@bobfrankston/mailx 1.0.437 → 1.0.439

package/packages/mailx-imap/index.js

@@ -145,9 +145,11 @@ export class ImapManager extends EventEmitter {
     inboxSyncing = false;
     /** Use native IMAP client instead of imapflow. Set to true to enable. */
     useNativeClient = false;
-    /** Accounts hitting connection limits — back off until this time */
-    connectionBackoff = new Map();
-    // Connection management: see withConnection() below — no semaphore needed
+    // Connection management: see withConnection() below.
+    // Cap-hit backoff machinery removed — bounded per-account concurrency
+    // (one ops socket + one IDLE socket) keeps mailx well under any
+    // reasonable server cap, so the recovery timer was dead weight that
+    // mostly served to lock the UI for minutes after a transient failure.
     /** Per-account health counters. Incremented when the server misbehaves
      *  in ways that suggest a problem the user should know about (inactivity
      *  timeouts, connection-cap hits, rate-limit waits). Surfaced via a
@@ -258,68 +260,51 @@ export class ImapManager extends EventEmitter {
     }
     /** Delete a message directly on the IMAP server (for stuck outbox messages not in local DB) */
     async deleteOnServer(accountId, folderPath, uid) {
-        const client = this.createClient(accountId, "delete-server");
-        try {
+        return this.withConnection(accountId, async (client) => {
             await client.deleteMessageByUid(folderPath, uid);
             console.log(`  Deleted UID ${uid} from ${folderPath} on server`);
-        }
-        finally {
-            try {
-                await client.logout();
-            }
-            catch { /* ignore */ }
-        }
+        });
     }
     /** Search messages on the IMAP server — returns matching UIDs */
     async searchOnServer(accountId, mailboxPath, criteria) {
-        const client = this.createClient(accountId);
-        try {
+        return this.withConnection(accountId, async (client) => {
             return await client.searchMessages(mailboxPath, criteria);
-        }
-        finally {
-            try {
-                await client.logout();
-            }
-            catch { /* ignore */ }
-        }
+        });
     }
     /** Server-side search that also materializes any UIDs we don't yet have
      *  locally. Returns the full result after upsert, so the caller can
-     *  render hits that fall outside the history window. */
+     *  render hits that fall outside the history window. The fetch loop
+     *  can be long for big hit-sets, so this runs on the slow lane and
+     *  yields between chunks (each chunk is a separate withConnection)
+     *  so an interactive body fetch can interleave. */
     async searchAndFetchOnServer(accountId, folderId, mailboxPath, criteria) {
-        const client = this.createClient(accountId);
-        try {
-            const uids = await client.searchMessages(mailboxPath, criteria);
-            if (uids.length === 0)
-                return [];
-            const have = new Set(this.db.getUidsForFolder(accountId, folderId));
-            const missing = uids.filter(u => !have.has(u));
-            if (missing.length > 0) {
-                // Fetch in chunks so a large hit-set doesn't over-long a single command.
-                const folder = this.db.getFolders(accountId).find(f => f.id === folderId);
-                if (folder) {
-                    const CHUNK = 500;
-                    for (let i = 0; i < missing.length; i += CHUNK) {
-                        const range = missing.slice(i, i + CHUNK).join(",");
+        const uids = await this.withConnection(accountId, async (client) => {
+            return await client.searchMessages(mailboxPath, criteria);
+        });
+        if (uids.length === 0)
+            return [];
+        const have = new Set(this.db.getUidsForFolder(accountId, folderId));
+        const missing = uids.filter(u => !have.has(u));
+        if (missing.length > 0) {
+            const folder = this.db.getFolders(accountId).find(f => f.id === folderId);
+            if (folder) {
+                const CHUNK = 500;
+                for (let i = 0; i < missing.length; i += CHUNK) {
+                    const range = missing.slice(i, i + CHUNK).join(",");
+                    await this.withConnection(accountId, async (client) => {
                         const fetched = await client.fetchMessages(mailboxPath, range, { source: false });
                         if (fetched?.length) {
                             await this.storeMessages(accountId, folderId, folder, fetched, 0);
                         }
-                    }
-                    this.db.recalcFolderCounts(folderId);
+                    }, { slow: true });
                 }
+                this.db.recalcFolderCounts(folderId);
             }
-            return uids;
-        }
-        finally {
-            try {
-                await client.logout();
-            }
-            catch { /* ignore */ }
         }
+        return uids;
     }
     /** Create a fresh IMAP client for an account (public access for API endpoints) */
-    createPublicClient(accountId) {
+    async createPublicClient(accountId) {
         return this.createClient(accountId);
     }
     // Legacy fallback disabled — was doubling connections without helping.
@@ -329,18 +314,23 @@ export class ImapManager extends EventEmitter {
     // All operations on an account are serialized through an operation queue.
     // No semaphore, no pool, no per-operation connect/disconnect.
     // IDLE uses a separate connection (see startWatching).
-    /** Persistent operational connections — one per account, reused for all operations */
+    /** Persistent operational connections — one per account, reused for all operations.
+     *  Body fetch, sync, prefetch, outbox-append, flag/move all serialize through
+     *  this single client per account via withConnection(). The priority lane
+     *  in the queue lets interactive clicks jump ahead of background prefetch. */
     opsClients = new Map();
-    /** Operation queues — ensures sequential access per account */
+    /** Two-lane operation queue per account — interactive ops (body fetch on
+     *  click, flag toggle) drain before background ops (sync, prefetch). FIFO
+     *  within each lane. The single ops connection means there's never a race
+     *  on which folder is SELECTed; commands run strictly sequentially. */
     opsQueues = new Map();
-    /** Persistent body-fetch connections — separate from ops so on-demand
-     *  body reads never queue behind a slow sync operation (bobma's IMAP
-     *  SEARCH can sit idle for 300s during backfill). */
-    bodyClients = new Map();
-    /** Per-account backoff after the IMAP server rejected a connection with
-     *  the per-user+IP cap (Dovecot mail_max_userip_connections). Subsequent
-     *  body fetches short-circuit until the timestamp passes. */
-    bodyBackoff = new Map();
+    /** Per-host semaphore — caps simultaneous IMAP socket opens to one server.
+     *  Defensive guardrail: with the single-ops-per-account model an individual
+     *  user's mailx never hits more than (#accounts × 2) sockets per host, well
+     *  under any reasonable server cap. Exists for the multi-account-on-one-host
+     *  case (e.g. bobma + bobma2 both on imap.iecc.com). */
+    hostSemaphores = new Map();
+    static HOST_PERMITS = 4;
     /** Get (or create) the persistent operational connection for an account.
      *  logout() is wrapped as a no-op so legacy callers don't close it. */
     async getOpsClient(accountId) {
@@ -364,7 +354,7 @@ export class ImapManager extends EventEmitter {
             console.log(`  [conn] ${accountId}: stale ops client detected in getOpsClient — reconnecting`);
             client = undefined;
         }
-        client = this.newClient(accountId, "ops");
+        client = await this.newClient(accountId, "ops");
         // Wrap logout as no-op — this is a persistent connection. The
         // newClient wrapper's close-counter runs on `_realLogout`.
         const realLogout = client.logout.bind(client);
@@ -374,63 +364,124 @@ export class ImapManager extends EventEmitter {
         return client;
     }
     /** Run an operation on the account's connection — queued, sequential, no concurrency */
-    async withConnection(accountId, fn) {
-        const prev = this.opsQueues.get(accountId) || Promise.resolve();
-        const next = prev.then(async () => {
-            try {
-                const client = await this.getOpsClient(accountId);
-                return await fn(client);
-            }
-            catch (e) {
-                // Connection broken — discard it so next operation reconnects
-                const stale = this.opsClients.get(accountId);
-                this.opsClients.delete(accountId);
-                if (stale) {
-                    try {
-                        await stale.logout();
-                    }
-                    catch { /* */ }
+    /** Run an operation against the account's single ops connection. Tasks
+     *  queue strictly sequentially per account — only one IMAP command in
+     *  flight at a time. This eliminates the SELECT-races and "stale client
+     *  recovery" paths the old multi-client design needed.
+     *
+     *  Default lane is `fast` — covers virtually everything (body fetch,
+     *  flag toggle, move, incremental sync). Pass `slow: true` only for
+     *  operations the caller knows will take a long time and shouldn't
+     *  block the user (multi-folder prefetch batches, large backfills).
+     *  When both lanes have tasks, fast drains first.
+     *
+     *  Within a lane, FIFO. The running task always finishes — IMAP can't
+     *  preempt a command mid-flight. */
+    async withConnection(accountId, fn, opts = {}) {
+        let queue = this.opsQueues.get(accountId);
+        if (!queue) {
+            queue = { fast: [], slow: [], running: false };
+            this.opsQueues.set(accountId, queue);
+        }
+        return new Promise((resolve, reject) => {
+            const task = async () => {
+                try {
+                    const client = await this.getOpsClient(accountId);
+                    resolve(await fn(client));
                 }
-                throw e;
-            }
-        }, async () => {
-            // Previous operation failed — still try this one with a fresh connection
-            try {
-                const client = await this.getOpsClient(accountId);
-                return await fn(client);
-            }
-            catch (e) {
-                const stale = this.opsClients.get(accountId);
-                this.opsClients.delete(accountId);
-                if (stale) {
-                    try {
-                        await stale.logout();
+                catch (e) {
+                    // Discard client on any error — keeping a half-broken
+                    // socket poisoned every subsequent request.
+                    const stale = this.opsClients.get(accountId);
+                    this.opsClients.delete(accountId);
+                    if (stale) {
+                        try {
+                            await (stale._realLogout || stale.logout)();
+                        }
+                        catch { /* */ }
+                        try {
+                            stale.destroy?.();
+                        }
+                        catch { /* */ }
                     }
-                    catch { /* */ }
+                    reject(e);
                 }
-                throw e;
-            }
+            };
+            (opts.slow ? queue.slow : queue.fast).push(task);
+            this.drainOpsQueue(accountId);
+        });
+    }
+    /** Run the next queued task. Fast lane drains before slow.
+     *  Idempotent — safe to call after each task completes; the running
+     *  flag prevents reentrant draining. */
+    drainOpsQueue(accountId) {
+        const queue = this.opsQueues.get(accountId);
+        if (!queue || queue.running)
+            return;
+        const next = queue.fast.shift() || queue.slow.shift();
+        if (!next)
+            return;
+        queue.running = true;
+        next().finally(() => {
+            queue.running = false;
+            this.drainOpsQueue(accountId);
+        });
+    }
+    /** Acquire one slot of the per-host connection semaphore. Returns a release
+     *  function — call exactly once when the socket is closed. Used by
+     *  newClient to cap simultaneous IMAP connections to a single server
+     *  across all mailx accounts. */
+    acquireHostSlot(host) {
+        let sem = this.hostSemaphores.get(host);
+        if (!sem) {
+            sem = { permits: ImapManager.HOST_PERMITS, waiters: [] };
+            this.hostSemaphores.set(host, sem);
+        }
+        const semRef = sem;
+        return new Promise(resolve => {
+            const grant = () => {
+                semRef.permits--;
+                let released = false;
+                resolve(() => {
+                    if (released)
+                        return;
+                    released = true;
+                    semRef.permits++;
+                    const next = semRef.waiters.shift();
+                    if (next)
+                        next();
+                });
+            };
+            if (semRef.permits > 0)
+                grant();
+            else
+                semRef.waiters.push(grant);
         });
-        this.opsQueues.set(accountId, next.catch(() => { }));
-        return next;
     }
     /** Open IMAP clients per account, used to trace who's opening sockets
      *  when we hit the Dovecot per-user+IP connection cap. */
     openClients = new Map();
     /** Create a new IMAP client (internal — callers use getOpsClient or withConnection).
-     *  `purpose` is a short tag printed alongside the `[conn+]` log so we can tell
-     *  which code path (sync/idle/body/outbox/move/…) opened each connection. */
-    newClient(accountId, purpose = "?") {
+     *  Acquires one slot of the per-host semaphore before constructing the
+     *  client; the slot is released when logout() or destroy() runs.
+     *  `purpose` is a short tag printed alongside the `[conn+]` log so we can
+     *  tell which code path (ops/idle/etc.) opened each connection. */
+    async newClient(accountId, purpose = "?") {
         if (this.reauthenticating.has(accountId))
             throw new Error(`Account ${accountId} is re-authenticating`);
-        const backoffUntil = this.connectionBackoff.get(accountId);
-        if (backoffUntil && Date.now() < backoffUntil) {
-            throw new Error(`Account ${accountId} in connection backoff (${Math.round((backoffUntil - Date.now()) / 1000)}s remaining)`);
-        }
         const config = this.configs.get(accountId);
         if (!config)
             throw new Error(`No config for account ${accountId}`);
-        const client = new CompatImapClient(config, this.transportFactory);
+        const host = config.server || accountId;
+        const releaseHostSlot = await this.acquireHostSlot(host);
+        let client;
+        try {
+            client = new CompatImapClient(config, this.transportFactory);
+        }
+        catch (e) {
+            releaseHostSlot();
+            throw e;
+        }
         let open = this.openClients.get(accountId);
         if (!open) {
             open = new Set();
@@ -444,6 +495,7 @@ export class ImapManager extends EventEmitter {
                 return;
             closed = true;
             open.delete(client);
+            releaseHostSlot();
             console.log(`  [conn-] ${accountId} (${purpose}/${how}) — ${open.size} open`);
         };
         const origLogout = client.logout?.bind(client);
@@ -470,38 +522,10 @@ export class ImapManager extends EventEmitter {
         }
         return client;
     }
-    /** Get (or lazily create) the persistent body-fetch client. Separate from
-     *  the ops client so body reads never wait on a slow sync command. */
-    async getBodyClient(accountId) {
-        let client = this.bodyClients.get(accountId);
-        if (client)
-            return client;
-        client = this.newClient(accountId, "body");
-        const realLogout = client.logout.bind(client);
-        client.logout = async () => { };
-        client._realLogout = realLogout;
-        this.bodyClients.set(accountId, client);
-        return client;
-    }
-    /** Drop the body-fetch connection (e.g. after a socket error). */
-    async dropBodyClient(accountId) {
-        const client = this.bodyClients.get(accountId);
-        if (!client)
-            return;
-        this.bodyClients.delete(accountId);
-        try {
-            await (client._realLogout || client.logout)();
-        }
-        catch { /* */ }
-        try {
-            client.destroy?.();
-        }
-        catch { /* */ }
-    }
-    /** Force-close every pooled client for an account — ops, body, any
-     *  lingering ones in openClients. Used when the server reports its
-     *  connection cap is hit so our slot count drops to zero on the
-     *  server side before backoff expires. */
+    /** Force-close every IMAP socket for an account — ops + any lingering
+     *  ones in openClients (e.g. an IDLE watcher in flight). Used during
+     *  account removal and disconnectOps so the server's connection slots
+     *  free immediately rather than waiting for socket idle timeouts. */
     async closeAllClients(accountId) {
         const ops = this.opsClients.get(accountId);
         this.opsClients.delete(accountId);
@@ -515,18 +539,6 @@ export class ImapManager extends EventEmitter {
             }
             catch { /* */ }
         }
-        const body = this.bodyClients.get(accountId);
-        this.bodyClients.delete(accountId);
-        if (body) {
-            try {
-                await (body._realLogout || body.logout)();
-            }
-            catch { /* */ }
-            try {
-                body.destroy?.();
-            }
-            catch { /* */ }
-        }
         const open = this.openClients.get(accountId);
         if (open) {
             for (const c of Array.from(open)) {
@@ -561,14 +573,16 @@ export class ImapManager extends EventEmitter {
             console.log(`  [conn] ${accountId}: disconnected`);
         }
     }
-    /** Legacy API — callers that still create/destroy connections.
-     *  These return the persistent ops client. logout() is a no-op
-     *  (the connection stays alive for reuse). */
+    /** Legacy entry: returns the shared persistent ops client. Most callers
+     *  should be using `withConnection()` instead — that gives proper
+     *  queueing and lets fast operations jump ahead of slow ones. */
     async createClientWithLimit(accountId) {
         return this.getOpsClient(accountId);
     }
-    createClient(accountId, purpose = "misc") {
-        // Return a fresh disposable client (used by IDLE watcher and one-off operations)
+    /** Disposable fresh client — only used by the IDLE watcher, which holds
+     *  its own socket so the fast/slow ops queue isn't blocked by IDLE
+     *  parking the connection in a wait-for-server state. */
+    async createClient(accountId, purpose = "misc") {
         return this.newClient(accountId, purpose);
     }
     trackLogout(_accountId) { }
@@ -699,7 +713,7 @@ export class ImapManager extends EventEmitter {
     /** Sync folder list for an account */
     async syncFolders(accountId, client) {
         if (!client)
-            client = this.createClient(accountId);
+            client = await this.getOpsClient(accountId);
         this.emit("syncProgress", accountId, "folders", 0);
         const t0 = Date.now();
         console.log(`  [diag] ${accountId}: getFolderList starting...`);
@@ -831,7 +845,7 @@ export class ImapManager extends EventEmitter {
     /** Sync messages for a specific folder */
     async syncFolder(accountId, folderId, client) {
         if (!client)
-            client = this.createClient(accountId);
+            client = await this.getOpsClient(accountId);
         const prefetch = getPrefetch();
         const folders = this.db.getFolders(accountId);
         const folder = folders.find(f => f.id === folderId);
@@ -1503,20 +1517,13 @@ export class ImapManager extends EventEmitter {
         }
         console.log(`  [conn] ${accountId}: reconnecting`);
     }
-    /** Handle sync errors — classify and emit appropriate UI events */
+    /** Handle sync errors — classify and emit appropriate UI events.
+     *  The connection-cap branch was removed: with the unified ops queue +
+     *  per-host semaphore, mailx alone can't exceed the server cap. If the
+     *  cap *is* hit, that means another client (Thunderbird, phone, sibling
+     *  process) is holding slots — punishing mailx with a multi-minute
+     *  blackout doesn't help the user, the next sync tick will retry. */
     handleSyncError(accountId, errMsg) {
-        if (errMsg.includes("max_userip_connections") || errMsg.includes("Too many simultaneous")) {
-            // Dovecot connection cap hit. 60s was too short — the server
-            // tracks slots with a decay window, and mailx was racing right
-            // back into the cap every time. Extend to 5 min AND close all
-            // pooled clients so the server's count drops to zero. Also
-            // mark all of this account's folder-cooldowns so prefetch
-            // doesn't try to reopen during the backoff.
-            const BACKOFF_MS = 5 * 60_000;
-            this.connectionBackoff.set(accountId, Date.now() + BACKOFF_MS);
-            this.closeAllClients(accountId).catch(() => { });
-            console.warn(`  [conn] ${accountId}: server connection cap hit — closing all clients + ${BACKOFF_MS / 1000}s backoff`);
-        }
         const config = this.configs.get(accountId);
         const isOAuth = !!config?.tokenProvider;
         const isTransient = /timeout|ECONNREFUSED|ECONNRESET|ETIMEDOUT|ENETUNREACH|Too many/i.test(errMsg);
@@ -1669,7 +1676,7 @@ export class ImapManager extends EventEmitter {
         let client = null;
         try {
             await this.quickCheck(accountId, async () => {
-                client = this.newClient(accountId);
+                client = await this.newClient(accountId, "quickCheck");
                 return await client.getMessagesCount("INBOX");
             }, async (count, prev) => {
                 if (prev !== undefined)
@@ -1818,9 +1825,11 @@ export class ImapManager extends EventEmitter {
             if (this.watchers.has(accountId))
                 continue;
             try {
-                // IDLE uses createClient (not createClientWithLimit) — it's a persistent
-                // background connection that must NOT consume a semaphore slot
-                const watchClient = this.createClient(accountId);
+                // IDLE keeps its own dedicated socket — once the connection
+                // is parked in IDLE, it's unusable for any other command, so
+                // it can't share the ops queue. Counts against the per-host
+                // semaphore (one slot for the IDLE socket).
+                const watchClient = await this.createClient(accountId, "idle");
                 const stop = await watchClient.watchMailbox("INBOX", (newCount) => {
                     console.log(`  [idle] ${accountId}: ${newCount} new message(s)`);
                     // Fetch only the new UIDs — the heavyweight gap/reconcile
@@ -1849,10 +1858,6 @@ export class ImapManager extends EventEmitter {
         }
         this.watchers.clear();
     }
-    /** Per-account fetch queue — serializes body fetches so only one IMAP command runs at a time.
-     *  The persistent fetchClient can only handle one command at a time (IMAP protocol limitation). */
-    fetchQueues = new Map();
-    /** Serialize body fetch operations per account — prevents concurrent IMAP commands on same connection */
     /** Unlink the on-disk body file for a message by reading its `body_path`
      *  from the DB. Safe to call either before or after `db.deleteMessage`
      *  — read body_path first, store it, then unlink whenever. */
@@ -1865,23 +1870,22 @@ export class ImapManager extends EventEmitter {
         }
         catch { /* row already gone / file already gone — both fine */ }
     }
-    enqueueFetch(accountId, fn) {
-        const prev = this.fetchQueues.get(accountId) || Promise.resolve();
-        const next = prev.then(fn, fn); // run fn after previous completes (regardless of success/failure)
-        this.fetchQueues.set(accountId, next);
-        return next;
-    }
-    // Body fetch uses withConnection — no separate client needed
     /** Fetch a single message body on demand, caching in the store.
-     *  Uses its own fresh connection — never blocked by background prefetch. */
+     *
+     *  Cache lookup is folder-agnostic: when a UID exists in multiple folders
+     *  (Gmail labels, copy-instead-of-move) the prefetcher may have populated
+     *  body_path on only one row. Looking up by (account, uid) without the
+     *  folder filter finds the cached `.eml` regardless of which folder
+     *  context the UI passed.
+     *
+     *  Server fetch goes through the unified ops queue on the fast lane —
+     *  the user clicked, they're waiting, this jumps ahead of any background
+     *  prefetch sitting in the slow lane. */
     async fetchMessageBody(accountId, folderId, uid) {
-        // Already cached? Read the DB row's `body_path` and check the file
-        // exists there. No more `(folderId, uid)` path reconstruction — that
-        // was the source of the S49 comingling bug (UID reuse + folder move
-        // pointing two messages at one file). `body_path` is the sole
-        // authority on where a given message's body lives on disk.
         const envelope = this.db.getMessageByUid(accountId, uid, folderId);
-        const storedPath = envelope?.bodyPath || "";
+        let storedPath = envelope?.bodyPath || "";
+        if (!storedPath)
+            storedPath = this.db.getMessageBodyPath(accountId, uid) || "";
         if (storedPath && await this.bodyStore.hasByPath(storedPath)) {
             return this.bodyStore.readByPath(storedPath);
         }
@@ -1890,102 +1894,35 @@ export class ImapManager extends EventEmitter {
         const folder = this.db.getFolders(accountId).find(f => f.id === folderId);
         if (!folder)
             return null;
-        // Gmail: use API for body fetch (no IMAP connection needed)
+        // Gmail: REST API, no IMAP connection involved.
         if (this.isGmailAccount(accountId)) {
             return this.fetchMessageBodyViaApi(accountId, folderId, uid, folder.path);
         }
-        // IMAP: use the persistent body-fetch client (separate from ops so we
-        // don't wait behind a slow sync command), serialized via enqueueFetch
-        // so overlapping requests share one socket instead of spawning fresh
-        // ones and blowing past the Dovecot connection cap.
-        return this.enqueueFetch(accountId, async () => {
-            // Cap-error backoff: when Dovecot has rejected us recently with
-            // "Maximum number of connections", short-circuit instead of
-            // queueing every body request behind a doomed login attempt.
-            const backoffUntil = this.bodyBackoff.get(accountId) || 0;
-            if (backoffUntil > Date.now()) {
-                const wait = Math.round((backoffUntil - Date.now()) / 1000);
-                console.warn(`  Body fetch (${accountId}/${uid}) skipped — server connection cap, retry in ${wait}s`);
-                return null;
-            }
-            const attempt = async () => {
-                const client = await this.getBodyClient(accountId);
+        // IMAP: fast lane on the ops queue. One try; if the socket is stale,
+        // withConnection's discard-on-error logic drops the client so the
+        // next attempt (caller-driven retry) gets a fresh one.
+        try {
+            const raw = await this.withConnection(accountId, async (client) => {
                 const msg = await client.fetchMessageByUid(folder.path, uid, { source: true });
                 if (!msg)
                     throw makeNotFoundError(accountId, folderId, uid);
                 if (!msg.source)
                     return null;
                 return Buffer.from(msg.source, "utf-8");
-            };
-            const classify = (msg) => ({
-                staleSocket: /Not connected|ECONNRESET|socket hang up|EPIPE|write after end|ended|closed/i.test(msg),
-                connCap: /UNAVAILABLE|Maximum number of connections|too many connections/i.test(msg),
             });
-            let raw;
-            try {
-                raw = await attempt();
-            }
-            catch (e) {
-                if (e?.isNotFound)
-                    throw e;
-                const msg = e?.message || "";
-                const { staleSocket, connCap } = classify(msg);
-                // Always drop the cached client on any failure — keeping a
-                // half-broken client poisoned every subsequent request.
-                await this.dropBodyClient(accountId);
-                if (connCap) {
-                    // The dedicated body socket is locked out by the server's
-                    // per-user+IP cap (something else holds the slots). Fall
-                    // back to the already-open ops connection — slower (queues
-                    // behind sync commands), but actually works.
-                    this.bodyBackoff.set(accountId, Date.now() + 30_000);
-                    console.warn(`  Body fetch (${accountId}/${uid}): connection cap — falling back to ops connection`);
-                    try {
-                        const fallbackRaw = await this.withConnection(accountId, async (client) => {
-                            const msg = await client.fetchMessageByUid(folder.path, uid, { source: true });
-                            if (!msg)
-                                throw makeNotFoundError(accountId, folderId, uid);
-                            if (!msg.source)
-                                return null;
-                            return Buffer.from(msg.source, "utf-8");
-                        });
-                        if (!fallbackRaw)
-                            return null;
-                        const bodyPath = await this.bodyStore.putMessage(accountId, folderId, uid, fallbackRaw);
-                        this.db.updateBodyPath(accountId, uid, bodyPath);
-                        this.emit("bodyCached", accountId, uid);
-                        return fallbackRaw;
-                    }
-                    catch (e3) {
-                        if (e3?.isNotFound)
-                            throw e3;
-                        console.error(`  Body fetch fallback failed (${accountId}/${uid}): ${e3?.message}`);
-                        return null;
-                    }
-                }
-                if (!staleSocket) {
-                    console.error(`  Body fetch error (${accountId}/${uid}): ${msg}`);
-                    return null;
-                }
-                // Stale socket — try once more with a fresh client.
-                try {
-                    raw = await attempt();
-                }
-                catch (e2) {
-                    if (e2?.isNotFound)
-                        throw e2;
-                    await this.dropBodyClient(accountId);
-                    console.error(`  Body fetch error (${accountId}/${uid}) after reconnect: ${e2?.message}`);
-                    return null;
-                }
-            }
             if (!raw)
                 return null;
             const bodyPath = await this.bodyStore.putMessage(accountId, folderId, uid, raw);
             this.db.updateBodyPath(accountId, uid, bodyPath);
             this.emit("bodyCached", accountId, uid);
             return raw;
-        });
+        }
+        catch (e) {
+            if (e?.isNotFound)
+                throw e;
+            console.error(`  Body fetch error (${accountId}/${uid}): ${e?.message || e}`);
+            return null;
+        }
     }
     /** Fetch message body via Gmail/Outlook API.
      *  Throws `MessageNotFoundError` when the server says the message is gone
@@ -2191,7 +2128,11 @@ export class ImapManager extends EventEmitter {
                 }
             }
             else {
-                // IMAP batch path: group by folder, one UID FETCH per folder.
+                // IMAP batch path: one UID FETCH per folder, each on its own
+                // turn through the slow lane. Yielding between folders is
+                // crucial — a click-to-view body should jump ahead of the
+                // next folder's batch via the fast lane, not wait for all
+                // folders to finish.
                 const byFolder = new Map();
                 for (const m of missing) {
                     let arr = byFolder.get(m.folderId);
@@ -2202,37 +2143,30 @@ export class ImapManager extends EventEmitter {
                     arr.push(m.uid);
                 }
                 const folders = this.db.getFolders(accountId);
-                let client = null;
-                try {
-                    client = await this.createClientWithLimit(accountId);
-                    // INBOX-first ordering so the folder the user actually looks at
-                    // gets its bodies even if a later folder eats the error budget.
-                    const orderedFolders = Array.from(byFolder.entries()).sort(([aid], [bid]) => {
-                        const af = folders.find(f => f.id === aid);
-                        const bf = folders.find(f => f.id === bid);
-                        const ai = af?.specialUse === "inbox" ? 0 : 1;
-                        const bi = bf?.specialUse === "inbox" ? 0 : 1;
-                        return ai - bi;
-                    });
-                    for (const [folderId, uids] of orderedFolders) {
-                        const folder = folders.find(f => f.id === folderId);
-                        if (!folder)
-                            continue;
-                        // Skip folders that have repeatedly timed out — keeps one
-                        // slow folder from burning the whole error budget and
-                        // starving the folder the user is actually looking at.
-                        if (this.shouldSkipFolder(accountId, folder.path)) {
-                            console.log(`  [prefetch] ${accountId}: skipping ${folder.path} (recent timeouts — cooling down)`);
-                            continue;
-                        }
-                        const received = new Set();
-                        // onBody fires synchronously as each message streams in from the server.
-                        // Disk/DB writes are kicked off fire-and-forget; we await them after the
-                        // batch command finishes. This keeps streaming throughput high while
-                        // still giving us a single await point for progress accounting.
-                        const pending = [];
-                        let batchSucceeded = false;
-                        try {
+                // INBOX-first ordering so the folder the user actually looks at
+                // gets its bodies even if a later folder eats the error budget.
+                const orderedFolders = Array.from(byFolder.entries()).sort(([aid], [bid]) => {
+                    const af = folders.find(f => f.id === aid);
+                    const bf = folders.find(f => f.id === bid);
+                    const ai = af?.specialUse === "inbox" ? 0 : 1;
+                    const bi = bf?.specialUse === "inbox" ? 0 : 1;
+                    return ai - bi;
+                });
+                for (const [folderId, uids] of orderedFolders) {
+                    const folder = folders.find(f => f.id === folderId);
+                    if (!folder)
+                        continue;
+                    if (this.shouldSkipFolder(accountId, folder.path)) {
+                        console.log(`  [prefetch] ${accountId}: skipping ${folder.path} (recent timeouts — cooling down)`);
+                        continue;
+                    }
+                    const received = new Set();
+                    let batchSucceeded = false;
+                    try {
+                        // Slow lane: prefetch is the textbook "this might take
+                        // a while" case — let interactive ops slip ahead.
+                        await this.withConnection(accountId, async (client) => {
+                            const pending = [];
                             await client.fetchBodiesBatch(folder.path, uids, (uid, source) => {
                                 received.add(uid);
                                 pending.push((async () => {
@@ -2245,57 +2179,38 @@ export class ImapManager extends EventEmitter {
                                         madeProgress = true;
                                     }
                                     catch (e) {
-                                        // EBUSY / disk error — non-fatal per message
                                         console.error(`  [prefetch] ${accountId}/${uid}: store write failed: ${e.message}`);
                                     }
                                 })());
                             });
-                            batchSucceeded = true;
-                            // Folder responded — clear its error history.
-                            this.clearFolderErrors(accountId, folder.path);
-                        }
-                        catch (e) {
-                            const msg = String(e?.message || "");
-                            console.error(`  [prefetch] ${accountId} folder ${folder.path}: batch fetch failed: ${msg}`);
-                            counters.errors++;
-                            this.recordFolderError(accountId, folder.path);
-                            // Server connection cap hit during prefetch — this is why
-                            // bobma log shows "100+ bodies to fetch" with no follow-up
-                            // "done": subsequent folders also hit the cap, burn the
-                            // budget, and nothing progresses. Route through the
-                            // sync-error handler so backoff + closeAllClients kick in.
-                            if (/max_userip_connections|Too many simultaneous/i.test(msg)) {
-                                this.handleSyncError(accountId, msg);
-                                break;
-                            }
-                            if (counters.errors >= ERROR_BUDGET)
-                                break;
-                        }
-                        await Promise.all(pending);
-                        // CRITICAL: only prune when the batch actually completed.
-                        // A thrown batch means NOTHING was received and we must
-                        // not treat absence-from-received as server-deletion.
-                        if (batchSucceeded)
-                            for (const uid of uids) {
-                                if (received.has(uid))
-                                    continue;
-                                try {
-                                    this.unlinkBodyFile(accountId, uid, folderId).catch(() => { });
-                                    this.db.deleteMessage(accountId, uid);
-                                    counters.deleted++;
-                                    madeProgress = true;
-                                }
-                                catch { /* ignore */ }
-                            }
+                            await Promise.all(pending);
+                        }, { slow: true });
+                        batchSucceeded = true;
+                        this.clearFolderErrors(accountId, folder.path);
                     }
-                }
-                finally {
-                    if (client) {
-                        try {
-                            await client.logout();
-                        }
-                        catch { /* ignore */ }
+                    catch (e) {
+                        const msg = String(e?.message || "");
+                        console.error(`  [prefetch] ${accountId} folder ${folder.path}: batch fetch failed: ${msg}`);
+                        counters.errors++;
+                        this.recordFolderError(accountId, folder.path);
+                        if (counters.errors >= ERROR_BUDGET)
+                            break;
                     }
+                    // CRITICAL: only prune when the batch actually completed.
+                    // A thrown batch means NOTHING was received; treating
+                    // absence as server-deletion lost 296 messages once.
+                    if (batchSucceeded)
+                        for (const uid of uids) {
+                            if (received.has(uid))
+                                continue;
+                            try {
+                                this.unlinkBodyFile(accountId, uid, folderId).catch(() => { });
+                                this.db.deleteMessage(accountId, uid);
+                                counters.deleted++;
+                                madeProgress = true;
+                            }
+                            catch { /* ignore */ }
+                        }
                 }
                 if (counters.errors >= ERROR_BUDGET) {
                     console.error(`  [prefetch] ${accountId}: stopping after ${counters.errors} errors (${counters.totalFetched} cached, ${counters.deleted} pruned)`);
@@ -2411,27 +2326,20 @@ export class ImapManager extends EventEmitter {
         const toFolder = toFolders.find(f => f.id === toFolderId);
         if (!toFolder)
             throw new Error(`Target folder ${toFolderId} not found`);
-        const sourceClient = this.createClient(fromAccountId);
-        const targetClient = this.createClient(toAccountId);
-        try {
-            const msg = await sourceClient.fetchMessageByUid(fromFolder.path, uid, { source: true });
-            if (!msg)
-                throw new Error(`Message UID ${uid} not found in ${fromFolder.path}`);
-            await sourceClient.moveMessageToServer(msg, fromFolder.path, targetClient, toFolder.path);
-            // Remove from local DB
-            this.db.deleteMessage(fromAccountId, uid);
-            console.log(`  Cross-account move: ${fromAccountId}/${fromFolder.path} UID ${uid} → ${toAccountId}/${toFolder.path}`);
-        }
-        finally {
-            try {
-                await sourceClient.logout();
-            }
-            catch { /* ignore */ }
-            try {
-                await targetClient.logout();
-            }
-            catch { /* ignore */ }
-        }
+        // Two accounts, two ops connections. Cross-account move is rare
+        // and requires both sockets to be live concurrently (we APPEND to
+        // target while still authenticated to source), so this can't fold
+        // into a single withConnection call.
+        await this.withConnection(fromAccountId, async (sourceClient) => {
+            await this.withConnection(toAccountId, async (targetClient) => {
+                const msg = await sourceClient.fetchMessageByUid(fromFolder.path, uid, { source: true });
+                if (!msg)
+                    throw new Error(`Message UID ${uid} not found in ${fromFolder.path}`);
+                await sourceClient.moveMessageToServer(msg, fromFolder.path, targetClient, toFolder.path);
+                this.db.deleteMessage(fromAccountId, uid);
+                console.log(`  Cross-account move: ${fromAccountId}/${fromFolder.path} UID ${uid} → ${toAccountId}/${toFolder.path}`);
+            });
+        });
     }
     /** Undelete — move from Trash back to original folder */
     async undeleteMessage(accountId, uid, originalFolderId) {
@@ -2676,17 +2584,10 @@ export class ImapManager extends EventEmitter {
             console.error(`  [sent] No Sent folder found for ${accountId}`);
             return;
         }
-        const client = this.createClient(accountId);
-        try {
+        await this.withConnection(accountId, async (client) => {
             await client.appendMessage(sent.path, rawMessage, ["\\Seen"]);
             console.log(`  [sent] Copied to ${sent.path}`);
-        }
-        finally {
-            try {
-                await client.logout();
-            }
-            catch { /* ignore */ }
-        }
+        });
     }
     /** Save a draft to the Drafts folder via IMAP APPEND.
      *  Returns the UID of the saved draft (for replacing on next save). */
@@ -2696,8 +2597,7 @@ export class ImapManager extends EventEmitter {
             console.error(`  [drafts] No Drafts folder found for ${accountId}`);
             return null;
         }
-        const client = this.createClient(accountId);
-        try {
+        return this.withConnection(accountId, async (client) => {
             // Delete previous draft — try UID first (fast path), and ALWAYS also try
             // searchByHeader(X-Mailx-Draft-ID) as a safety net. Running both catches
             // orphans from a crash-mid-save or a UID delete that failed silently.
@@ -2727,10 +2627,7 @@ export class ImapManager extends EventEmitter {
             }
             // Append new draft. If the server returns [TRYCREATE] (RFC 3501 §7.1),
             // the folder doesn't exist on the server even though mailx's DB has
-            // it — happens when the folder was never created, or when the local
-            // special-folder detection latched onto a path that doesn't match
-            // the server's actual name. Create it then retry. Logs the path so
-            // we can diagnose a mis-detected Drafts folder.
+            // it. Create it and retry once.
             let result;
             try {
                 result = await client.appendMessage(drafts.path, rawMessage, ["\\Draft", "\\Seen"]);
@@ -2743,7 +2640,6 @@ export class ImapManager extends EventEmitter {
                         await client.createmailbox(drafts.path);
                     }
                     catch (ce) {
-                        // "already exists" is benign; others we surface
                         if (!/already exists/i.test(String(ce?.message || ""))) {
                             console.error(`  [drafts] Folder create failed for "${drafts.path}": ${ce.message}`);
                         }
@@ -2754,16 +2650,9 @@ export class ImapManager extends EventEmitter {
                     throw e;
                 }
             }
-            // APPENDUID returns the UID directly; imapflow returns { destination, uid }
             const uid = typeof result === "number" ? result : result?.uid || null;
             return uid;
-        }
-        finally {
-            try {
-                await client.logout();
-            }
-            catch { /* ignore */ }
-        }
+        });
     }
     /** Delete a draft (or all drafts with a stable X-Mailx-Draft-ID) after successful send.
      *  Tries the specific UID first, then falls back to searchByHeader so orphaned copies
@@ -2774,8 +2663,7 @@ export class ImapManager extends EventEmitter {
             return;
         if (!draftUid && !draftId)
             return;
-        const client = this.createClient(accountId);
-        try {
+        await this.withConnection(accountId, async (client) => {
             if (draftUid) {
                 try {
                     await client.deleteMessageByUid(drafts.path, draftUid);
@@ -2801,13 +2689,7 @@ export class ImapManager extends EventEmitter {
                     console.error(`  [drafts] searchByHeader for ${draftId} failed: ${e.message}`);
                 }
             }
-        }
-        finally {
-            try {
-                await client.logout();
-            }
-            catch { /* ignore */ }
-        }
+        });
     }
     /** Queue outgoing message locally — never fails, worker handles IMAP+SMTP.
      *  Single path: write `~/.mailx/outbox/<acct>/*.ltr` synchronously, then
@@ -2994,20 +2876,14 @@ export class ImapManager extends EventEmitter {
         const existing = folders.find(f => f.path.toLowerCase() === "outbox");
         if (existing)
             return existing.path;
-        // Create it
-        const client = this.createClient(accountId);
         try {
-            await client.createmailbox("Outbox");
-            // Sync folders to pick up the new one
-            await this.syncFolders(accountId, client);
-            await client.logout();
+            await this.withConnection(accountId, async (client) => {
+                await client.createmailbox("Outbox");
+                await this.syncFolders(accountId, client);
+            });
         }
         catch (e) {
-            try {
-                await client.logout();
-            }
-            catch { /* ignore */ }
-            // Might already exist
+            // Might already exist — benign
             if (!e.message?.includes("already exists"))
                 throw e;
         }
@@ -3040,23 +2916,15 @@ export class ImapManager extends EventEmitter {
         //   - ~/.mailx/outbox/<acct>/*.ltr (fallback when IMAP is unreachable)
         try {
             const outboxPath = await this.ensureOutbox(accountId);
-            const client = this.createClient(accountId);
-            try {
+            await this.withConnection(accountId, async (client) => {
                 await client.appendMessage(outboxPath, rawMessage, ["\\Seen"]);
                 console.log(`  [outbox] Queued message in ${outboxPath}`);
-                // Sync outbox folder so message appears in UI immediately
-                const outboxFolder = this.findFolder(accountId, "outbox");
-                if (outboxFolder) {
-                    this.syncFolder(accountId, outboxFolder.id).catch(() => { });
-                }
-                return;
-            }
-            finally {
-                try {
-                    await client.logout();
-                }
-                catch { /* ignore */ }
+            });
+            const outboxFolder = this.findFolder(accountId, "outbox");
+            if (outboxFolder) {
+                this.syncFolder(accountId, outboxFolder.id).catch(() => { });
             }
+            return;
         }
         catch (e) {
             console.error(`  [outbox] IMAP queue failed: ${e.message} — saving locally`);
@@ -3317,14 +3185,14 @@ export class ImapManager extends EventEmitter {
         }
         console.log(`  [smtp] ${accountId}: sent to ${recipients.join(", ")}`);
     }
-    /** Process Outbox — send pending messages with flag-based interlock */
+    /** Process Outbox — send pending messages with flag-based interlock.
+     *  Each per-UID step is its own withConnection({slow}) call so the queue
+     *  yields between messages: a click-to-view body in the middle of a
+     *  10-message outbox drain doesn't wait for all 10 to finish. */
     async processOutbox(accountId) {
         const outboxFolder = this.findFolder(accountId, "outbox");
         if (!outboxFolder)
             return;
-        // Skip if this account's sync is failing — don't pile up connections
-        if (this.connectionBackoff.has(accountId) && Date.now() < (this.connectionBackoff.get(accountId) || 0))
-            return;
         // Gmail: skip IMAP outbox check — sending handled by processLocalQueue which sends directly via SMTP
         if (this.isGmailAccount(accountId))
             return;
@@ -3332,32 +3200,23 @@ export class ImapManager extends EventEmitter {
         const account = settings.accounts.find(a => a.id === accountId);
         if (!account)
             return;
-        const client = await this.createClientWithLimit(accountId);
-        try {
-            // Get all UIDs in Outbox
-            const uids = await client.getUids(outboxFolder.path);
-            if (uids.length === 0) {
-                try {
-                    await client.logout();
-                }
-                catch { }
-                return;
-            }
-            // Stale-claim recovery: if a peer (or our prior incarnation) crashed
-            // mid-send, the $Sending-<host>-<ts> flag would otherwise pin the
-            // message forever. Sweep flags older than STALE_CLAIM_MS first.
-            const STALE_CLAIM_MS = 3600_000; // 1 hour — far longer than any reasonable SMTP send
-            const nowSec = Math.floor(Date.now() / 1000);
-            // Encode our claim with a seconds-since-epoch timestamp so peers
-            // (and our own restart sweeper) can identify stale entries.
-            const sendingFlag = `$Sending-${this.hostname}-${nowSec}`;
-            for (const uid of uids) {
-                // Check flags — skip if already being sent or permanently failed
+        // List UIDs first — quick command, fast lane.
+        const uids = await this.withConnection(accountId, (client) => client.getUids(outboxFolder.path));
+        if (uids.length === 0)
+            return;
+        const STALE_CLAIM_MS = 3600_000; // 1 hour — longer than any reasonable SMTP send
+        const nowSec = Math.floor(Date.now() / 1000);
+        const sendingFlag = `$Sending-${this.hostname}-${nowSec}`;
+        const sentFolder = this.findFolder(accountId, "sent");
+        for (const uid of uids) {
+            // Each iteration is one slow-lane turn — fast-lane work can run
+            // between iterations, so a body click during a long outbox drain
+            // gets serviced promptly.
+            const result = await this.withConnection(accountId, async (client) => {
                 const flags = await client.getFlags(outboxFolder.path, uid);
-                // Sweep stale claims. New form: $Sending-<host>-<sec>. Old form
-                // ($Sending-<host>, no timestamp) is treated as stale on first
-                // encounter — safe because if its owner is alive, it'll re-claim
-                // with a fresh timestamped flag on its next tick.
+                // Sweep stale claims. $Sending-<host>-<sec> with old timestamp,
+                // or legacy $Sending-<host> without timestamp (treated as
+                // stale; if the real owner is alive it'll re-claim next tick).
                 const claimFlags = flags.filter((f) => f.startsWith("$Sending"));
                 for (const cf of claimFlags) {
                     const m = cf.match(/^\$Sending-(.+?)(?:-(\d+))?$/);
@@ -3373,78 +3232,76 @@ export class ImapManager extends EventEmitter {
                         catch { /* ignore */ }
                     }
                 }
-                // Re-read flags after sweep
                 const flagsNow = (claimFlags.length > 0)
                     ? await client.getFlags(outboxFolder.path, uid)
                     : flags;
                 if (flagsNow.some((f) => f.startsWith("$Sending")))
-                    continue;
+                    return { skip: true };
                 if (flagsNow.includes("$PermanentFailure"))
-                    continue;
+                    return { skip: true };
                 if (flagsNow.includes("$Failed")) {
-                    // Retry: remove failed flag
                     await client.removeFlags(outboxFolder.path, uid, ["$Failed"]);
                 }
-                // Claim this message
                 await client.addFlags(outboxFolder.path, uid, [sendingFlag]);
-                // Re-check — did we win the race? (TOCTOU window: two devices
-                // both reaching addFlags concurrently both see ≥2 sending flags
-                // and both back off — fails safe; nobody sends this tick, next
-                // tick one wins.)
+                // TOCTOU re-check: if two devices addFlags concurrently both
+                // see ≥2 sending flags. Fail-safe: both back off, next tick
+                // one wins.
                 const flagsAfter = await client.getFlags(outboxFolder.path, uid);
                 const sendingFlags = flagsAfter.filter((f) => f.startsWith("$Sending"));
                 if (sendingFlags.length > 1 || (sendingFlags.length === 1 && sendingFlags[0] !== sendingFlag)) {
-                    // Another machine claimed it — back off
                     await client.removeFlags(outboxFolder.path, uid, [sendingFlag]);
-                    continue;
+                    return { skip: true };
                 }
-                // Fetch the raw message
                 const msg = await client.fetchMessageByUid(outboxFolder.path, uid, { source: true });
                 if (!msg?.source) {
                     await client.removeFlags(outboxFolder.path, uid, [sendingFlag]);
-                    continue;
+                    return { skip: true };
                 }
-                // Send via shared SMTP method
-                try {
-                    await this.sendRawViaSMTP(accountId, msg.source);
-                    console.log(`  [outbox] Sent UID ${uid}`);
-                    // Delete from Outbox FIRST to prevent double-send if move-to-Sent fails.
-                    // The message is already sent via SMTP — worst case we lose the Sent copy,
-                    // which is better than sending the message twice.
+                return { source: msg.source };
+            }, { slow: true });
+            if (result.skip)
+                continue;
+            const source = result.source;
+            // SMTP send is its own connection — not an IMAP op, doesn't go
+            // through withConnection.
+            try {
+                await this.sendRawViaSMTP(accountId, source);
+                console.log(`  [outbox] Sent UID ${uid}`);
+                // Delete from Outbox + copy to Sent. Done in two separate
+                // withConnection calls so other work can interleave.
+                await this.withConnection(accountId, async (client) => {
+                    // Delete FIRST to prevent double-send if Sent-copy fails.
                     await client.deleteMessageByUid(outboxFolder.path, uid);
-                    // Copy to Sent folder (best-effort — message is already sent)
-                    const sentFolder = this.findFolder(accountId, "sent");
-                    if (sentFolder) {
-                        try {
-                            await client.appendMessage(sentFolder.path, msg.source, ["\\Seen"]);
-                            this.syncFolder(accountId, sentFolder.id).catch(() => { });
-                        }
-                        catch (sentErr) {
-                            console.error(`  [outbox] Failed to copy to Sent: ${sentErr.message} — message was sent successfully`);
-                        }
-                        this.syncFolder(accountId, outboxFolder.id).catch(() => { });
+                }, { slow: true });
+                if (sentFolder) {
+                    try {
+                        await this.withConnection(accountId, async (client) => {
+                            await client.appendMessage(sentFolder.path, source, ["\\Seen"]);
+                        }, { slow: true });
+                        this.syncFolder(accountId, sentFolder.id).catch(() => { });
                     }
-                }
-                catch (e) {
-                    const errMsg = e.message || String(e);
-                    console.error(`  [outbox] Send failed UID ${uid}: ${errMsg}`);
-                    await client.removeFlags(outboxFolder.path, uid, [sendingFlag]);
-                    await client.addFlags(outboxFolder.path, uid, ["$Failed"]);
-                    // Notify UI about the send failure
-                    this.emit("accountError", accountId, `Send failed: ${errMsg}`, "Message kept in Outbox", false);
-                    // Auth failures should not retry — back off this account
-                    if (/auth|login|credential|invalid/i.test(errMsg)) {
-                        this.outboxBackoff.set(accountId, Date.now() + 3600000); // 1 hour
-                        console.error(`  [outbox] Auth failure for ${accountId} — outbox paused for 1 hour`);
+                    catch (sentErr) {
+                        console.error(`  [outbox] Failed to copy to Sent: ${sentErr.message} — message was sent successfully`);
                     }
+                    this.syncFolder(accountId, outboxFolder.id).catch(() => { });
                 }
             }
-        }
-        finally {
-            try {
-                await client.logout();
+            catch (e) {
+                const errMsg = e.message || String(e);
+                console.error(`  [outbox] Send failed UID ${uid}: ${errMsg}`);
+                try {
+                    await this.withConnection(accountId, async (client) => {
+                        await client.removeFlags(outboxFolder.path, uid, [sendingFlag]);
+                        await client.addFlags(outboxFolder.path, uid, ["$Failed"]);
+                    }, { slow: true });
+                }
+                catch { /* best-effort */ }
+                this.emit("accountError", accountId, `Send failed: ${errMsg}`, "Message kept in Outbox", false);
+                if (/auth|login|credential|invalid/i.test(errMsg)) {
+                    this.outboxBackoff.set(accountId, Date.now() + 3600000); // 1 hour
+                    console.error(`  [outbox] Auth failure for ${accountId} — outbox paused for 1 hour`);
+                }
             }
-            catch { /* ignore */ }
         }
     }
     /** Start background Outbox worker — runs immediately then every 10 seconds */