Thank you for your help, Timo.
use Dovecot v2.0's dsync
I gather from your reply that it's OK to use Dovecot 2.0 utilities (eg dsync) on a dovecot (v1) installation; presumably with its own configuration file(s).
You could set mail_drop_priv_before_exec=yes ... chgrp vmail ...
Yes, I think we could do that; I should have thought of it myself, thanks again.
I think there was one other problem with the automatic conversion which I've now remembered: I note that the first time a user connects to th eimap service dovecot creates their (virtual) home directory for them with all the right permissions. That's great and I use the existence of that directory as an indication to our MTA that the user wants delivery into the dovecot store rather than their old system mailbox. However once I tried using the convert plugin the process fails because (it seems) the conversion tries to take place before the home directory has been created.
Is there any configuration change that might change this order?
Can I configure the convert plugin on LDA delivery, for example, instead of as part of the "protocol imap" section?
Many thanks, Steve Platt