This server starts in the authenticated state (RFC2060 3.2), but accepts the LOGIN command while in that state with *any* username and password and always returns success. This is for compatability with clients that do not understand the PREAUTH greeting connections.
The uidlist file this server uses is the same format as dovecot's V3 uidlist files. The locking mechanism, however, is different. A POSIX fcntl advisory read lock MUST be acquired on uidlist.lock before reading uidlist. A POSIX fcntl advisory write lock MUST be acquired on uidlist.lock before beginning the process of writing out to a temp file and then renaming said temp file overtop of uidlist. This is to keep UIDs in sync across newly starting and concurrently running processes, so long as those processes are also monitoring for new mail with inotify (renames and deletes may be tracked, but will not affect the UIDs being in sync). The uidlist file is rewritten on every update to keep newly-starting processes in sync with already-running processes (though, again, likely the file only needs to be rewritten on new mail, as renames and deletes do not affect UIDs).