@remit/smtp-worker 0.0.30 → 0.0.32

package/src/handlers/send-message.test.ts

@@ -1,1037 +1,717 @@
 import assert from "node:assert/strict";
-import { describe, it } from "node:test";
+import net from "node:net";
+import { afterEach, beforeEach, describe, it } from "node:test";
 import type {
-	AccountItem,
-	OutboxMessageItem,
-	UpdateOutboxMessageInput,
+	CreateAccountInput,
+	CreateOutboxMessageInput,
 } from "@remit/data-ports";
-import { AccountAuthType } from "@remit/domain-enums";
-import { RefreshTokenError } from "@remit/mail-oauth-service";
-import { OutboxAttachmentUnavailableError } from "@remit/mailbox-service/outbox-attachment-content";
+import { deriveAddressId } from "@remit/data-ports/id";
 import {
-	type EncryptedPayload,
-	serializeEncryptedPayload,
-} from "@remit/secrets-service";
+	type RecordingQueue,
+	recordingQueue,
+} from "@remit/data-ports/recording-queue";
 import {
-	type MailAttachment,
-	type MailMessage,
-	type SendResult,
-	SmtpConnectionError,
-} from "@remit/smtp-service";
-import type { SendMessageEvent } from "../events.js";
+	AccountAuthType,
+	ConnectionState,
+	OutboxMessageStatus,
+} from "@remit/domain-enums";
 import {
-	getSendMessageMaxAttempts,
-	SEND_MESSAGE_MAX_ATTEMPTS,
-	type SendMessageDeps,
-	sendMessage,
-} from "./send-message-core.js";
-
-const silentLogger = {
-	info: () => {},
-	warn: () => {},
-	error: () => {},
-	debug: () => {},
-	trace: () => {},
-	fatal: () => {},
-	child: () => silentLogger,
-} as never;
-
-const buildOutbox = (
-	overrides: Partial<OutboxMessageItem> = {},
-): OutboxMessageItem =>
-	({
-		outboxMessageId: "obx-1",
-		accountId: "acc-1",
-		accountConfigId: "cfg-1",
-		fromAddress: "alice@example.com",
-		toAddresses: ["bob@example.com"],
-		messageIdValue: "msg-1@example.com",
-		status: "queued",
-		createdAt: 0,
-		updatedAt: 0,
-		...overrides,
-	}) as unknown as OutboxMessageItem;
-
-const buildAccount = (overrides: Partial<AccountItem> = {}): AccountItem =>
-	({
-		accountId: "acc-1",
-		accountConfigId: "cfg-1",
-		username: "alice@example.com",
-		email: "alice@example.com",
-		passwordHash: JSON.stringify(
-			serializeEncryptedPayload({
+	BETTER_SQLITE3_LIMITS,
+	createSqliteRepositories,
+} from "@remit/drizzle-service";
+import { createShippedSqliteDb } from "@remit/drizzle-service/test-sqlite";
+import type { MailFailureKind } from "@remit/logger";
+import { RefreshTokenError } from "@remit/mail-oauth-service";
+import { serializeEncryptedPayload } from "@remit/secrets-service";
+import { SmtpConnectionError } from "@remit/smtp-service";
+import {
+	type FakeSmtp,
+	type FakeSmtpOptions,
+	startFakeSmtp,
+} from "@remit/smtp-service/test-fake-smtp";
+import { createMockStorageService } from "@remit/storage-service";
+import type { SendMessageEvent } from "../events.js";
+import { handleSendMessage, type SendMessageContext } from "./send-message.js";
+
+const MAX_ATTEMPTS = 3;
+
+const storedSecret = (plaintext: string): string =>
+	JSON.stringify(
+		serializeEncryptedPayload({
+			encryptedDek: Buffer.from("dek"),
+			encryptedData: Buffer.from(plaintext),
+			iv: Buffer.from("iv"),
+			authTag: Buffer.from("tag"),
+		}),
+	);
+
+interface SocketRequest {
+	host: string | undefined;
+	port: string | number | undefined;
+}
+
+interface World {
+	repos: ReturnType<typeof createSqliteRepositories>;
+	smtp: FakeSmtp;
+	queue: RecordingQueue;
+	storage: ReturnType<typeof createMockStorageService>;
+	requests: SocketRequest[];
+	failures: MailFailureKind[];
+	tokenRequests: string[];
+	ctx: SendMessageContext;
+	close: () => void;
+}
+
+const openWorld = async (smtpOptions: FakeSmtpOptions = {}): Promise<World> => {
+	const store = createShippedSqliteDb();
+	const repos = createSqliteRepositories(
+		{
+			app: store.db,
+			mail: store.db,
+			search: store.db,
+		},
+		BETTER_SQLITE3_LIMITS,
+	);
+	const smtp = await startFakeSmtp(smtpOptions);
+	const queue = recordingQueue();
+	const storage = createMockStorageService();
+	const requests: SocketRequest[] = [];
+	const failures: MailFailureKind[] = [];
+	const tokenRequests: string[] = [];
+	const ctx: SendMessageContext = {
+		ports: repos,
+		secrets: {
+			encrypt: async (plaintext) => ({
 				encryptedDek: Buffer.from("dek"),
-				encryptedData: Buffer.from("data"),
+				encryptedData: Buffer.from(plaintext),
 				iv: Buffer.from("iv"),
 				authTag: Buffer.from("tag"),
 			}),
-		),
-		imapHost: "imap.example.com",
+			decrypt: async (payload) => payload.encryptedData.toString(),
+		},
+		storage,
+		messageManagement: queue,
+		tokenService: {
+			getAccessToken: async (accountId) => {
+				tokenRequests.push(accountId);
+				return { accessToken: "access-token", expiresAt: 0, grantedScopes: [] };
+			},
+		},
+		getSocket: (request, callback) => {
+			requests.push({ host: request.host, port: request.port });
+			const connection = net.connect(smtp.port, "127.0.0.1", () =>
+				callback(null, { connection }),
+			);
+		},
+		maxAttempts: MAX_ATTEMPTS,
+		recordSmtpFailure: (kind) => failures.push(kind),
+	};
+	return {
+		repos,
+		smtp,
+		queue,
+		storage,
+		requests,
+		failures,
+		tokenRequests,
+		ctx,
+		close: () => {
+			smtp.close();
+			store.close();
+		},
+	};
+};
+
+interface Arranged {
+	accountId: string;
+	accountConfigId: string;
+	outboxMessageId: string;
+	event: SendMessageEvent;
+}
+
+const arrange = async (
+	w: World,
+	options: {
+		account?: Partial<CreateAccountInput>;
+		outbox?: Partial<CreateOutboxMessageInput>;
+	} = {},
+): Promise<Arranged> => {
+	const account = await w.repos.account.create({
+		accountConfigId: "cfg-1",
+		username: "alice@example.com",
+		email: "alice@example.com",
+		passwordHash: storedSecret("smtp-password"),
+		imapHost: "imap.example.invalid",
 		imapPort: 993,
 		imapTls: true,
 		imapStartTls: false,
 		smtpEnabled: true,
-		smtpHost: "smtp.example.com",
+		smtpHost: "smtp.example.invalid",
 		smtpPort: 587,
 		smtpTls: false,
 		smtpStartTls: true,
-		smtpUsername: "",
 		isActive: true,
-		connectionState: "not_authenticated",
-		createdAt: 0,
-		updatedAt: 0,
-		...overrides,
-	}) as unknown as AccountItem;
-
-interface Recorded {
-	updates: Array<{ id: string; patch: UpdateOutboxMessageInput }>;
-	statuses: Array<{ id: string; status: OutboxMessageItem["status"] }>;
-	marked: Array<{ id: string; sentAt: number; smtpMessageId?: string }>;
-	appendCalls: Array<{ accountId: string; outboxMessageId: string }>;
-	sendCalls: number;
-	resolveCalls: number;
-	connectionStateUpdates: Array<{ accountId: string; state: string }>;
-	conditionalUpdates: Array<{
-		id: string;
-		expected: OutboxMessageItem["status"];
-		patch: UpdateOutboxMessageInput;
-	}>;
-	/** Ordered names of the writes the handler made, across every recorder. */
-	writeOrder: string[];
-	outboundIncrements: Array<{ addressId: string; now: number }>;
-	replyIncrements: Array<{ addressId: string; now: number }>;
-}
-
-const buildDeps = (
-	options: {
-		outbox?: OutboxMessageItem;
-		account?: AccountItem;
-		sendResult?: SendResult;
-		appendThrows?: Error;
-		resolveCredentials?: SendMessageDeps["resolveCredentials"];
-		send?: SendMessageDeps["send"];
-		attachments?: MailAttachment[];
-		attachmentsFail?: Error;
-	} = {},
-): { deps: SendMessageDeps; recorded: Recorded } => {
-	const recorded: Recorded = {
-		updates: [],
-		statuses: [],
-		marked: [],
-		appendCalls: [],
-		sendCalls: 0,
-		resolveCalls: 0,
-		connectionStateUpdates: [],
-		conditionalUpdates: [],
-		writeOrder: [],
-		outboundIncrements: [],
-		replyIncrements: [],
-	};
-	const outbox = options.outbox ?? buildOutbox();
-	const account = options.account ?? buildAccount();
-	let currentStatus: OutboxMessageItem["status"] = outbox.status;
-	const deps: SendMessageDeps = {
-		getOutbox: async (accountConfigId, id) => {
-			assert.equal(accountConfigId, account.accountConfigId);
-			assert.equal(id, outbox.outboxMessageId);
-			return outbox;
-		},
-		getAccount: async (id) => {
-			assert.equal(id, account.accountId);
-			return account;
-		},
-		updateOutbox: async (accountConfigId, id, patch) => {
-			assert.equal(accountConfigId, account.accountConfigId);
-			if (patch.status) currentStatus = patch.status;
-			recorded.writeOrder.push("outbox");
-			recorded.updates.push({ id, patch });
-		},
-		updateOutboxStatus: async (accountConfigId, id, status) => {
-			assert.equal(accountConfigId, account.accountConfigId);
-			currentStatus = status;
-			recorded.statuses.push({ id, status });
-		},
-		// Compare-and-set, as the port implements it: the write lands only while
-		// the row still holds `expected`, and answers null when it does not.
-		updateOutboxIfStatus: async (accountConfigId, id, expected, patch) => {
-			assert.equal(accountConfigId, account.accountConfigId);
-			recorded.conditionalUpdates.push({ id, expected, patch });
-			if (expected !== currentStatus) return null;
-			if (patch.status) currentStatus = patch.status;
-			recorded.writeOrder.push("outbox");
-			recorded.updates.push({ id, patch });
-			return {};
-		},
-		markOutboxSent: async (accountConfigId, id, fields) => {
-			assert.equal(accountConfigId, account.accountConfigId);
-			recorded.marked.push({ id, ...fields });
-		},
-		secrets: {
-			decrypt: async (payload: EncryptedPayload): Promise<string> =>
-				payload.encryptedDek.toString(),
-		},
-		// Stub credential resolver: returns a password credential from the account's
-		// encrypted passwordHash (mirroring what resolveConnectionCredentials does in prod).
-		resolveCredentials:
-			options.resolveCredentials ??
-			(async (_account) => {
-				recorded.resolveCalls += 1;
-				return {
-					status: "resolved" as const,
-					credentials: {
-						kind: "password" as const,
-						password: _account.passwordHash
-							? "resolved-password"
-							: "no-password-configured",
-					},
-				};
-			}),
-		updateConnectionState: async (accountId, state) => {
-			recorded.writeOrder.push("connectionState");
-			recorded.connectionStateUpdates.push({ accountId, state });
-		},
-		send:
-			options.send ??
-			(async () => {
-				recorded.sendCalls += 1;
-				return (
-					options.sendResult ?? {
-						success: true,
-						messageId: "smtp-mid-1",
-						isTransient: false,
-					}
-				);
-			}),
-		loadAttachments: async (tenant, outboxMessageId) => {
-			assert.equal(tenant.accountConfigId, account.accountConfigId);
-			assert.equal(tenant.accountId, account.accountId);
-			assert.equal(outboxMessageId, outbox.outboxMessageId);
-			if (options.attachmentsFail) throw options.attachmentsFail;
-			return options.attachments ?? [];
+		connectionState: ConnectionState.Authenticated,
+		...options.account,
+	});
+	const outbox = await w.repos.outboxMessage.create({
+		accountId: account.accountId,
+		accountConfigId: account.accountConfigId,
+		fromAddress: "alice@example.com",
+		toAddresses: ["bob@example.com"],
+		subject: "Quarterly numbers",
+		textBody: "Hello Bob",
+		messageIdValue: "<send-1@example.com>",
+		status: OutboxMessageStatus.queued,
+		...options.outbox,
+	});
+	return {
+		accountId: account.accountId,
+		accountConfigId: account.accountConfigId,
+		outboxMessageId: outbox.outboxMessageId,
+		event: {
+			type: "SEND_MESSAGE",
+			eventId: "evt-1",
+			timestamp: 0,
+			accountId: account.accountId,
+			outboxMessageId: outbox.outboxMessageId,
 		},
-		emitAppendSentMessage: async (accountId, outboxMessageId) => {
-			recorded.appendCalls.push({ accountId, outboxMessageId });
-			if (options.appendThrows) throw options.appendThrows;
+	};
+};
+
+const outboxRow = (w: World, a: Arranged) =>
+	w.repos.outboxMessage.get(a.accountConfigId, a.outboxMessageId);
+
+const accountRow = (w: World, a: Arranged) => w.repos.account.get(a.accountId);
+
+const attach = async (
+	w: World,
+	a: Arranged,
+	file: { filename: string; content: Buffer | null },
+): Promise<void> => {
+	const outboxAttachmentId = `att-${file.filename}`;
+	const reserved = await w.repos.outboxAttachment.reserve(
+		{
+			outboxAttachmentId,
+			outboxMessageId: a.outboxMessageId,
+			accountId: a.accountId,
+			accountConfigId: a.accountConfigId,
+			filename: file.filename,
+			contentType: "application/pdf",
+			sizeBytes: file.content?.length ?? 4,
+			storageKey: `key/${file.filename}`,
+			reservationExpiresAt: Math.floor(Date.now() / 1000) + 3600,
 		},
-		engagement: {
-			resolveAddressId: (accountConfigId, email) =>
-				`addr-${accountConfigId}-${email}`,
-			incrementOutboundCount: async (accountConfigId, addressId, now) => {
-				assert.equal(accountConfigId, account.accountConfigId);
-				recorded.outboundIncrements.push({ addressId, now });
-			},
-			incrementReplyCount: async (accountConfigId, addressId, now) => {
-				assert.equal(accountConfigId, account.accountConfigId);
-				recorded.replyIncrements.push({ addressId, now });
-			},
-			findMessageByHeader: async () => null,
-			getEnvelopeFromEmail: async () => null,
+		{
+			maxTotalBytes: 1_000_000,
+			maxCount: 10,
+			nowSeconds: Math.floor(Date.now() / 1000),
 		},
+	);
+	assert.equal(reserved.outcome, "Reserved");
+	await w.repos.outboxAttachment.markStored(
+		a.accountConfigId,
+		outboxAttachmentId,
+		file.content?.length ?? 4,
+	);
+	if (file.content === null) return;
+	await w.storage.storeOutboxAttachment({
+		accountConfigId: a.accountConfigId,
+		accountId: a.accountId,
+		outboxMessageId: a.outboxMessageId,
+		outboxAttachmentId,
+		content: file.content,
+	});
+};
+
+const refusingSocket =
+	(code: string): SendMessageContext["getSocket"] =>
+	(_request, callback) => {
+		callback(Object.assign(new Error(`connect ${code}`), { code }), false);
 	};
-	return { deps, recorded };
+
+const seedAddress = async (w: World, email: string): Promise<string> => {
+	const addressId = deriveAddressId("cfg-1", email);
+	const [localPart = "", domain = ""] = email.split("@");
+	await w.repos.address.upsertAddress({
+		addressId,
+		accountConfigId: "cfg-1",
+		localPart,
+		domain,
+		normalizedEmail: email,
+		normalizedCompound: email,
+	});
+	return addressId;
 };
 
-const event: SendMessageEvent = {
-	type: "SEND_MESSAGE",
-	eventId: "evt-1",
-	timestamp: 0,
-	accountId: "acc-1",
-	outboxMessageId: "obx-1",
+const assertBlockedOnReauth = async (w: World, a: Arranged): Promise<void> => {
+	const row = await outboxRow(w, a);
+	assert.equal(row.status, OutboxMessageStatus.blocked);
+	assert.match(String(row.lastError), /reconnected/i);
+	assert.match(String(row.lastError), /Reconnect/);
 };
 
-describe("sendMessage handler", () => {
-	it("retries a message whose files could not be read, below the budget", async () => {
-		const { deps, recorded } = buildDeps({
-			outbox: buildOutbox({ status: "queued" }),
-			attachmentsFail: new OutboxAttachmentUnavailableError(
-				"payroll.xlsx",
-				"nothing is stored at key/payroll",
-			),
-		});
+let w: World;
 
-		await assert.rejects(() => sendMessage(event, silentLogger, deps, 1));
+beforeEach(async () => {
+	w = await openWorld();
+});
 
-		assert.equal(recorded.sendCalls, 0);
-		assert.deepEqual(recorded.updates, []);
-		assert.deepEqual(recorded.statuses, [], "never moved to sending");
-	});
+afterEach(() => w.close());
 
-	it("settles a message whose files cannot be read as failed, naming the file, at the budget", async () => {
-		const { deps, recorded } = buildDeps({
-			outbox: buildOutbox({ status: "queued" }),
-			attachmentsFail: new OutboxAttachmentUnavailableError(
-				"payroll.xlsx",
-				"nothing is stored at key/payroll",
-			),
+describe("handleSendMessage", () => {
+	it("sends over the context's socket, marks the row sent and queues the Sent copy", async () => {
+		const a = await arrange(w, {
+			outbox: { lastError: "stale error from a prior attempt" },
 		});
 
-		await sendMessage(event, silentLogger, deps, SEND_MESSAGE_MAX_ATTEMPTS);
+		await handleSendMessage(a.event, w.ctx, 1);
 
-		assert.equal(recorded.sendCalls, 0);
-		assert.equal(recorded.updates.length, 1);
-		assert.equal(recorded.updates[0].patch.status, "failed");
-		assert.equal(
-			recorded.updates[0].patch.lastError,
-			'"payroll.xlsx" could not be read: nothing is stored at key/payroll, so this message was not sent. Remove "payroll.xlsx", attach it again, and send.',
+		assert.deepEqual(w.requests, [{ host: "smtp.example.invalid", port: 587 }]);
+		assert.match(w.smtp.received.join(""), /Subject: Quarterly numbers/);
+		const row = await outboxRow(w, a);
+		assert.equal(row.status, OutboxMessageStatus.sent);
+		assert.equal(row.lastError, undefined);
+		assert.deepEqual(
+			w.queue.sent.map(({ body }) => [
+				body.type,
+				body.accountId,
+				body.outboxMessageId,
+			]),
+			[["APPEND_SENT_MESSAGE", a.accountId, a.outboxMessageId]],
 		);
 	});
 
 	it("sends every file the draft carries as a part of the message", async () => {
-		const attachments: MailAttachment[] = [
-			{
-				filename: "report.pdf",
-				contentType: "application/pdf",
-				content: Buffer.from("%PDF-1.4"),
-			},
-		];
-		const sent: MailMessage[] = [];
-		const { deps } = buildDeps({
-			attachments,
-			send: async (_config, message) => {
-				sent.push(message);
-				return { success: true, messageId: "smtp-mid-1", isTransient: false };
-			},
+		const a = await arrange(w);
+		await attach(w, a, {
+			filename: "report.pdf",
+			content: Buffer.from("%PDF-1.4"),
 		});
 
-		await sendMessage(event, silentLogger, deps);
+		await handleSendMessage(a.event, w.ctx, 1);
 
-		assert.equal(sent.length, 1);
-		assert.deepEqual(sent[0].attachments, attachments);
+		assert.match(w.smtp.received.join(""), /filename=report\.pdf/);
+		assert.equal((await outboxRow(w, a)).status, OutboxMessageStatus.sent);
 	});
 
-	it("marks status `blocked` when SMTP is disabled — never `sent`", async () => {
-		const { deps, recorded } = buildDeps({
-			account: buildAccount({ smtpEnabled: false }),
-		});
+	it("retries a message whose files could not be read, below the budget", async () => {
+		const a = await arrange(w);
+		await attach(w, a, { filename: "payroll.xlsx", content: null });
 
-		await sendMessage(event, silentLogger, deps);
+		await assert.rejects(() => handleSendMessage(a.event, w.ctx, 1));
 
-		assert.equal(recorded.sendCalls, 0, "send must not be invoked");
-		assert.equal(recorded.marked.length, 0, "must not mark as sent");
-		assert.equal(recorded.updates.length, 1);
-		assert.equal(recorded.updates[0].patch.status, "blocked");
-		assert.match(
-			String(recorded.updates[0].patch.lastError),
-			/SMTP not configured/,
-		);
-		assert.equal(
-			recorded.statuses.length,
-			0,
-			"must not flicker through `sending`",
-		);
-		assert.equal(
-			recorded.appendCalls.length,
-			0,
-			"must not enqueue APPEND_SENT_MESSAGE",
-		);
+		assert.deepEqual(w.requests, [], "never dialled the server");
+		assert.equal((await outboxRow(w, a)).status, OutboxMessageStatus.queued);
 	});
 
-	it("marks status `failed` (not `sent`) on permanent SMTP error", async () => {
-		const { deps, recorded } = buildDeps({
-			account: buildAccount({
-				smtpHost: "smtp.example.com",
-				smtpPort: 587,
-			}),
-			sendResult: {
-				success: false,
-				error: new Error("auth failed") as Error & { responseCode?: number },
-				smtpCode: 535,
-				isTransient: false,
-			},
-		});
+	it("settles a message whose files cannot be read as failed, naming the file, at the budget", async () => {
+		const a = await arrange(w);
+		await attach(w, a, { filename: "payroll.xlsx", content: null });
 
-		await sendMessage(event, silentLogger, deps);
+		await handleSendMessage(a.event, w.ctx, MAX_ATTEMPTS);
 
-		assert.equal(recorded.sendCalls, 1);
-		assert.equal(recorded.marked.length, 0);
-		const failedUpdate = recorded.updates.find(
-			(u) => u.patch.status === "failed",
-		);
-		assert.ok(failedUpdate, "should write a failed update");
-		assert.equal(failedUpdate.patch.lastSmtpCode, 535);
-		assert.equal(failedUpdate.patch.lastError, "auth failed");
-		assert.equal(
-			recorded.appendCalls.length,
-			0,
-			"must not enqueue APPEND_SENT_MESSAGE",
+		assert.deepEqual(w.requests, []);
+		const row = await outboxRow(w, a);
+		assert.equal(row.status, OutboxMessageStatus.failed);
+		assert.match(
+			String(row.lastError),
+			/^"payroll\.xlsx" could not be read: .*, so this message was not sent\. Remove "payroll\.xlsx", attach it again, and send\.$/,
 		);
 	});
 
-	it("marks `sent` and clears prior error fields on success", async () => {
-		const { deps, recorded } = buildDeps({
-			outbox: buildOutbox({
-				lastError: "stale error from prior attempt",
-				lastSmtpCode: 421,
-			}),
-			account: buildAccount({ smtpHost: "smtp.example.com", smtpPort: 587 }),
-		});
+	it("marks status `blocked` when SMTP is disabled — never `sent`", async () => {
+		const a = await arrange(w, { account: { smtpEnabled: false } });
 
-		await sendMessage(event, silentLogger, deps);
+		await handleSendMessage(a.event, w.ctx, 1);
 
-		assert.equal(recorded.sendCalls, 1);
-		assert.equal(recorded.marked.length, 1);
-		assert.equal(recorded.marked[0].id, "obx-1");
-		assert.equal(recorded.marked[0].smtpMessageId, "smtp-mid-1");
-		assert.equal(
-			recorded.appendCalls.length,
-			1,
-			"must enqueue APPEND_SENT_MESSAGE",
-		);
-		// `markOutboxSent` is the seam that clears lastError/lastSmtpCode.
-		// We do not assert on `update` calls writing those fields — only that
-		// `markOutboxSent` was used (not the legacy generic update).
+		assert.deepEqual(w.requests, [], "send must not be attempted");
+		const row = await outboxRow(w, a);
+		assert.equal(row.status, OutboxMessageStatus.blocked);
+		assert.match(String(row.lastError), /SMTP not configured/);
+		assert.deepEqual(w.queue.sent, [], "must not enqueue APPEND_SENT_MESSAGE");
 	});
 
-	it("reverts to `queued` and rethrows on transient SMTP error", async () => {
-		const { deps, recorded } = buildDeps({
-			account: buildAccount({ smtpHost: "smtp.example.com", smtpPort: 587 }),
-			sendResult: {
-				success: false,
-				error: new Error("temporarily unavailable"),
-				smtpCode: 421,
-				isTransient: true,
-			},
-		});
+	it("marks status `failed` (not `sent`) on a permanent SMTP refusal, counting no engagement", async () => {
+		w.close();
+		w = await openWorld({ dataFinalResponse: "554 5.7.1 Rejected\r\n" });
+		const a = await arrange(w);
+		const bob = await seedAddress(w, "bob@example.com");
 
-		await assert.rejects(
-			() => sendMessage(event, silentLogger, deps),
-			/SMTP transient error/,
-		);
+		await handleSendMessage(a.event, w.ctx, 1);
 
-		const requeued = recorded.statuses.find((s) => s.status === "queued");
-		assert.ok(requeued, "should revert to queued for SQS retry");
-		assert.equal(recorded.marked.length, 0, "must not mark as sent");
+		const row = await outboxRow(w, a);
+		assert.equal(row.status, OutboxMessageStatus.failed);
+		assert.equal(row.lastSmtpCode, 554);
+		assert.deepEqual(w.queue.sent, []);
+		const address = await w.repos.address.getAddress("cfg-1", bob);
+		assert.equal(address.outboundCount ?? 0, 0);
 	});
 
-	it("skips processing if message is already `sent` (idempotent)", async () => {
-		const { deps, recorded } = buildDeps({
-			outbox: buildOutbox({ status: "sent" }),
-		});
+	it("reverts to `queued` and rethrows on a transient SMTP refusal", async () => {
+		w.close();
+		w = await openWorld({ dataFinalResponse: "451 4.3.0 Try later\r\n" });
+		const a = await arrange(w);
 
-		await sendMessage(event, silentLogger, deps);
+		await assert.rejects(
+			() => handleSendMessage(a.event, w.ctx, 1),
+			/SMTP transient error/,
+		);
 
-		assert.equal(recorded.sendCalls, 0);
-		assert.equal(recorded.marked.length, 0);
-		assert.equal(recorded.updates.length, 0);
-		assert.equal(recorded.statuses.length, 0);
+		assert.equal((await outboxRow(w, a)).status, OutboxMessageStatus.queued);
 	});
 
-	it("never re-sends a message that was sent but could not be filed", async () => {
-		// The redelivery fence is the only thing between SQS at-least-once and a
-		// second copy on the wire. `unfiled` is past the send, so it belongs on
-		// the same side of the fence as `sent`.
-		const { deps, recorded } = buildDeps({
-			outbox: buildOutbox({ status: "unfiled" }),
-		});
-
-		await sendMessage(event, silentLogger, deps);
+	for (const status of [
+		OutboxMessageStatus.sent,
+		OutboxMessageStatus.unfiled,
+		OutboxMessageStatus.failed,
+	]) {
+		it(`never re-sends a row already at \`${status}\``, async () => {
+			const a = await arrange(w, { outbox: { status } });
 
-		assert.equal(recorded.sendCalls, 0);
-		assert.equal(recorded.marked.length, 0);
-		assert.equal(recorded.updates.length, 0);
-	});
+			await handleSendMessage(a.event, w.ctx, 1);
 
-	it("drops the event for a row the enqueue settled at `failed`", async () => {
-		// The other half of #936. An error from SQS `SendMessage` says the response
-		// was lost, not that the broker refused the event, so the row is settled
-		// outside this fence and the event that landed anyway dies here. Settling
-		// it at `draft` instead would send it — and leave the user a row they can
-		// send a second time.
-		const { deps, recorded } = buildDeps({
-			outbox: buildOutbox({ status: "failed" }),
+			assert.deepEqual(w.requests, []);
+			assert.equal((await outboxRow(w, a)).status, status);
 		});
-
-		await sendMessage(event, silentLogger, deps);
-
-		assert.equal(recorded.sendCalls, 0, "must not send");
-		assert.equal(recorded.marked.length, 0);
-		assert.equal(recorded.updates.length, 0);
-		assert.equal(recorded.statuses.length, 0);
-	});
+	}
 
 	it("settles the row as unfiled when the append event cannot be queued", async () => {
-		const { deps, recorded } = buildDeps({
-			account: buildAccount({ smtpHost: "smtp.example.com", smtpPort: 587 }),
-			appendThrows: new Error("queue unreachable"),
-		});
+		const a = await arrange(w);
+		w.queue.answer(() => Promise.reject(new Error("queue unreachable")));
 
-		await sendMessage(event, silentLogger, deps);
+		await handleSendMessage(a.event, w.ctx, 1);
 
-		// The send itself succeeded. Without a settle the row keeps the `sent`
-		// status the Outbox list hides, and no APPEND is ever going to delete it.
-		assert.equal(recorded.marked.length, 1);
-		const patch = recorded.updates.at(-1)?.patch;
-		assert.equal(patch?.status, "unfiled");
-		assert.match(String(patch?.lastError), /could not be queued/);
+		const row = await outboxRow(w, a);
+		assert.equal(row.status, OutboxMessageStatus.unfiled);
+		assert.match(String(row.lastError), /could not be queued/);
 	});
 
-	it("drops event when account is deleted (tombstone fence)", async () => {
-		const { deps, recorded } = buildDeps({
-			account: buildAccount({
-				smtpHost: "smtp.example.com",
-				smtpPort: 587,
-				deletedAt: Date.now(),
-			}),
-		});
+	it("drops the event when the account is deleted (tombstone fence)", async () => {
+		const a = await arrange(w, { account: { deletedAt: Date.now() } });
 
-		await sendMessage(event, silentLogger, deps);
+		await handleSendMessage(a.event, w.ctx, 1);
 
-		assert.equal(recorded.sendCalls, 0, "must not send");
-		assert.equal(recorded.marked.length, 0, "must not mark as sent");
-		assert.equal(recorded.updates.length, 0, "must not update outbox");
-		assert.equal(recorded.statuses.length, 0, "must not change status");
-		assert.equal(recorded.appendCalls.length, 0, "must not enqueue append");
+		assert.deepEqual(w.requests, []);
+		assert.equal((await outboxRow(w, a)).status, OutboxMessageStatus.queued);
+		assert.deepEqual(w.queue.sent, []);
 	});
 
-	it("increments outboundCount once per unique recipient on successful send", async () => {
-		const { deps, recorded } = buildDeps({
-			outbox: buildOutbox({
+	it("increments outboundCount once per unique recipient on a successful send", async () => {
+		const a = await arrange(w, {
+			outbox: {
 				toAddresses: ["bob@example.com", "BOB@example.com"],
 				ccAddresses: ["carol@example.com"],
 				bccAddresses: ["dave@example.com"],
-			}),
-			account: buildAccount({ smtpHost: "smtp.example.com", smtpPort: 587 }),
-		});
-
-		await sendMessage(event, silentLogger, deps);
-
-		assert.equal(recorded.marked.length, 1, "send must succeed");
-		const incrementedAddressIds = recorded.outboundIncrements
-			.map((i) => i.addressId)
-			.sort();
-		assert.deepEqual(incrementedAddressIds, [
-			"addr-cfg-1-bob@example.com",
-			"addr-cfg-1-carol@example.com",
-			"addr-cfg-1-dave@example.com",
-		]);
-		assert.equal(recorded.replyIncrements.length, 0);
-	});
-
-	it("does not increment counters when send fails", async () => {
-		const { deps, recorded } = buildDeps({
-			account: buildAccount({ smtpHost: "smtp.example.com", smtpPort: 587 }),
-			sendResult: {
-				success: false,
-				error: new Error("auth failed") as Error & { responseCode?: number },
-				smtpCode: 535,
-				isTransient: false,
 			},
 		});
-
-		await sendMessage(event, silentLogger, deps);
-
-		assert.equal(recorded.outboundIncrements.length, 0);
-		assert.equal(recorded.replyIncrements.length, 0);
-	});
-
-	it("increments replyCount when In-Reply-To resolves to a recipient", async () => {
-		const { deps, recorded } = buildDeps({
-			outbox: buildOutbox({
-				toAddresses: ["bob@example.com"],
-				inReplyTo: "parent-msg@example.com",
-			}),
-			account: buildAccount({ smtpHost: "smtp.example.com", smtpPort: 587 }),
-		});
-		deps.engagement.findMessageByHeader = async () =>
-			({ messageId: "msg-parent" }) as unknown as never;
-		deps.engagement.getEnvelopeFromEmail = async () => "bob@example.com";
-
-		await sendMessage(event, silentLogger, deps);
-
-		assert.equal(recorded.replyIncrements.length, 1);
-		assert.equal(
-			recorded.replyIncrements[0].addressId,
-			"addr-cfg-1-bob@example.com",
+		const ids = await Promise.all(
+			["bob@example.com", "carol@example.com", "dave@example.com"].map(
+				(email) => seedAddress(w, email),
+			),
 		);
-	});
 
-	it("does NOT increment replyCount when resolved sender is not a recipient", async () => {
-		const { deps, recorded } = buildDeps({
-			outbox: buildOutbox({
-				toAddresses: ["bob@example.com"],
-				inReplyTo: "parent-msg@example.com",
-			}),
-			account: buildAccount({ smtpHost: "smtp.example.com", smtpPort: 587 }),
-		});
-		deps.engagement.findMessageByHeader = async () =>
-			({ messageId: "msg-parent" }) as unknown as never;
-		deps.engagement.getEnvelopeFromEmail = async () => "stranger@example.com";
+		await handleSendMessage(a.event, w.ctx, 1);
 
-		await sendMessage(event, silentLogger, deps);
-
-		assert.equal(recorded.replyIncrements.length, 0);
-	});
-
-	it("collapses duplicate replyCount increments via the resolved Address", async () => {
-		const { deps, recorded } = buildDeps({
-			outbox: buildOutbox({
-				toAddresses: ["bob@example.com"],
-				inReplyTo: "parent-msg@example.com",
-				references: ["root-msg@example.com", "parent-msg@example.com"],
-			}),
-			account: buildAccount({ smtpHost: "smtp.example.com", smtpPort: 587 }),
-		});
-		deps.engagement.findMessageByHeader = async () =>
-			({ messageId: "msg-parent" }) as unknown as never;
-		deps.engagement.getEnvelopeFromEmail = async () => "bob@example.com";
-
-		await sendMessage(event, silentLogger, deps);
-
-		assert.equal(
-			recorded.replyIncrements.length,
-			1,
-			"replyCount must increment once per resolved Address",
+		const counts = await Promise.all(
+			ids.map(
+				async (id) =>
+					(await w.repos.address.getAddress("cfg-1", id)).outboundCount,
+			),
 		);
+		assert.deepEqual(counts, [1, 1, 1]);
 	});
 
-	it("resolves a reply target via accountId (account-scoped message identity)", async () => {
-		const { deps, recorded } = buildDeps({
-			outbox: buildOutbox({
-				toAddresses: ["bob@example.com"],
-				inReplyTo: "parent-msg@example.com",
-			}),
-			account: buildAccount({ smtpHost: "smtp.example.com", smtpPort: 587 }),
-		});
-
-		const headerLookups: string[] = [];
-		deps.engagement.findMessageByHeader = async (accountId) => {
-			headerLookups.push(accountId);
-			return { messageId: "msg-parent" } as unknown as never;
+	it("does not fail the send when the engagement counters throw", async () => {
+		const a = await arrange(w);
+		const address = Object.create(w.repos.address);
+		address.incrementOutboundCount = async () => {
+			throw new Error("simulated outage");
 		};
-		deps.engagement.getEnvelopeFromEmail = async () => "bob@example.com";
-
-		await sendMessage(event, silentLogger, deps);
 
-		// Inbound messages are keyed by accountId now, so the reply lookup must
-		// pass the outbox's accountId ("acc-1"), never its accountConfigId ("cfg-1").
-		assert.ok(headerLookups.length > 0);
-		for (const id of headerLookups) {
-			assert.equal(id, "acc-1");
-		}
-		assert.equal(recorded.replyIncrements.length, 1);
-	});
-
-	it("does not fail the send when engagement counters throw", async () => {
-		const { deps, recorded } = buildDeps({
-			account: buildAccount({ smtpHost: "smtp.example.com", smtpPort: 587 }),
-		});
-		deps.engagement.incrementOutboundCount = async () => {
-			throw new Error("simulated DDB outage");
-		};
-
-		await sendMessage(event, silentLogger, deps);
+		await handleSendMessage(
+			a.event,
+			{ ...w.ctx, ports: { ...w.repos, address } },
+			1,
+		);
 
-		assert.equal(recorded.marked.length, 1, "send must still be marked sent");
-		assert.equal(recorded.appendCalls.length, 1, "append must still emit");
+		assert.equal((await outboxRow(w, a)).status, OutboxMessageStatus.sent);
+		assert.equal(w.queue.sent.length, 1, "append must still emit");
 	});
 });
 
-/**
- * The row is the only place the user learns a send stopped on re-auth, so every
- * branch that abandons the send has to leave a `blocked` row naming the remedy
- * (issue #1152).
- */
-const assertBlockedOnReauth = (recorded: Recorded): void => {
-	const settled = recorded.updates.at(-1)?.patch;
-	assert.equal(settled?.status, "blocked");
-	assert.match(String(settled?.lastError), /reconnected/i);
-	assert.match(String(settled?.lastError), /Reconnect/);
-};
+describe("handleSendMessage OAuth reauth/ACK contract", () => {
+	const oauthAccount = {
+		authType: AccountAuthType.OauthMicrosoft,
+		passwordHash: undefined,
+		oauthRefreshTokenHash: storedSecret("refresh-token"),
+	};
 
-describe("sendMessage OAuth reauth/ACK contract", () => {
 	it("blocks the message when the account already needs reauth (issue #1152)", async () => {
-		const { deps, recorded } = buildDeps({
-			account: buildAccount({
-				smtpHost: "smtp.example.com",
-				smtpPort: 587,
-				connectionState: "reauth_required",
-			}),
+		const a = await arrange(w, {
+			account: { ...oauthAccount, connectionState: "reauth_required" },
 		});
 
-		await sendMessage(event, silentLogger, deps);
+		await handleSendMessage(a.event, w.ctx, 1);
 
-		assert.equal(recorded.resolveCalls, 0, "must not resolve credentials");
-		assert.equal(recorded.sendCalls, 0, "must not send");
-		assert.equal(
-			recorded.connectionStateUpdates.length,
-			0,
-			"must not flip connectionState",
-		);
-		assertBlockedOnReauth(recorded);
-		assert.equal(recorded.statuses.length, 0, "must not change status");
+		assert.deepEqual(w.tokenRequests, [], "must not resolve credentials");
+		assert.deepEqual(w.requests, [], "must not send");
+		assert.equal((await accountRow(w, a)).connectionState, "reauth_required");
+		await assertBlockedOnReauth(w, a);
 	});
 
-	it("on RefreshTokenError reauth-required during credential resolution: flips to reauth_required and ACKs", async () => {
-		const { deps, recorded } = buildDeps({
-			account: buildAccount({ smtpHost: "smtp.example.com", smtpPort: 587 }),
-			resolveCredentials: async () => {
-				throw new RefreshTokenError({
-					kind: "reauth-required",
-					code: "invalid_grant",
-				});
-			},
-		});
+	it("flips to reauth_required and ACKs when the refresh token is revoked", async () => {
+		const a = await arrange(w, { account: oauthAccount });
 
-		await sendMessage(event, silentLogger, deps);
+		await handleSendMessage(
+			a.event,
+			{
+				...w.ctx,
+				tokenService: {
+					getAccessToken: async () => {
+						throw new RefreshTokenError({
+							kind: "reauth-required",
+							code: "invalid_grant",
+						});
+					},
+				},
+			},
+			1,
+		);
 
-		assert.equal(recorded.sendCalls, 0, "must not send");
-		assert.equal(recorded.connectionStateUpdates.length, 1);
-		assert.deepEqual(recorded.connectionStateUpdates[0], {
-			accountId: "acc-1",
-			state: "reauth_required",
-		});
-		assertBlockedOnReauth(recorded);
+		assert.deepEqual(w.requests, [], "must not send");
+		assert.equal((await accountRow(w, a)).connectionState, "reauth_required");
+		await assertBlockedOnReauth(w, a);
 	});
 
-	it("account storing no credential: settles `blocked` and never retries (issue #1120)", async () => {
-		const { deps, recorded } = buildDeps({
-			account: buildAccount({ passwordHash: undefined }),
-			resolveCredentials: async () => ({
-				status: "missing" as const,
-				terminalState: "credentials_missing" as const,
-				reason: "authType=password but no passwordHash",
-			}),
-		});
+	it("settles `blocked` and never retries for an account storing no credential (issue #1120)", async () => {
+		const a = await arrange(w, { account: { passwordHash: undefined } });
 
-		await sendMessage(event, silentLogger, deps);
+		await handleSendMessage(a.event, w.ctx, 1);
 
-		assert.equal(recorded.sendCalls, 0, "must not send");
-		assert.deepEqual(recorded.connectionStateUpdates, [
-			{ accountId: "acc-1", state: "credentials_missing" },
-		]);
-		assert.equal(recorded.updates[0]?.patch.status, "blocked");
+		assert.deepEqual(w.requests, [], "must not send");
+		assert.equal(
+			(await accountRow(w, a)).connectionState,
+			"credentials_missing",
+		);
+		assert.equal((await outboxRow(w, a)).status, OutboxMessageStatus.blocked);
 	});
 
-	it("on transient credential error: rethrows", async () => {
-		const { deps, recorded } = buildDeps({
-			account: buildAccount({ smtpHost: "smtp.example.com", smtpPort: 587 }),
-			resolveCredentials: async () => {
-				throw new RefreshTokenError({ kind: "transient", code: "503" });
-			},
-		});
+	it("rethrows a transient refresh failure without flipping the account", async () => {
+		const a = await arrange(w, { account: oauthAccount });
 
 		await assert.rejects(
-			() => sendMessage(event, silentLogger, deps),
+			() =>
+				handleSendMessage(
+					a.event,
+					{
+						...w.ctx,
+						tokenService: {
+							getAccessToken: async () => {
+								throw new RefreshTokenError({ kind: "transient", code: "503" });
+							},
+						},
+					},
+					1,
+				),
 			/transient/,
 		);
 		assert.equal(
-			recorded.connectionStateUpdates.length,
-			0,
-			"must not flip connectionState",
+			(await accountRow(w, a)).connectionState,
+			ConnectionState.Authenticated,
 		);
 	});
 
-	it("on SmtpConnectionError auth during credential resolution for OAuth account: flips to reauth_required and ACKs", async () => {
-		const { deps, recorded } = buildDeps({
-			account: buildAccount({
-				smtpHost: "smtp.example.com",
-				smtpPort: 587,
-				authType: AccountAuthType.OauthMicrosoft,
-			}),
-			resolveCredentials: async () => {
-				throw new SmtpConnectionError("auth", "535 authentication failed");
-			},
-		});
+	it("flips an OAuth account to reauth_required on an SMTP auth refusal while resolving", async () => {
+		const a = await arrange(w, { account: oauthAccount });
 
-		await sendMessage(event, silentLogger, deps);
+		await handleSendMessage(
+			a.event,
+			{
+				...w.ctx,
+				tokenService: {
+					getAccessToken: async () => {
+						throw new SmtpConnectionError("auth", "535 authentication failed");
+					},
+				},
+			},
+			1,
+		);
 
-		assert.equal(recorded.sendCalls, 0, "must not send");
-		assert.equal(recorded.connectionStateUpdates.length, 1);
-		assert.deepEqual(recorded.connectionStateUpdates[0], {
-			accountId: "acc-1",
-			state: "reauth_required",
-		});
-		assertBlockedOnReauth(recorded);
+		assert.deepEqual(w.requests, []);
+		assert.equal((await accountRow(w, a)).connectionState, "reauth_required");
+		await assertBlockedOnReauth(w, a);
 	});
 
-	it("on SmtpConnectionError auth during credential resolution for password account: rethrows (no state flip)", async () => {
-		const { deps, recorded } = buildDeps({
-			account: buildAccount({
-				smtpHost: "smtp.example.com",
-				smtpPort: 587,
-				authType: AccountAuthType.Password,
-			}),
-			resolveCredentials: async () => {
-				throw new SmtpConnectionError("auth", "535 authentication failed");
-			},
-		});
+	it("rethrows a password account's SMTP auth refusal while resolving, leaving the account alone", async () => {
+		const a = await arrange(w);
 
 		await assert.rejects(
-			() => sendMessage(event, silentLogger, deps),
+			() =>
+				handleSendMessage(
+					a.event,
+					{
+						...w.ctx,
+						secrets: {
+							...w.ctx.secrets,
+							decrypt: async () => {
+								throw new SmtpConnectionError(
+									"auth",
+									"535 authentication failed",
+								);
+							},
+						},
+					},
+					1,
+				),
 			/535 authentication failed/,
 		);
 		assert.equal(
-			recorded.connectionStateUpdates.length,
-			0,
-			"must not flip connectionState for password account",
+			(await accountRow(w, a)).connectionState,
+			ConnectionState.Authenticated,
 		);
 	});
 
-	it("on SmtpConnectionError auth during send for OAuth account: flips to reauth_required and ACKs", async () => {
-		const { deps, recorded } = buildDeps({
-			account: buildAccount({
-				smtpHost: "smtp.example.com",
-				smtpPort: 587,
-				authType: AccountAuthType.OauthMicrosoft,
-			}),
-			send: async () => {
-				throw new SmtpConnectionError("auth", "535 authentication failed");
-			},
-		});
+	it("flips an OAuth account to reauth_required when the server refuses its token, settling the row from `sending`", async () => {
+		w.close();
+		w = await openWorld({ authResponse: "535 5.7.8 Token rejected\r\n" });
+		const a = await arrange(w, { account: oauthAccount });
 
-		await sendMessage(event, silentLogger, deps);
+		await handleSendMessage(a.event, w.ctx, 1);
 
-		assert.equal(recorded.connectionStateUpdates.length, 1);
-		assert.deepEqual(recorded.connectionStateUpdates[0], {
-			accountId: "acc-1",
-			state: "reauth_required",
-		});
-		assertBlockedOnReauth(recorded);
-	});
-
-	it("on SmtpConnectionError auth during send for password account: rethrows (no state flip)", async () => {
-		const { deps, recorded } = buildDeps({
-			account: buildAccount({
-				smtpHost: "smtp.example.com",
-				smtpPort: 587,
-				authType: AccountAuthType.Password,
-			}),
-			send: async () => {
-				throw new SmtpConnectionError("auth", "535 authentication failed");
-			},
-		});
-
-		await assert.rejects(
-			() => sendMessage(event, silentLogger, deps),
-			/535 authentication failed/,
-		);
-		assert.equal(
-			recorded.connectionStateUpdates.length,
-			0,
-			"must not flip connectionState for password account",
-		);
+		const account = await accountRow(w, a);
+		assert.equal(account.connectionState, "reauth_required");
+		assert.match(String(account.lastError), /Token rejected/);
+		await assertBlockedOnReauth(w, a);
 	});
 
 	it("flips the connection state before it settles the row", async () => {
-		const { deps, recorded } = buildDeps({
-			resolveCredentials: async () => {
-				throw new RefreshTokenError({
-					kind: "reauth-required",
-					code: "invalid_grant",
-				});
-			},
-		});
+		const a = await arrange(w, { account: oauthAccount });
+		const writes: string[] = [];
+		const account = Object.create(w.repos.account);
+		account.update = (...args: Parameters<typeof w.repos.account.update>) => {
+			writes.push("connectionState");
+			return w.repos.account.update(...args);
+		};
+		const outboxMessage = Object.create(w.repos.outboxMessage);
+		outboxMessage.updateIfStatus = (
+			...args: Parameters<typeof w.repos.outboxMessage.updateIfStatus>
+		) => {
+			writes.push("outbox");
+			return w.repos.outboxMessage.updateIfStatus(...args);
+		};
 
-		await sendMessage(event, silentLogger, deps);
+		await handleSendMessage(
+			a.event,
+			{
+				...w.ctx,
+				ports: { ...w.repos, account, outboxMessage },
+				tokenService: {
+					getAccessToken: async () => {
+						throw new RefreshTokenError({
+							kind: "reauth-required",
+							code: "invalid_grant",
+						});
+					},
+				},
+			},
+			1,
+		);
 
 		// A settle that throws after the flip is redelivered into the fence, which
 		// settles the row. The other order leaves the account unfenced, and the
 		// settled row is outside the send fence so no redelivery gets back here.
-		assert.deepEqual(recorded.writeOrder, ["connectionState", "outbox"]);
+		assert.deepEqual(writes, ["connectionState", "outbox"]);
 	});
 
 	it("leaves a row the user pulled back into the composer alone", async () => {
-		const { deps, recorded } = buildDeps({
-			outbox: buildOutbox({ status: "draft" }),
-			account: buildAccount({ connectionState: "reauth_required" }),
+		const a = await arrange(w, {
+			account: { connectionState: "reauth_required" },
+			outbox: { status: OutboxMessageStatus.draft },
 		});
 
-		await sendMessage(event, silentLogger, deps);
+		await handleSendMessage(a.event, w.ctx, 1);
 
-		assert.equal(recorded.updates.length, 0, "must not overwrite the draft");
-		assert.equal(recorded.conditionalUpdates.length, 0, "must not even try");
-	});
-
-	it("settles a send-time rejection against `sending`, the status the row reached", async () => {
-		const { deps, recorded } = buildDeps({
-			account: buildAccount({ authType: AccountAuthType.OauthMicrosoft }),
-			send: async () => {
-				throw new SmtpConnectionError("auth", "535 authentication failed");
-			},
-		});
-
-		await sendMessage(event, silentLogger, deps);
-
-		assert.deepEqual(
-			recorded.conditionalUpdates.map((update) => update.expected),
-			["sending"],
-		);
-		assertBlockedOnReauth(recorded);
+		const row = await outboxRow(w, a);
+		assert.equal(row.status, OutboxMessageStatus.draft);
+		assert.equal(row.lastError, undefined);
 	});
 });
 
-/**
- * A connection failure as `smtp-client.ts` raises one: the code nodemailer put
- * on the underlying error is what says how far the submission got, and it
- * survives only on the cause.
- */
-const connectionError = (code: string): SmtpConnectionError =>
-	new SmtpConnectionError(
-		"network",
-		`SMTP connection failed: ${code}`,
-		Object.assign(new Error(code), { code }),
-	);
-
-describe("sendMessage retry-budget exhaustion (issue #951)", () => {
-	it("rethrows a password account's auth failure below the retry budget, leaving the row `sending`", async () => {
-		const { deps, recorded } = buildDeps({
-			account: buildAccount({
-				smtpHost: "smtp.example.com",
-				smtpPort: 587,
-				authType: AccountAuthType.Password,
-			}),
-			send: async () => {
-				throw new SmtpConnectionError("auth", "535 authentication failed");
-			},
-		});
+describe("handleSendMessage retry-budget exhaustion (issue #951)", () => {
+	it("rethrows a password account's auth refusal below the budget, leaving the row `sending`", async () => {
+		w.close();
+		w = await openWorld({ authResponse: "535 5.7.8 Bad credentials\r\n" });
+		const a = await arrange(w);
 
 		await assert.rejects(
-			() =>
-				sendMessage(event, silentLogger, deps, SEND_MESSAGE_MAX_ATTEMPTS - 1),
-			/535 authentication failed/,
-		);
-		assert.equal(
-			recorded.updates.length,
-			0,
-			"must not settle the row before the retry budget is spent",
+			() => handleSendMessage(a.event, w.ctx, MAX_ATTEMPTS - 1),
+			/authentication failed/,
 		);
+		assert.equal((await outboxRow(w, a)).status, OutboxMessageStatus.sending);
 	});
 
-	it("settles a password account's exhausted auth failure at `failed`, not stranded at `sending`", async () => {
-		const { deps, recorded } = buildDeps({
-			account: buildAccount({
-				smtpHost: "smtp.example.com",
-				smtpPort: 587,
-				authType: AccountAuthType.Password,
-			}),
-			send: async () => {
-				throw new SmtpConnectionError("auth", "535 authentication failed");
-			},
-		});
+	it("settles a password account's exhausted auth refusal at `failed`", async () => {
+		w.close();
+		w = await openWorld({ authResponse: "535 5.7.8 Bad credentials\r\n" });
+		const a = await arrange(w);
 
-		await sendMessage(event, silentLogger, deps, SEND_MESSAGE_MAX_ATTEMPTS);
+		await handleSendMessage(a.event, w.ctx, MAX_ATTEMPTS);
 
-		assert.equal(recorded.connectionStateUpdates.length, 0);
-		const failedUpdate = recorded.updates.find(
-			(u) => u.patch.status === "failed",
+		assert.equal(
+			(await accountRow(w, a)).connectionState,
+			ConnectionState.Authenticated,
 		);
-		assert.ok(failedUpdate, "should settle the row as failed");
-		assert.match(String(failedUpdate.patch.lastError), /authentication failed/);
+		const row = await outboxRow(w, a);
+		assert.equal(row.status, OutboxMessageStatus.failed);
+		assert.match(String(row.lastError), /authentication failed/);
+		assert.deepEqual(w.failures, ["auth"]);
 	});
 
-	it("settles an exhausted refused connection at `failed`, not stranded at `sending`", async () => {
-		const { deps, recorded } = buildDeps({
-			account: buildAccount({ smtpHost: "smtp.example.com", smtpPort: 587 }),
-			send: async () => {
-				throw connectionError("ECONNREFUSED");
-			},
-		});
-
-		await sendMessage(event, silentLogger, deps, SEND_MESSAGE_MAX_ATTEMPTS);
+	it("settles a refused connection at `failed` on the context's budget", async () => {
+		const a = await arrange(w);
 
-		const failedUpdate = recorded.updates.find(
-			(u) => u.patch.status === "failed",
+		await handleSendMessage(
+			a.event,
+			{ ...w.ctx, getSocket: refusingSocket("ECONNREFUSED"), maxAttempts: 1 },
+			1,
 		);
-		assert.ok(failedUpdate, "should settle the row as failed");
-		assert.match(String(failedUpdate.patch.lastError), /ECONNREFUSED/);
+
+		const row = await outboxRow(w, a);
+		assert.equal(row.status, OutboxMessageStatus.failed);
+		assert.match(String(row.lastError), /ECONNREFUSED/);
+		assert.deepEqual(w.failures, ["network"]);
 	});
 
 	for (const code of ["ECONNRESET", "ETIMEDOUT"]) {
 		it(`settles an exhausted ${code} at \`unfiled\` — the server may hold the message`, async () => {
 			// Both classify as `network` and both can land after DATA, so a
 			// `failed` row here would offer a Retry that delivers a second copy.
-			const { deps, recorded } = buildDeps({
-				account: buildAccount({ smtpHost: "smtp.example.com", smtpPort: 587 }),
-				send: async () => {
-					throw connectionError(code);
-				},
-			});
+			const a = await arrange(w);
 
-			await sendMessage(event, silentLogger, deps, SEND_MESSAGE_MAX_ATTEMPTS);
-
-			assert.equal(
-				recorded.updates.find((u) => u.patch.status === "failed"),
-				undefined,
-				"a row that may have been delivered must not be re-sendable",
-			);
-			const settled = recorded.updates.at(-1)?.patch;
-			assert.equal(settled?.status, "unfiled");
-			assert.match(
-				String(settled?.lastError),
-				/may already have been delivered/,
+			await handleSendMessage(
+				a.event,
+				{ ...w.ctx, getSocket: refusingSocket(code) },
+				MAX_ATTEMPTS,
 			);
-			assert.match(String(settled?.lastError), new RegExp(code));
-		});
-	}
 
-	it("settles an exhausted connection failure that names no code at `unfiled`", async () => {
-		// Nothing says the message did not reach the server, and the answer that
-		// cannot produce a second copy is the one to settle on.
-		const { deps, recorded } = buildDeps({
-			account: buildAccount({ smtpHost: "smtp.example.com", smtpPort: 587 }),
-			send: async () => {
-				throw new SmtpConnectionError("network", "SMTP connection failed");
-			},
+			const row = await outboxRow(w, a);
+			assert.equal(row.status, OutboxMessageStatus.unfiled);
+			assert.match(String(row.lastError), /may already have been delivered/);
+			assert.match(String(row.lastError), new RegExp(code));
 		});
+	}
 
-		await sendMessage(event, silentLogger, deps, SEND_MESSAGE_MAX_ATTEMPTS);
+	it("settles an exhausted transient SMTP refusal at `failed` instead of leaving it `queued` forever", async () => {
+		w.close();
+		w = await openWorld({ dataFinalResponse: "451 4.3.0 Try later\r\n" });
+		const a = await arrange(w);
 
-		assert.equal(recorded.updates.at(-1)?.patch.status, "unfiled");
-	});
+		await handleSendMessage(a.event, w.ctx, MAX_ATTEMPTS);
 
-	it("settles an exhausted transient SMTP failure at `failed` instead of leaving it `queued` forever", async () => {
-		const { deps, recorded } = buildDeps({
-			account: buildAccount({ smtpHost: "smtp.example.com", smtpPort: 587 }),
-			sendResult: {
-				success: false,
-				error: new Error("temporarily unavailable"),
-				smtpCode: 421,
-				isTransient: true,
-			},
-		});
-
-		await sendMessage(event, silentLogger, deps, SEND_MESSAGE_MAX_ATTEMPTS);
-
-		const failedUpdate = recorded.updates.find(
-			(u) => u.patch.status === "failed",
-		);
-		assert.ok(failedUpdate, "should settle the row as failed");
-		assert.equal(failedUpdate.patch.lastSmtpCode, 421);
-		assert.equal(
-			recorded.statuses.find((s) => s.status === "queued"),
-			undefined,
-			"must not leave the row requeued once the budget is spent",
-		);
-	});
-});
-
-describe("the retry budget is the queue's, read from the environment", () => {
-	it("takes the deployment's own maxReceiveCount when it is set", () => {
-		// The e2e stack sets 1 (`deploy/vps/e2e.env`): its pollers hold a record
-		// for 300s, so a spec cannot wait out three deliveries.
-		assert.equal(
-			getSendMessageMaxAttempts({ SEND_MESSAGE_MAX_ATTEMPTS: "1" }),
-			1,
-		);
-		assert.equal(
-			getSendMessageMaxAttempts({ SEND_MESSAGE_MAX_ATTEMPTS: "5" }),
-			5,
-		);
-	});
-
-	it("falls back to remit-smtp's maxReceiveCount when it is unset or unusable", () => {
-		assert.equal(getSendMessageMaxAttempts({}), 3);
-		assert.equal(
-			getSendMessageMaxAttempts({ SEND_MESSAGE_MAX_ATTEMPTS: "" }),
-			3,
-		);
-		assert.equal(
-			getSendMessageMaxAttempts({ SEND_MESSAGE_MAX_ATTEMPTS: "not-a-number" }),
-			3,
-		);
-		assert.equal(
-			getSendMessageMaxAttempts({ SEND_MESSAGE_MAX_ATTEMPTS: "0" }),
-			3,
-		);
+		const row = await outboxRow(w, a);
+		assert.equal(row.status, OutboxMessageStatus.failed);
+		assert.equal(row.lastSmtpCode, 451);
+		assert.deepEqual(w.failures, ["other"]);
 	});
 });