Mail logs at midnight:

learnFromUserMail: learning start
learnFromUserMail: learning from mailbox ...            (6 mailboxes)
learnFromUserMail: learning as ham: /app/data/vmail/<user>/mail/cur/...,S=21845327,...
node:events:487
      throw er; // Unhandled 'error' event
Error: write EPIPE
    at WriteWrap.onWriteComplete [as oncomplete] (node:internal/stream_base_commons:87:19)
Node.js v24.19.0
WARN exited: mail-service (exit status 1; not expected)
INFO reaped unknown pid 11009 (exit status 98)
INFO spawned: 'mail-service' with pid 11010

"learning done" is never logged, all mailboxes after that one are never trained, and no summary
event is written.

Cause, as far as I can tell:

• spamcLearn() in /app/code/spamd.js pipes the whole file to spamc through
  shell.execFileWithInput().
• spamc's default --max-size is 500 KB. For a bigger message it exits immediately with 98
  (EX_TOOBIG), before even connecting to spamd.
• The rest of the write to child.stdin then fails with EPIPE. execFileWithInput() in
  /app/code/shell.js has no 'error' listener on child.stdin, so this becomes an uncaught
  exception that kills mail-service.
• Candidates are the last 3 days of mail (LEARN_DAYS), so any message with an attachment

  500 KB is enough to trigger it, which in practice means every night.

Reproduction inside the mail container, against a closed port so nothing is actually learned:

spamc -p 1 -u test@invalid --learntype ham < small.eml ; echo $?   # 69 (tries to connect)
spamc -p 1 -u test@invalid --learntype ham < 2MB.eml   ; echo $?   # 98 (too big, exits at once)

A small Node script doing execFile('spamc', ) followed by child.stdin.end(<2 MB buffer>)
dies with the same "Unhandled 'error' event / write EPIPE".

Possible fixes, either would do:

• in execFileWithInput(), add child.stdin.on('error', () => {}) so the failure is reported by
  the execFile callback instead of crashing the process;
• in findMailFiles(), skip files above spamc's max size (e.g. find -size -500k), or treat
  exit code 98 as "skipped" rather than as a failure.

Thanks!