@bobfrankston/rmfmail 1.1.203 → 1.1.205

package/packages/mailx-imap/index.ts

@@ -4038,35 +4038,35 @@ export class ImapManager extends EventEmitter {
      *  sending/queued/ on every send — that write is gone now, so scanning the
      *  directory is safe again. Any legitimate files that land there (crash
      *  recovery, manual drop) will get sent. */
-    private async processLocalQueue(accountId: string): Promise<void> {
-        const outboxDir = path.join(getConfigDir(), "outbox", accountId);
-        const queuedDir = path.join(getConfigDir(), "sending", accountId, "queued");
-
-        // Recovery sweep: any *.sending-<host>-<pid> on THIS host whose PID is
-        // dead (process crashed mid-send) gets unclaimed so the next tick can
-        // retry. Foreign hosts are left alone — we have no way to know if their
-        // process is alive. Cross-host stale recovery is the IMAP-folder path's
-        // job (sweeper looks at server-side claim flags, not local files).
-        // Stale-claim recovery. A claim is "stale" if any of:
-        //  (a) the PID is dead — original owner crashed mid-send
-        //  (b) the PID is alive BUT it's not us, and the file mtime is
-        //      older than STALE_CLAIM_MS — the OS recycled the PID for
-        //      some other process. `process.kill(pid, 0)` returning success
-        //      only proves *some* process owns that PID, not that it's
-        //      our long-dead mailx daemon. Without the age guard, a
-        //      claim survives forever as soon as any other Node process
-        //      (statusline, msger, npm) gets the recycled PID. Bob saw
-        //      this exact case: `.sending-rmf39-63196` sat in the queue
-        //      for 7+ hours because PID 63196 was now an unrelated Node.
-        //  (c) it's our PID — never sweep our own claim.
-        // 5 minutes: SMTP transactions complete in seconds; 5m of
-        // claim with no progress means the worker is wedged or PID
-        // got recycled. Earlier 1h was a band-aid that left Bob's
-        // outbox stuck for hours when an SMTP wedge crashed the
-        // worker mid-flight.
+    /** Recover stale `.sending-<host>-<pid>` claims for an account back to
+     *  plain `.ltr` so the next tick can retry. A claim is stale if:
+     *   (a) the PID is dead — original owner crashed/was replaced mid-send;
+     *   (b) the PID is alive but it's not us and the file mtime is older than
+     *       STALE_CLAIM_MS — `process.kill(pid,0)` only proves *some* process
+     *       owns that PID, not our long-dead daemon (OS recycles PIDs); the
+     *       age guard stops an unrelated Node (statusline/msger/npm) inheriting
+     *       a recycled PID from pinning the claim forever (Bob's 7-hour stuck
+     *       `.sending-rmf39-63196`);
+     *   (c) it's our PID — never sweep our own live claim.
+     *  Foreign hosts are left alone (we can't probe their PIDs); cross-host
+     *  recovery is the IMAP-folder sweeper's job.
+     *
+     *  CRITICAL: this is a local filesystem op with NO network I/O, so it MUST
+     *  run independently of send-backoff. It used to live inside
+     *  processLocalQueue, which the outbox worker SKIPS when an account is in
+     *  backoff — so a persistently-erroring account (e.g. Dovecot "Not
+     *  connected" storms) never recovered its claims, leaving a message stuck
+     *  "sending…" forever while healthy accounts drained. Bob 2026-05-31:
+     *  "stuck while others are getting sent." Now called every tick for every
+     *  account before the backoff gate. */
+    private recoverStaleClaims(accountId: string): void {
         const STALE_CLAIM_MS = 5 * 60_000;
         const myPid = process.pid;
-        for (const dir of [outboxDir, queuedDir]) {
+        const dirs = [
+            path.join(getConfigDir(), "outbox", accountId),
+            path.join(getConfigDir(), "sending", accountId, "queued"),
+        ];
+        for (const dir of dirs) {
             if (!fs.existsSync(dir)) continue;
             for (const f of fs.readdirSync(dir)) {
                 const m = f.match(/^(.+)\.sending-([^-]+)-(\d+)$/);
@@ -4079,9 +4079,8 @@ export class ImapManager extends EventEmitter {
                 try { process.kill(pid, 0); alive = true; } catch { /* dead */ }
                 let ageMs = Infinity;
                 try { ageMs = Date.now() - fs.statSync(path.join(dir, f)).mtimeMs; } catch { /* */ }
-                // Live PID + recent mtime → assume genuine sibling owner.
-                // Live PID + ancient mtime → PID got recycled, sweep it.
-                // Dead PID → sweep regardless of age.
+                // Live PID + recent mtime → genuine sibling owner, leave it.
+                // Live PID + ancient mtime → recycled PID, sweep. Dead PID → sweep.
                 if (alive && ageMs < STALE_CLAIM_MS) continue;
                 try {
                     fs.renameSync(path.join(dir, f), path.join(dir, original));
@@ -4090,6 +4089,16 @@ export class ImapManager extends EventEmitter {
                 } catch { /* ignore */ }
             }
         }
+    }
+
+    private async processLocalQueue(accountId: string): Promise<void> {
+        const outboxDir = path.join(getConfigDir(), "outbox", accountId);
+        const queuedDir = path.join(getConfigDir(), "sending", accountId, "queued");
+
+        // Recovery also runs unconditionally in the worker tick (before the
+        // backoff gate); keep it here too for the direct-call path from
+        // queueOutgoing. Idempotent — a no-op when nothing is stale.
+        this.recoverStaleClaims(accountId);
 
         const filesToSend: { dir: string; file: string }[] = [];
         for (const dir of [outboxDir, queuedDir]) {
@@ -4541,7 +4550,14 @@ export class ImapManager extends EventEmitter {
             // per-account sweep picks them up below.
             this.routeGeneralOutbox();
             for (const [accountId] of this.configs) {
-                // Skip accounts in backoff
+                // Recover stale claims FIRST, unconditionally — it's a local
+                // FS op with no network, so it must not be gated by send
+                // backoff. Otherwise an account stuck in backoff (Dovecot "Not
+                // connected" storms) never unclaims an orphaned .sending- file,
+                // and a message sits "sending…" forever while other accounts
+                // drain (Bob 2026-05-31).
+                this.recoverStaleClaims(accountId);
+                // Skip the SEND for accounts in backoff (network ops only).
                 const retryAfter = this.outboxBackoff.get(accountId) || 0;
                 if (now < retryAfter) continue;
 

package/packages/mailx-imap/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bobfrankston/mailx-imap",
-  "version": "0.1.78",
+  "version": "0.1.79",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bobfrankston/mailx-imap",
-      "version": "0.1.78",
+      "version": "0.1.79",
       "license": "ISC",
       "dependencies": {
         "@bobfrankston/iflow-direct": "^0.1.27",

package/packages/mailx-imap/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-imap",
-  "version": "0.1.78",
+  "version": "0.1.79",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",