fix: say the directory can't be browsed instead of that a refresh failed when the server lists only the people you know

components/contacts/__tests__/directory-picker-dialog.test.tsx

@@ -98,4 +98,14 @@ describe('DirectoryPickerDialog', () => {
     expect(rows()).toHaveLength(2);
     expect(screen.getByRole('alert')).toHaveTextContent('refresh_failed');
   });
+
+  // Stalwart 1.0 with directory queries off: the listing holds the principals
+  // the user knows (their own, their groups), and nothing failed.
+  it('says the directory is not browsable when it lists only the principals the user knows', () => {
+    setDirectory(people(1), 'forbidden');
+    render(<DirectoryPickerDialog client={client} onClose={vi.fn()} onAdd={vi.fn()} />);
+    expect(rows()).toHaveLength(1);
+    expect(screen.getByRole('status')).toHaveTextContent('forbidden_hint');
+    expect(screen.queryByText('refresh_failed')).not.toBeInTheDocument();
+  });
 });

components/contacts/directory-browser.tsx

@@ -187,9 +187,14 @@ export function DirectoryBrowser({
             <RefreshCw className={cn("w-4 h-4", status === "loading" && "animate-spin")} />
           </button>
         </div>
-        {entries.length > 0 && (status === "error" || status === "forbidden") && (
+        {entries.length > 0 && status === "error" && (
           <p role="alert" className="mt-2 text-xs text-destructive">{t("refresh_failed")}</p>
         )}
+        {/* A refused listing (Stalwart 1.0 with directory queries off) still
+            holds the principals the user knows; nothing failed to refresh. */}
+        {entries.length > 0 && status === "forbidden" && (
+          <p role="status" className="mt-2 text-xs text-muted-foreground">{t("forbidden_hint")}</p>
+        )}
       </div>
 
       <div className="flex-1 min-h-0 overflow-y-auto" role="list" aria-label={t("title")}>