- Step 6: install scheduled task ----
+    await step(prompter, log, "Step 6 of 6 — install scheduled task", async () => {
+      if (!isWindows()) {
+        log.say("Skipping: scheduled tasks are Windows-only.");
+        return;
+      }
+      if (await taskExists()) {
+        const replace = await prompter.confirm(
+          "A 'mailpress' scheduled task already exists. Re-install it?", { default: true });
+        if (!replace) {
+          log.success("kept existing scheduled task");
+          return;
+        }
+      } else {
+        const install = await prompter.confirm(
+          "Install mailpress as a Windows Scheduled Task (runs at login, restarts on failure)?",
+          { default: true });
+        if (!install) {
+          log.say(dim("  skipped. You can run mailpress manually with `mailpress.exe` or install later."));
+          return;
+        }
+      }
+      const out = await installTask();
+      log.debug("installTask output:", out);
+      log.success("scheduled task installed and started");
+    }, { allowSkip: true });
+
+    // ---- Done ----
+    log.heading("Setup complete");
+    const errors = validateConfig(config);
+    if (errors.length) {
+      log.failure("config still has issues: " + errors.join("; "));
+    } else {
+      log.success("config saved to " + dim("config.local.json"));
+      log.success("token saved (gitignored)");
+      log.say("");
+      log.say("mailpress is now polling your inbox in the background.");
+      log.say("Useful commands:");
+      log.say(dim("  mailpress --doctor   ") + "— re-run all health checks");
+      log.say(dim("  mailpress --test     ") + "— switch printer, test print any file");
+      log.say(dim("  mailpress --once     ") + "— process current unread and exit");
+      log.say(dim("  mailpress --setup    ") + "— re-run this wizard");
+    }
+  } finally {
+    prompter.close();
+  }
+}
diff --git a/package.json b/package.json
index 9ba414c..4f5252d 100644
--- a/package.json
+++ b/package.json
@@ -1,15 +1,26 @@
 {
   "name": "mailpress",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "private": true,
   "type": "module",
   "description": "Polls a Gmail inbox, prints every email body + attachments on a wired office printer.",
+  "bin": {
+    "mailpress": "./cli.mjs"
+  },
   "scripts": {
-    "consent": "node consent.mjs",
-    "start": "node index.mjs",
-    "once": "node index.mjs --once"
+    "start": "node cli.mjs",
+    "setup": "node cli.mjs --setup",
+    "consent": "node cli.mjs --consent",
+    "doctor": "node cli.mjs --doctor",
+    "once": "node cli.mjs --once",
+    "build": "node scripts/build.mjs"
   },
   "engines": {
     "node": ">=18"
+  },
+  "devDependencies": {
+    "esbuild": "^0.25.0",
+    "postject": "^1.0.0-alpha.6",
+    "resedit": "^3.0.0"
   }
 }
diff --git a/print-files.ps1 b/print-files.ps1
index cc6de80..0d16a49 100644
--- a/print-files.ps1
+++ b/print-files.ps1
@@ -26,10 +26,21 @@
 
 param(
   [Parameter(Mandatory=$true)] [string] $PrinterName,
-  [Parameter(Mandatory=$true)] [string[]] $Files,
+  [string[]] $Files,
+  # Pipe-delimited list ("a|b|c"). Used by mailpress because '|' is illegal
+  # in Windows filenames, so it survives any reasonable attachment name.
+  [string] $FilesDelimited,
   [int] $SleepMs = 3000
 )
 
+if (-not $Files -and $FilesDelimited) {
+  $Files = $FilesDelimited -split '\|'
+}
+if (-not $Files -or $Files.Count -eq 0) {
+  Write-Error "Either -Files or -FilesDelimited is required."
+  exit 2
+}
+
 $ErrorActionPreference = "Stop"
 
 function Write-Log($msg) {
diff --git a/scripts/build.mjs b/scripts/build.mjs
new file mode 100644
index 0000000..c909ae3
--- /dev/null
+++ b/scripts/build.mjs
@@ -0,0 +1,202 @@
+#!/usr/bin/env node
+// Build mailpress.exe using Node's Single Executable Applications feature.
+//
+// Steps:
+//   1. Bundle cli.mjs + lib/*.mjs into a single CommonJS bundle (esbuild).
+//   2. Generate the SEA preparation blob.
+//   3. Copy the platform's node binary to dist/mailpress(.exe).
+//   4. Inject the blob via postject.
+//   5. Copy runtime assets (print-files.ps1, config.example.json) next to it.
+//
+// Run on Windows for a real .exe. On Linux/macOS this still produces a
+// working binary for that platform (useful for testing the CLI plumbing
+// even though the printer code is Windows-only).
+//
+// Prereqs: Node >= 20.12, `npx esbuild`, `npx postject`. The script will
+// `npm install --no-save` them on demand if missing.
+
+import { execSync } from "node:child_process";
+import { existsSync, mkdirSync, copyFileSync, readFileSync, writeFileSync, rmSync, chmodSync } from "node:fs";
+// readFileSync/writeFileSync used by embedIcon below.
+import { join, resolve, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { platform } from "node:os";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const ROOT = resolve(HERE, "..");
+const DIST = join(ROOT, "dist");
+const BUNDLE = join(DIST, "mailpress.cjs");
+const SEA_CONFIG = join(DIST, "sea-config.json");
+const BLOB = join(DIST, "sea-prep.blob");
+const IS_WIN = platform() === "win32";
+const EXE_NAME = IS_WIN ? "mailpress.exe" : "mailpress";
+const EXE = join(DIST, EXE_NAME);
+
+function run(cmd, opts = {}) {
+  console.log(`$ ${cmd}`);
+  execSync(cmd, { stdio: "inherit", cwd: ROOT, ...opts });
+}
+
+function ensureTool(pkg, binFlag = "--version") {
+  try {
+    execSync(`npx --no-install ${pkg} ${binFlag}`, { stdio: "ignore" });
+    return;
+  } catch { /* not installed */ }
+  console.log(`Installing ${pkg}...`);
+  run(`npm install --no-save ${pkg}`);
+}
+
+function checkNodeVersion() {
+  const [maj, min] = process.versions.node.split(".").map(Number);
+  if (maj < 20 || (maj === 20 && min < 12)) {
+    throw new Error(`Node ${process.versions.node} is too old for stable SEA. Need >= 20.12.`);
+  }
+}
+
+function clean() {
+  if (existsSync(DIST)) rmSync(DIST, { recursive: true, force: true });
+  mkdirSync(DIST, { recursive: true });
+}
+
+function bundle() {
+  ensureTool("esbuild");
+  // SEA requires CommonJS. Bundle the CLI entry into a single CJS file.
+  // External: none — we want everything inlined.
+  run(
+    `npx esbuild cli.mjs ` +
+    `--bundle --platform=node --format=cjs --target=node20 ` +
+    `--outfile="${BUNDLE}" ` +
+    `--legal-comments=none --log-level=warning`,
+  );
+}
+
+function writeSeaConfig() {
+  const conf = {
+    main: BUNDLE,
+    output: BLOB,
+    disableExperimentalSEAWarning: true,
+    useSnapshot: false,
+    useCodeCache: true,
+    assets: {},
+  };
+  writeFileSync(SEA_CONFIG, JSON.stringify(conf, null, 2));
+}
+
+function generateBlob() {
+  run(`node --experimental-sea-config "${SEA_CONFIG}"`);
+}
+
+function copyNode() {
+  copyFileSync(process.execPath, EXE);
+  try { chmodSync(EXE, 0o755); } catch { /* */ }
+}
+
+function inject() {
+  ensureTool("postject");
+  const sentinel = "NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2";
+  // --macho-segment-name is only needed on macOS.
+  const extra = platform() === "darwin" ? "--macho-segment-name NODE_SEA" : "";
+  run(
+    `npx postject "${EXE}" NODE_SEA_BLOB "${BLOB}" ` +
+    `--sentinel-fuse ${sentinel} ${extra}`,
+  );
+}
+
+// Embed an icon + version metadata into the Windows .exe via resedit.
+// Skipped on non-Windows because non-PE binaries have no icon resource.
+async function embedIcon() {
+  if (!IS_WIN) {
+    console.log("Skipping icon embed (not building a Windows .exe)");
+    return;
+  }
+  const iconPath = join(ROOT, "assets", "icon.ico");
+  if (!existsSync(iconPath)) {
+    console.warn(`assets/icon.ico missing — exe will keep node's default icon`);
+    return;
+  }
+  ensureTool("resedit");
+  const { NtExecutable, NtExecutableResource, Resource, Data } = await import("resedit");
+  const exeBuf = readFileSync(EXE);
+  // Node's official Windows binary is code-signed. resedit refuses to parse
+  // signed PE files by default; we have to opt in. Embedding an icon
+  // invalidates the signature anyway, and postject has already done the
+  // same to inject the SEA blob, so the binary is unsigned end-to-end.
+  const exe = NtExecutable.from(exeBuf, { ignoreCert: true });
+  const res = NtExecutableResource.from(exe);
+
+  const iconFile = Data.IconFile.from(readFileSync(iconPath));
+  Resource.IconGroupEntry.replaceIconsForResource(
+    res.entries,
+    1, // icon group resource id
+    1033, // en-US language id
+    iconFile.icons.map((i) => i.data),
+  );
+
+  const versionInfo = Resource.VersionInfo.createEmpty();
+  versionInfo.setFileVersion(0, 2, 0, 0);
+  versionInfo.setProductVersion(0, 2, 0, 0);
+  versionInfo.setStringValues(
+    { lang: 1033, codepage: 1200 },
+    {
+      ProductName: "mailpress",
+      FileDescription: "Gmail-to-printer relay",
+      CompanyName: "mailpress",
+      LegalCopyright: "",
+      OriginalFilename: "mailpress.exe",
+    },
+  );
+  versionInfo.outputToResourceEntries(res.entries);
+
+  res.outputResource(exe);
+  writeFileSync(EXE, Buffer.from(exe.generate()));
+  console.log("Embedded icon + version metadata");
+}
+
+function copyAssets() {
+  const assets = ["print-files.ps1", "config.example.json", "install-task.ps1"];
+  for (const a of assets) {
+    const src = join(ROOT, a);
+    if (existsSync(src)) {
+      copyFileSync(src, join(DIST, a));
+    } else {
+      console.warn(`asset missing, skipping: ${a}`);
+    }
+  }
+  // The icon is embedded in the exe; also drop a copy beside it for users
+  // who want a desktop shortcut with a matching icon.
+  const ico = join(ROOT, "assets", "icon.ico");
+  if (existsSync(ico)) copyFileSync(ico, join(DIST, "mailpress.ico"));
+}
+
+function smokeTest() {
+  console.log("\nSmoke testing --help...");
+  try {
+    execSync(`"${EXE}" --help`, { stdio: "inherit", cwd: DIST });
+    execSync(`"${EXE}" --version`, { stdio: "inherit", cwd: DIST });
+  } catch (e) {
+    throw new Error(`smoke test failed: ${e.message}`);
+  }
+}
+
+async function main() {
+  checkNodeVersion();
+  console.log(`Building mailpress for ${platform()} (node ${process.versions.node})`);
+  clean();
+  bundle();
+  writeSeaConfig();
+  generateBlob();
+  copyNode();
+  inject();
+  await embedIcon();
+  copyAssets();
+  smokeTest();
+  console.log(`\nDone. Artifacts in ${DIST}:`);
+  for (const f of [EXE_NAME, "print-files.ps1", "install-task.ps1", "config.example.json"]) {
+    if (existsSync(join(DIST, f))) console.log(`  ${f}`);
+  }
+}
+
+main().catch((e) => {
+  console.error("Build failed:", e.message);
+  process.exit(1);
+});