@remit/web-client 0.0.195 → 0.0.197

package/src/hooks/useIntelligenceSurface.ts

@@ -19,7 +19,11 @@ export interface IntelligenceSurface extends IntelligenceCommands {
 	closeDrawer: () => void;
 	/** Whether this width has room for the rail, so the rail is the surface. */
 	railFits: boolean;
-	/** Raise the rail if it fits and is down. The DKIM auto-open's way in. */
+	/**
+	 * Raise the rail if it fits and is down, for this thread only. The DKIM
+	 * auto-open's way in, so it never stores a preference the reader never gave
+	 * (#778).
+	 */
 	openRail: () => void;
 }
 
@@ -39,7 +43,8 @@ export interface IntelligenceCommands {
 export const useIntelligenceSurface = (
 	openThreadId: string | undefined,
 ): IntelligenceSurface => {
-	const { intelligenceOpen, onToggleIntelligence } = useMailContext();
+	const { intelligenceOpen, onToggleIntelligence, onRaiseIntelligence } =
+		useMailContext();
 	const railFits = useAppShellLayout()?.showIntelligencePane ?? false;
 	const threadId = openThreadId ?? null;
 	const drawer = useIntelligenceDrawer(threadId);
@@ -57,8 +62,8 @@ export const useIntelligenceSurface = (
 	}, [railFits, onToggleIntelligence, toggleDrawer]);
 	const openRail = useCallback(() => {
 		if (!railFits || intelligenceOpen) return;
-		onToggleIntelligence();
-	}, [railFits, intelligenceOpen, onToggleIntelligence]);
+		onRaiseIntelligence();
+	}, [railFits, intelligenceOpen, onRaiseIntelligence]);
 	const open = useCallback(() => {
 		if (!railFits) {
 			openDrawer();

package/src/hooks/useRailPanels.ts

@@ -0,0 +1,128 @@
+/**
+ * The binding between the address, this device's stored preference and what the
+ * `/mail` shell has up: pane 4 and the one overlay that may cover it.
+ *
+ * The rail goes up two ways and they are not the same fact. The reader's own
+ * control states where they want the rail from now on, so it writes both the
+ * preference and the address. A raise — the DKIM auto-open, the authenticity
+ * banner's "Why?" — surfaces the rail for the message in front of them and is
+ * held here, in memory, against that message: it never writes the preference,
+ * and opening anything else ends it. One message signed by the wrong domain used
+ * to mean the rail was up for every later thread and every later session (#778).
+ *
+ * The raise stays out of the address because its whole copy is computed from the
+ * open message — reload the URL and the mismatch raises it again on its own, so
+ * putting it in the fragment would be a second owner of a fact the message
+ * already holds (`docs/architecture/url-state.md`, R6).
+ */
+import { useCallback, useState } from "react";
+import { useLayoutTier } from "@/hooks/useLayoutTier";
+import {
+	readIntelligencePref,
+	resolveRailOpen,
+	writeIntelligencePref,
+} from "@/lib/intelligence-pref";
+import {
+	isOverlayPanel,
+	type OverlayPanel,
+	useOpenPanels,
+	useOpenThreadPath,
+	useSetOpenPanels,
+} from "@/routing";
+
+export interface RailPanels {
+	/** The overlay the address holds: the nav slide-over or the shortcuts sheet. */
+	openOverlay: OverlayPanel | undefined;
+	/** Whether pane 4 is up, by the reader's standing answer or a raise. */
+	intelligenceOpen: boolean;
+	showOverlay: (overlay: OverlayPanel | undefined) => void;
+	/**
+	 * The reader's own control, which is what a stored preference is made of —
+	 * except over a rail only a raise has up, where it ends the raise and stores
+	 * nothing.
+	 */
+	toggleIntelligence: () => void;
+	/** Puts the rail up for the message in front of the reader, and no further. */
+	raiseIntelligence: () => void;
+}
+
+export const useRailPanels = (): RailPanels => {
+	const tier = useLayoutTier();
+	// The panels the address carries (#722): the intelligence rail, the nav
+	// slide-over and the shortcuts sheet. The rail is a pane and the other two
+	// cover it, so the address holds a pane and an overlay at once — a sheet
+	// opening never takes the rail down — while two overlays cannot both be up.
+	const openPanels = useOpenPanels();
+	const setOpenPanels = useSetOpenPanels();
+	const openOverlay = openPanels.find(isOverlayPanel);
+	// Pane 4 on desktop, the details drawer below it. `resolveRailOpen` is the
+	// one place the address and the stored preference meet: the address decides
+	// whenever it says anything at all, and the preference opens the rail with
+	// the thread where it is silent (#782).
+	const openThread = useOpenThreadPath();
+	// Held in state, not read back from storage each render: closing the rail
+	// where the address is silent changes nothing about the address, and the
+	// answer has to move anyway.
+	const [prefersRail, setPrefersRail] = useState(readIntelligencePref);
+	// The message a raise belongs to. Naming it by address is what ends the raise
+	// when the reader opens anything else, without a teardown that has to run.
+	const openMessage = openThread
+		? `${openThread.threadId}/${openThread.messageId ?? ""}`
+		: null;
+	const [raisedFor, setRaisedFor] = useState<string | null>(null);
+	const visibility = {
+		panels: openPanels,
+		prefersOpen: prefersRail,
+		isDesktop: tier === "desktop",
+		hasThread: openThread !== undefined,
+		openMessage,
+	};
+	const intelligenceOpen = resolveRailOpen({ ...visibility, raisedFor });
+	// What the reader themselves have the rail at, which is what an address write
+	// states. A raise is left out of it on purpose: a sheet opening over a
+	// surfaced rail must not write that rail into the address as a choice.
+	const chosenOpen = resolveRailOpen({ ...visibility, raisedFor: null });
+	// Every write states the whole set, because it is composed from what is
+	// showing rather than from what the address happens to spell: the rail open
+	// by preference alone is still open, and an overlay must not close it.
+	const showPanels = useCallback(
+		(rail: boolean, overlay: OverlayPanel | undefined) => {
+			setOpenPanels([
+				...(rail ? (["intelligence"] as const) : []),
+				...(overlay ? [overlay] : []),
+			]);
+		},
+		[setOpenPanels],
+	);
+	const showOverlay = useCallback(
+		(overlay: OverlayPanel | undefined) => {
+			showPanels(chosenOpen, overlay);
+		},
+		[chosenOpen, showPanels],
+	);
+	const toggleIntelligence = useCallback(() => {
+		// Putting away a rail that only a raise has up answers the surfacing, not
+		// the question of where the reader wants the rail — the answer they gave
+		// last stands, and the address never carried this rail to rewrite.
+		if (intelligenceOpen && !chosenOpen) {
+			setRaisedFor(null);
+			return;
+		}
+		const open = !intelligenceOpen;
+		writeIntelligencePref(open);
+		setPrefersRail(open);
+		setRaisedFor(null);
+		showPanels(open, openOverlay);
+	}, [chosenOpen, intelligenceOpen, openOverlay, showPanels]);
+	const raiseIntelligence = useCallback(() => {
+		setRaisedFor(openMessage);
+	}, [openMessage]);
+
+	return {
+		openOverlay,
+		intelligenceOpen,
+		showOverlay,
+		toggleIntelligence,
+		raiseIntelligence,
+	};
+};

package/src/lib/delete-folder.test.ts

@@ -3,6 +3,7 @@ import { describe, it } from "node:test";
 import {
 	advanceMove,
 	beginMove,
+	elapsedLabel,
 	excludeFolder,
 	type FolderNode,
 	failMove,
@@ -262,6 +263,19 @@ describe("move progress", () => {
 	});
 });
 
+describe("elapsedLabel", () => {
+	it("counts a wait in minutes and padded seconds", () => {
+		assert.equal(elapsedLabel(0), "0:00");
+		assert.equal(elapsedLabel(9_400), "0:09");
+		assert.equal(elapsedLabel(65_000), "1:05");
+		assert.equal(elapsedLabel(600_000), "10:00");
+	});
+
+	it("reads a backwards clock as no time at all", () => {
+		assert.equal(elapsedLabel(-5_000), "0:00");
+	});
+});
+
 describe("initialStage", () => {
 	it("opens on the empty confirm for a folder with no mail", () => {
 		assert.equal(initialStage(0), "confirm-empty");

package/src/lib/delete-folder.ts

@@ -172,6 +172,12 @@ export function moveProgressLabel(progress: MoveProgress): string {
 	return `Moved ${progress.moved} of ${progress.total}`;
 }
 
+/** How long a wait has run, as `m:ss` — clamped at zero so a clock skew reads as 0:00. */
+export function elapsedLabel(ms: number): string {
+	const seconds = Math.max(0, Math.floor(ms / 1000));
+	return `${Math.floor(seconds / 60)}:${String(seconds % 60).padStart(2, "0")}`;
+}
+
 /** Where the wizard opens: a straight confirm for an empty folder, otherwise the fate step. */
 export function initialStage(
 	messageCount: number,

package/src/lib/fresh-mailbox-count.test.ts

@@ -0,0 +1,145 @@
+/**
+ * awaitFreshMailboxCount — the gate a folder delete holds behind while the
+ * server is asked what the folder actually holds. It reports a count only from
+ * a round that stamped past the baseline, reports `pending` rather than a count
+ * when the segment runs out, and refuses outright on a folder the account does
+ * not list.
+ */
+
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import {
+	awaitFreshMailboxCount,
+	FRESH_COUNT_MISSING_MESSAGE,
+	type MailboxCountReading,
+	mailboxSyncStamp,
+} from "./fresh-mailbox-count.js";
+
+const reading = (
+	messagesTotal: number,
+	lastSyncedAt?: number,
+): MailboxCountReading => ({
+	mailboxId: "mbx-1",
+	messagesTotal,
+	lastSyncedAt,
+});
+
+const noDelay = () => Promise.resolve();
+
+/** A clock that jumps a minute per reading, so a segment expires in two polls. */
+const impatientClock = () => {
+	let clock = 0;
+	return () => {
+		clock += 60_000;
+		return clock;
+	};
+};
+
+describe("mailboxSyncStamp", () => {
+	it("reads the folder's stamp, and zero for a folder never synced", () => {
+		assert.equal(mailboxSyncStamp([reading(0, 100)], "mbx-1"), 100);
+		assert.equal(mailboxSyncStamp([reading(0)], "mbx-1"), 0);
+	});
+
+	it("refuses a folder the account does not list", () => {
+		assert.throws(() => mailboxSyncStamp([], "mbx-1"), {
+			message: FRESH_COUNT_MISSING_MESSAGE,
+		});
+	});
+});
+
+describe("awaitFreshMailboxCount", () => {
+	it("resolves with the count a round stamped past the baseline", async () => {
+		const responses = [[reading(0, 100)], [reading(0, 100)], [reading(3, 200)]];
+		let call = 0;
+		const outcome = await awaitFreshMailboxCount({
+			mailboxId: "mbx-1",
+			since: 100,
+			readMailboxes: async () => responses[call++] as MailboxCountReading[],
+			delay: noDelay,
+		});
+		assert.deepEqual(outcome, { status: "fresh", messageCount: 3 });
+		assert.equal(call, 3);
+	});
+
+	it("never reports a count from a round older than the baseline", async () => {
+		// The stamp stands still — the folder was never re-read, so the zero
+		// sitting in the row is exactly the stale count that must not be trusted.
+		const outcome = await awaitFreshMailboxCount({
+			mailboxId: "mbx-1",
+			since: 100,
+			readMailboxes: async () => [reading(0, 100)],
+			delay: noDelay,
+			now: impatientClock(),
+		});
+		assert.deepEqual(outcome, { status: "pending" });
+	});
+
+	it("resumes against the same baseline and then reports the count", async () => {
+		let stamp = 100;
+		const readMailboxes = async () => [reading(2, stamp)];
+		const first = await awaitFreshMailboxCount({
+			mailboxId: "mbx-1",
+			since: 100,
+			readMailboxes,
+			delay: noDelay,
+			now: impatientClock(),
+		});
+		assert.deepEqual(first, { status: "pending" });
+
+		stamp = 300;
+		const second = await awaitFreshMailboxCount({
+			mailboxId: "mbx-1",
+			since: 100,
+			readMailboxes,
+			delay: noDelay,
+			now: impatientClock(),
+		});
+		assert.deepEqual(second, { status: "fresh", messageCount: 2 });
+	});
+
+	it("refuses a folder the account no longer lists", async () => {
+		await assert.rejects(
+			awaitFreshMailboxCount({
+				mailboxId: "mbx-1",
+				since: 100,
+				readMailboxes: async () => [],
+				delay: noDelay,
+			}),
+			{ message: FRESH_COUNT_MISSING_MESSAGE },
+		);
+	});
+
+	it("propagates a failed read rather than counting it as zero", async () => {
+		await assert.rejects(
+			awaitFreshMailboxCount({
+				mailboxId: "mbx-1",
+				since: 100,
+				readMailboxes: async () => {
+					throw new Error("sync status 500");
+				},
+				delay: noDelay,
+			}),
+			{ message: "sync status 500" },
+		);
+	});
+
+	it("stops on abort and never reports a count", async () => {
+		const controller = new AbortController();
+		let call = 0;
+		controller.abort();
+		await assert.rejects(
+			awaitFreshMailboxCount({
+				mailboxId: "mbx-1",
+				since: 100,
+				readMailboxes: async () => {
+					call += 1;
+					return [reading(0, 200)];
+				},
+				signal: controller.signal,
+				delay: noDelay,
+			}),
+		);
+		assert.equal(call, 0, "an aborted wait reads nothing");
+	});
+});

package/src/lib/fresh-mailbox-count.ts

@@ -0,0 +1,114 @@
+import { abortableDelay } from "./mailbox-sync-wait";
+
+/**
+ * How many messages a folder holds *on the mail server*, rather than how many
+ * the last sync round left in the local row.
+ *
+ * Every count the client can read — the mailbox row's `messageCount`, and so
+ * the folder list and the sync-status projection over it — is whatever the last
+ * round wrote. Mail that arrived since is invisible in it, which is fine for a
+ * badge and fatal for a delete: `deleteMailbox` takes the folder's mail with it
+ * and IMAP has no undo.
+ *
+ * So the count is taken from a round asked for on the spot: trigger a sync,
+ * then wait for the folder's `lastSyncedAt` to advance past the stamp read
+ * before the trigger, and read the count that round wrote alongside it (every
+ * message-sync round writes both from the same IMAP STATUS).
+ *
+ * What the advancing stamp proves is that *some* round's write landed after the
+ * baseline read — not necessarily the round this triggered. A round already in
+ * flight can land first and satisfy the wait. That is accepted: its STATUS was
+ * taken within milliseconds of the baseline, and the error it can carry is a
+ * count from a moment too early, which either agrees with the trigger's round
+ * or reports mail the folder had and the delete then refuses. The mistake lands
+ * on the side of not deleting.
+ *
+ * Nothing here decides on a count read before the trigger, and every way out
+ * other than an advanced stamp throws or reports `pending`: a folder missing
+ * from the account, a failed read, an aborted wait. Uncertainty about what a
+ * folder holds is never permission to delete it.
+ */
+
+/** The read fields the wait needs off a sync-status entry. */
+export interface MailboxCountReading {
+	mailboxId: string;
+	messagesTotal: number;
+	lastSyncedAt?: number;
+}
+
+/** A count from a round that reported after the baseline, or no round yet. */
+export type FreshCountOutcome =
+	| { status: "fresh"; messageCount: number }
+	| { status: "pending" };
+
+export interface AwaitFreshMailboxCountOptions {
+	/** Reads every mailbox's sync-status entry; called once per poll. */
+	readMailboxes: () => Promise<readonly MailboxCountReading[]>;
+	/** The folder to count. */
+	mailboxId: string;
+	/** The folder's `lastSyncedAt` as read before the sync was triggered. */
+	since: number;
+	/** Aborts the wait; a round that lands afterwards resolves nothing. */
+	signal?: AbortSignal;
+	/** How long this stretch of waiting runs before reporting `pending`. */
+	segmentMs?: number;
+	pollIntervalMs?: number;
+	/** Injectable clock/sleep for tests. */
+	delay?: (ms: number, signal?: AbortSignal) => Promise<void>;
+	now?: () => number;
+}
+
+/**
+ * How long one stretch of waiting runs before handing the decision back to the
+ * user. An explicit sync fans the whole account out on one FIFO group with
+ * INBOX first, so a folder on a large account can sit behind minutes of other
+ * mailboxes: this is not long enough to conclude anything, only long enough
+ * that someone watching a spinner deserves to be asked whether to keep waiting.
+ */
+export const FRESH_COUNT_SEGMENT_MS = 120_000;
+export const FRESH_COUNT_POLL_INTERVAL_MS = 2_000;
+
+export const FRESH_COUNT_MISSING_MESSAGE =
+	"This folder is no longer in the account's folder list, so nothing was deleted.";
+
+const entryFor = (
+	mailboxes: readonly MailboxCountReading[],
+	mailboxId: string,
+): MailboxCountReading => {
+	const entry = mailboxes.find((mailbox) => mailbox.mailboxId === mailboxId);
+	if (!entry) throw new Error(FRESH_COUNT_MISSING_MESSAGE);
+	return entry;
+};
+
+/** The folder's last sync stamp, or a refusal when the account does not list it. */
+export const mailboxSyncStamp = (
+	mailboxes: readonly MailboxCountReading[],
+	mailboxId: string,
+): number => entryFor(mailboxes, mailboxId).lastSyncedAt ?? 0;
+
+/**
+ * Poll for one segment. Resolves `fresh` with the count once a round reports
+ * past `since`, `pending` when the segment runs out with the folder still
+ * unreported — the caller asks the user whether to wait on, and calling again
+ * with the same `since` resumes without triggering a second round.
+ */
+export async function awaitFreshMailboxCount({
+	readMailboxes,
+	mailboxId,
+	since,
+	signal,
+	segmentMs = FRESH_COUNT_SEGMENT_MS,
+	pollIntervalMs = FRESH_COUNT_POLL_INTERVAL_MS,
+	delay = abortableDelay,
+	now = Date.now,
+}: AwaitFreshMailboxCountOptions): Promise<FreshCountOutcome> {
+	const deadline = now() + segmentMs;
+	for (;;) {
+		signal?.throwIfAborted();
+		const entry = entryFor(await readMailboxes(), mailboxId);
+		if ((entry.lastSyncedAt ?? 0) > since)
+			return { status: "fresh", messageCount: entry.messagesTotal };
+		if (now() >= deadline) return { status: "pending" };
+		await delay(pollIntervalMs, signal);
+	}
+}

package/src/lib/intelligence-pref.test.ts

@@ -58,7 +58,10 @@ describe("intelligence-pref (#782)", () => {
 });
 
 describe("resolveRailOpen (#722)", () => {
-	const withThread = { hasThread: true, isDesktop: true };
+	const OPEN_MESSAGE = "thread-1/msg-1";
+	// No raise live, and a message on screen for one to be measured against.
+	const unraised = { raisedFor: null, openMessage: OPEN_MESSAGE };
+	const withThread = { hasThread: true, isDesktop: true, ...unraised };
 
 	it("opens the rail with the thread where the address says nothing", () => {
 		assert.equal(
@@ -81,6 +84,7 @@ describe("resolveRailOpen (#722)", () => {
 				prefersOpen: true,
 				isDesktop: false,
 				hasThread: true,
+				...unraised,
 			}),
 			false,
 		);
@@ -94,6 +98,7 @@ describe("resolveRailOpen (#722)", () => {
 				prefersOpen: true,
 				isDesktop: true,
 				hasThread: false,
+				...unraised,
 			}),
 			false,
 		);
@@ -127,6 +132,68 @@ describe("resolveRailOpen (#722)", () => {
 				prefersOpen: false,
 				isDesktop: false,
 				hasThread: true,
+				...unraised,
+			}),
+			true,
+		);
+	});
+});
+
+/**
+ * A DKIM mismatch, or the banner's "Why?", puts the rail up for the message the
+ * reader is looking at. It is measured against that message rather than stored,
+ * so it reaches neither the address nor the preference, and the next thread the
+ * reader opens is not carrying it (#778).
+ */
+describe("a raised rail belongs to its message (#778)", () => {
+	const OPEN_MESSAGE = "thread-1/msg-1";
+	const collapsed = {
+		hasThread: true,
+		isDesktop: true,
+		panels: [] as const,
+		prefersOpen: false,
+	};
+
+	it("puts the rail up over a collapse for the message it was raised for", () => {
+		assert.equal(
+			resolveRailOpen({
+				...collapsed,
+				raisedFor: OPEN_MESSAGE,
+				openMessage: OPEN_MESSAGE,
+			}),
+			true,
+		);
+	});
+
+	it("ends with the message, so the next thread opens as the reader left it", () => {
+		assert.equal(
+			resolveRailOpen({
+				...collapsed,
+				raisedFor: OPEN_MESSAGE,
+				openMessage: "thread-2/msg-2",
+			}),
+			false,
+		);
+		assert.equal(
+			resolveRailOpen({
+				...collapsed,
+				hasThread: false,
+				raisedFor: OPEN_MESSAGE,
+				openMessage: null,
+			}),
+			false,
+		);
+	});
+
+	// The reader is being shown something about the message in front of them, so
+	// a link that named other panels does not get to suppress it.
+	it("surfaces over an address that named another panel", () => {
+		assert.equal(
+			resolveRailOpen({
+				...collapsed,
+				panels: ["shortcuts"],
+				raisedFor: OPEN_MESSAGE,
+				openMessage: OPEN_MESSAGE,
 			}),
 			true,
 		);

package/src/lib/intelligence-pref.ts

@@ -34,24 +34,38 @@ export interface RailVisibility {
 	isDesktop: boolean;
 	/** The rail reads a conversation, so with none open there is nothing to be up. */
 	hasThread: boolean;
+	/** The message a transient raise was made for, if one is live. */
+	raisedFor: string | null;
+	/** The message on screen, which is what a raise is measured against. */
+	openMessage: string | null;
 }
 
 /**
  * Whether the rail is up.
  *
- * An address that names any panel is the only owner of what is open, so a
- * shared link showing the shortcuts sheet is not overwritten by the recipient's
- * own preference. The preference speaks only where the address is silent, and
- * only with a conversation open on the tier that has a rail — it opens with the
- * thread there (#782), while a phone would get a full-screen drawer over a
- * message nobody asked to cover.
+ * A raise answers first, and only for the message it was made for: a DKIM
+ * mismatch or the banner's "Why?" surfaces the rail over a collapse, because
+ * the reader is being shown something about what is in front of them — and
+ * opening anything else ends it, so one mismatched signature is not the chrome
+ * of the whole session (#778). It is measured rather than stored, which is why
+ * it never reaches the address or the preference.
+ *
+ * Otherwise an address that names any panel is the only owner of what is open,
+ * so a shared link showing the shortcuts sheet is not overwritten by the
+ * recipient's own preference. The preference speaks only where the address is
+ * silent, and only with a conversation open on the tier that has a rail — it
+ * opens with the thread there (#782), while a phone would get a full-screen
+ * drawer over a message nobody asked to cover.
  */
 export function resolveRailOpen({
 	panels,
 	prefersOpen,
 	isDesktop,
 	hasThread,
+	raisedFor,
+	openMessage,
 }: RailVisibility): boolean {
+	if (raisedFor !== null && raisedFor === openMessage) return true;
 	if (panels.length > 0) return panels.includes("intelligence");
 	return isDesktop && hasThread && prefersOpen;
 }

package/src/lib/mail-context.ts

@@ -54,7 +54,14 @@ export interface MailContextValue {
 	 * alone would lose the preference and disagree with the shell.
 	 */
 	intelligenceOpen: boolean;
+	/** The reader's own control over pane 4, which stores what they chose. */
 	onToggleIntelligence: () => void;
+	/**
+	 * Puts pane 4 up for the thread in hand without touching the stored
+	 * preference: a DKIM mismatch surfacing the rail is about this message, not
+	 * about where the reader wants the rail from now on (#778).
+	 */
+	onRaiseIntelligence: () => void;
 }
 
 export const MailContext = createContext<MailContextValue | null>(null);
@@ -78,6 +85,7 @@ export const useMailContext = (): MailContextValue => {
 			onSearchClearQuery: () => {},
 			intelligenceOpen: false,
 			onToggleIntelligence: () => {},
+			onRaiseIntelligence: () => {},
 		}
 	);
 };

package/src/lib/mailbox-sync-wait.ts

@@ -50,7 +50,11 @@ export const MAILBOX_SYNC_FAILED_MESSAGE =
 export const MAILBOX_SYNC_TIMEOUT_MESSAGE =
 	"The folder was created but the mail server hasn't confirmed it yet, so nothing was attached to it. It's in your folder list — try again in a moment.";
 
-const defaultDelay = (ms: number, signal?: AbortSignal): Promise<void> =>
+/** `setTimeout` that rejects with the signal's reason instead of outliving it. */
+export const abortableDelay = (
+	ms: number,
+	signal?: AbortSignal,
+): Promise<void> =>
 	new Promise((resolve, reject) => {
 		if (signal?.aborted) {
 			reject(signal.reason);
@@ -81,7 +85,7 @@ export async function waitForMailboxSynced<T extends MailboxSyncSignal>({
 	signal,
 	timeoutMs = MAILBOX_SYNC_TIMEOUT_MS,
 	pollIntervalMs = MAILBOX_SYNC_POLL_INTERVAL_MS,
-	delay = defaultDelay,
+	delay = abortableDelay,
 	now = Date.now,
 }: WaitForMailboxSyncedOptions<T>): Promise<T> {
 	const deadline = now() + timeoutMs;