mail-time 5.2.1 → 5.3.1

package/index.cjs

@@ -304,20 +304,20 @@ const DEFAULT_PREFIX$2 = '';
 /**
  * @typedef {object} MongoCollection
  * @property {string} [collectionName]
- * @property {(keys: object, opts?: object) => Promise<unknown>} createIndex
- * @property {() => Promise<{ name: string, key: Record<string, unknown> }[]>} indexes
+ * @property {(keys: any, opts?: any) => Promise<unknown>} createIndex
+ * @property {() => Promise<{ name?: string, key: Record<string, unknown> }[]>} indexes
  * @property {(name: string) => Promise<unknown>} dropIndex
- * @property {(query: object, opts?: object) => unknown} find
- * @property {(query: object, opts?: object) => Promise<object|null>} findOne
- * @property {(doc: object) => Promise<unknown>} insertOne
- * @property {(query: object) => Promise<{ deletedCount?: number }>} deleteOne
- * @property {(query: object, update: object) => Promise<{ modifiedCount?: number }>} updateOne
+ * @property {(query: any, opts?: any) => unknown} find
+ * @property {(query: any, opts?: any) => Promise<object|null>} findOne
+ * @property {(doc: any) => Promise<unknown>} insertOne
+ * @property {(query: any) => Promise<{ deletedCount?: number }>} deleteOne
+ * @property {(query: any, update: any) => Promise<{ modifiedCount?: number, matchedCount?: number }>} updateOne
  */
 
 /**
  * @typedef {object} Db
  * @property {(name: string) => MongoCollection} collection
- * @property {(cmd: object) => Promise<{ ok?: number }>} command
+ * @property {(cmd: any) => Promise<{ ok?: number }>} command
  */
 
 /**
@@ -748,7 +748,7 @@ class MongoQueue {
  * @property {() => Promise<string>} [ping]
  * @property {() => unknown} [getRandomNode]
  * @property {(...args: any[]) => any} [nodeClient]
- * @property {(firstKey: string, isReadonly: boolean, args: string[]) => Promise<unknown>} [sendCommand]
+ * @property {(...args: any[]) => Promise<unknown>} [sendCommand]
  * @property {(options: object) => AsyncIterable<string|string[]>} [scanIterator]
  * @property {(key: string, field: string) => Promise<string|null|undefined>} [hGet]
  * @property {(script: string, options: { keys: string[], arguments: string[] }) => Promise<unknown>} [eval]
@@ -947,6 +947,12 @@ const isNoScriptError = (error) => {
   return !!error && (error.code === 'NOSCRIPT' || (typeof error.message === 'string' && error.message.includes('NOSCRIPT')));
 };
 
+// node-redis 4/5 throw `WatchError` from `exec()` when a watched key changed; that is the
+// expected outcome of a lost CAS race, not a storage failure.
+const isWatchError = (error) => {
+  return !!error && (error.name === 'WatchError' || error.constructor?.name === 'WatchError');
+};
+
 const canReleaseLease = (currentTask, updateObj) => {
   return currentTask
     && currentTask.tries === updateObj.leaseTries
@@ -1340,15 +1346,19 @@ class RedisQueue {
     const taskJSON = JSON.stringify(task);
 
     if (typeof this.client.multi === 'function') {
-      const multi = this.client.multi();
-      multi.set(letterKey, taskJSON);
-      multi.set(sendatKey, `${task.sendAt}`);
-      if (task.to) {
-        multi.set(this.__getKey(task.to, 'concatletter'), task.uuid, {
-          PXAT: task.sendAt - 128,
-        });
-      }
-      await multi.exec();
+      // EXEC discards every WATCH on the connection, so an unserialized push would turn a
+      // concurrent claim's guarded MULTI into an unconditional write (duplicate send).
+      await this.__serialize(async () => {
+        const multi = this.client.multi();
+        multi.set(letterKey, taskJSON);
+        multi.set(sendatKey, `${task.sendAt}`);
+        if (task.to) {
+          multi.set(this.__getKey(task.to, 'concatletter'), task.uuid, {
+            PXAT: task.sendAt - 128,
+          });
+        }
+        await multi.exec();
+      });
       return;
     }
 
@@ -1385,7 +1395,7 @@ class RedisQueue {
   }
 
   /** @internal */
-  async __cancel(uuid) {
+  async __cancel(uuid, attempt = 0) {
     this.__debug('[cancel]', uuid);
     if (typeof uuid !== 'string') {
       return false;
@@ -1406,7 +1416,10 @@ class RedisQueue {
         const args = keep
           ? [uuid, JSON.stringify({ isCancelled: true }), 'cancel', `${Date.now()}`, `${this.mailTimeInstance.sendingTimeout || 300000}`, '0', '0', payload, JSON.stringify({ ...task, isCancelled: true })]
           : [uuid, 'cancel', '0', '0'];
-        return Number(await this.__runScript(keep ? 'update' : 'remove', { keys, arguments: args })) >= 1;
+        const result = Number(await this.__runScript(keep ? 'update' : 'remove', { keys, arguments: args }));
+        // -1: the payload changed between hGet and the script (a claim renewal, for example); retry on a fresh snapshot
+        if (result === -1 && attempt < 2) return await this.__cancel(uuid, attempt + 1);
+        return result >= 1;
       }
       if (!atomic) {
         if (task.recipientResults != null) return false;
@@ -1418,7 +1431,7 @@ class RedisQueue {
       multi.del(this.__getKey(uuid, 'sendat'));
       return (await multi.exec()) !== null;
     } catch (error) {
-      logError('[cancel] storage error', error);
+      if (!isWatchError(error)) logError('[cancel] storage error', error);
       return false;
     } finally {
       if (!this.useHashTags && atomic) await this.client.unwatch?.();
@@ -1475,7 +1488,9 @@ class RedisQueue {
         return false;
       }
       try {
+        const concatKey = task.to ? this.__getKey(task.to, 'concatletter') : null;
         await this.client.watch(letterKey);
+        if (concatKey) await this.client.watch(concatKey);
         const taskJSON = await this.client.get(letterKey);
         if (!taskJSON) {
           await this.client.unwatch?.();
@@ -1493,8 +1508,9 @@ class RedisQueue {
           return false;
         }
         const keysToDelete = [letterKey, this.__getKey(task.uuid, 'sendat')];
-        if (task.to) {
-          keysToDelete.push(this.__getKey(task.to, 'concatletter'));
+        // The pointer may already name a newer letter folded for the same recipient.
+        if (concatKey && (await this.client.get(concatKey)) === task.uuid) {
+          keysToDelete.push(concatKey);
         }
         const multi = this.client.multi();
         for (const key of keysToDelete) {
@@ -1503,7 +1519,7 @@ class RedisQueue {
         const result = await multi.exec();
         return result !== null;
       } catch (opError) {
-        logError('[remove] [lease] [opError]', opError);
+        if (!isWatchError(opError)) logError('[remove] [lease] [opError]', opError);
         return false;
       }
     }
@@ -1515,7 +1531,10 @@ class RedisQueue {
 
     const keysToDelete = [letterKey, this.__getKey(task.uuid, 'sendat')];
     if (task.to) {
-      keysToDelete.push(this.__getKey(task.to, 'concatletter'));
+      const concatKey = this.__getKey(task.to, 'concatletter');
+      if ((await this.client.get(concatKey)) === task.uuid) {
+        keysToDelete.push(concatKey);
+      }
     }
     await this.client.del(keysToDelete);
     return true;
@@ -1675,7 +1694,7 @@ class RedisQueue {
       }
       return true;
     } catch (opError) {
-      logError('[update] [try/catch] [opError]', opError);
+      if (!isWatchError(opError)) logError('[update] [try/catch] [opError]', opError);
       return false;
     }
   }
@@ -1716,6 +1735,8 @@ class RedisQueue {
 /**
  * @typedef {object} PostgresClient
  * @property {(queryText: string, values?: unknown[]) => Promise<PostgresQueryResult>} query
+ * @property {(...args: any[]) => any} [connect] - a client whose constructor name ends in `Pool` or that has a numeric `totalCount` (`pg.Pool`) is treated as a pool; setup checks out one connection
+ * @property {number} [totalCount]
  */
 
 /**
@@ -1816,8 +1837,18 @@ class PostgresQueue {
   /** @internal */
   __applyPrefix(prefix) {
     this.prefix = prefix;
-    this.__readyPromise = this.__setup();
-    this.__readyPromise.catch(() => void 0);
+    this.__startSetup();
+  }
+
+  /** @internal */
+  __startSetup() {
+    const setup = this.__setup();
+    this.__readyPromise = setup;
+    // A failed setup (database still booting) must not poison every later call; the next
+    // ready() retries it. The awaiting caller still sees this attempt's rejection.
+    setup.catch(() => {
+      if (this.__readyPromise === setup) this.__readyPromise = null;
+    });
   }
 
   /** @internal */
@@ -1842,16 +1873,25 @@ class PostgresQueue {
   async ready() {
     this.__ensurePrefix();
     this.__debug('[ready]');
+    if (!this.__readyPromise) this.__startSetup();
     await this.__readyPromise;
   }
 
   /** @internal */
   async __setup() {
     const advisoryLockKey = advisoryLockKeyFor(this.prefix);
-    await this.client.query('SELECT pg_advisory_lock($1, $2)', [ADVISORY_LOCK_NAMESPACE, advisoryLockKey]);
+    // `pg_advisory_lock` is session-scoped. Through a `pg.Pool` each `query()` may use a
+    // different connection, so lock, DDL and unlock must share one checked-out client;
+    // otherwise the lock stays on an idle pooled connection and blocks peer startups.
+    const pooled = typeof this.client.connect === 'function'
+      && (typeof this.client.totalCount === 'number' || /Pool$/.test(this.client.constructor?.name || ''));
+    const conn = pooled ? await this.client.connect() : this.client;
+    let locked = false;
 
     try {
-      await this.client.query(`CREATE TABLE IF NOT EXISTS mail_time_queue (
+      await conn.query('SELECT pg_advisory_lock($1, $2)', [ADVISORY_LOCK_NAMESPACE, advisoryLockKey]);
+      locked = true;
+      await conn.query(`CREATE TABLE IF NOT EXISTS mail_time_queue (
           id BIGSERIAL PRIMARY KEY,
           prefix TEXT NOT NULL DEFAULT 'default',
           uuid TEXT NOT NULL,
@@ -1872,18 +1912,22 @@ class PostgresQueue {
           created_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP,
           updated_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP
         )`);
-      await this.client.query('ALTER TABLE mail_time_queue ADD COLUMN IF NOT EXISTS is_settled BOOLEAN NOT NULL DEFAULT false');
-      await this.client.query('ALTER TABLE mail_time_queue ADD COLUMN IF NOT EXISTS recipient_results JSONB');
-      await this.client.query(`CREATE UNIQUE INDEX IF NOT EXISTS idx_mail_time_queue_prefix_uuid
+      await conn.query('ALTER TABLE mail_time_queue ADD COLUMN IF NOT EXISTS is_settled BOOLEAN NOT NULL DEFAULT false');
+      await conn.query('ALTER TABLE mail_time_queue ADD COLUMN IF NOT EXISTS recipient_results JSONB');
+      await conn.query(`CREATE UNIQUE INDEX IF NOT EXISTS idx_mail_time_queue_prefix_uuid
         ON mail_time_queue (prefix, uuid)`);
 
-      await this.client.query(`CREATE INDEX IF NOT EXISTS idx_mail_time_queue_policy_due_v1
+      await conn.query(`CREATE INDEX IF NOT EXISTS idx_mail_time_queue_policy_due_v1
         ON mail_time_queue (prefix, is_settled, is_sent, is_failed, is_cancelled, is_sending, sending_at, send_at, tries)`);
 
-      await this.client.query(`CREATE INDEX IF NOT EXISTS idx_mail_time_queue_policy_pending_to_v1
+      await conn.query(`CREATE INDEX IF NOT EXISTS idx_mail_time_queue_policy_pending_to_v1
         ON mail_time_queue (prefix, to_address, is_settled, is_sent, is_failed, is_cancelled, send_at)`);
     } finally {
-      await this.client.query('SELECT pg_advisory_unlock($1, $2)', [ADVISORY_LOCK_NAMESPACE, advisoryLockKey]);
+      try {
+        if (locked) await conn.query('SELECT pg_advisory_unlock($1, $2)', [ADVISORY_LOCK_NAMESPACE, advisoryLockKey]);
+      } finally {
+        if (pooled) conn.release();
+      }
     }
   }
 
@@ -2446,29 +2490,113 @@ const mailTimePreset = (name, overrides) => {
 
 const policyError = (message) => new Error(`[mail-time] [recipientPolicies] ${message}`);
 const SIMPLE_MAILBOX = /^[^\s<>,;:"()\\\[\]@]+@[^\s<>,;:"()\\\[\]@]+$/u;
+// Unquoted display-name characters that are auto-quoted in the sent header; `,` `;` `:` `<` `>` stay rejected.
+const QUOTABLE_SPECIALS = /[()[\]@\\]/u;
+const UNSAFE_CHARS = /[\r\n\u0000]/u;
+
+/**
+ * Error for an address that cannot be parsed into exactly one mailbox. The message names
+ * the field and the rule that failed, never the address or display name itself.
+ */
+const addressError = (field, reason) => {
+  const error = policyError(`\`${field}\` ${reason}`);
+  error.code = 'MAIL_TIME_INVALID_ADDRESS';
+  error.field = field;
+  return error;
+};
+
+const isAddressError = (error) => error?.code === 'MAIL_TIME_INVALID_ADDRESS';
 
-const normalizePolicyAddress = (value) => {
-  const input = typeof value === 'string' ? value : (!Array.isArray(value) && value?.address);
-  if (typeof input !== 'string' || /[\r\n]/u.test(input)) {
-    throw policyError('recipient requires a simple address without line breaks');
+const toMailbox = (address, field) => {
+  const trimmed = address.trim();
+  if (!SIMPLE_MAILBOX.test(trimmed)) throw addressError(field, 'must contain one address such as user@example.com; quoted local parts are not supported');
+  return trimmed.toLowerCase();
+};
+
+/**
+ * Parse one Nodemailer mailbox string: `addr`, `<addr>`, or `display name <addr>`, where the
+ * display name is any mix of atoms and quoted strings with backslash escapes. Unquoted
+ * `( ) [ ] @ \\` in a display name set `quote`, so the sent header carries the name quoted.
+ * Groups, comma-separated lists, and text after `>` are rejected rather than guessed at.
+ * @returns {{ name: string, address: string, quote: boolean }} `address` keeps its case.
+ */
+const parseMailboxString = (input, field) => {
+  let display = '';
+  let name = '';
+  let angle = null;
+  let quoted = false;
+  for (let i = 0; i < input.length; i++) {
+    const char = input[i];
+    if (quoted) {
+      if (char === '\\') {
+        if (++i >= input.length) break;
+        name += input[i];
+      } else if (char === '"') {
+        quoted = false;
+      } else {
+        name += char;
+      }
+      continue;
+    }
+    if (char === '"') {
+      quoted = true;
+    } else if (char === '<') {
+      const close = input.indexOf('>', i + 1);
+      if (close === -1) throw addressError(field, 'has an unclosed angle bracket');
+      angle = input.slice(i + 1, close);
+      if (input.slice(close + 1).trim()) throw addressError(field, 'must end after the angle-bracket address; use an array for multiple recipients');
+      break;
+    } else if (char === ',') {
+      throw addressError(field, 'must contain one mailbox; use an array for multiple recipients or quote a display name that contains a comma');
+    } else if (char === ';' || char === ':') {
+      throw addressError(field, 'must not use group syntax');
+    } else if (char === '>') {
+      throw addressError(field, 'has an unquoted `>` in its display name; wrap the name in double quotes');
+    } else {
+      display += char;
+      name += char;
+    }
   }
-  let address = input.trim();
-  if (address.includes('<') || address.includes('>')) {
-    const match = address.match(/^[^<>,;:"\r\n]*<([^<>]+)>$/u);
-    if (!match) throw policyError('use a simple explicit envelope.to');
-    address = match[1].trim();
+  if (quoted) throw addressError(field, 'has an unterminated quoted display name');
+  if (angle === null) {
+    if (display !== input) throw addressError(field, 'must contain one address such as user@example.com; quoted local parts are not supported');
+    toMailbox(input, field);
+    return { name: '', address: input, quote: false };
   }
-  if (!SIMPLE_MAILBOX.test(address)) throw policyError('use a simple explicit envelope.to');
-  return address.toLowerCase();
+  toMailbox(angle, field);
+  return { name: name.replace(/\s+/gu, ' ').trim(), address: angle.trim(), quote: QUOTABLE_SPECIALS.test(display) };
+};
+
+/**
+ * Normalize exactly one mailbox (string or `{ name?, address }`) to its lowercase address.
+ * @param {unknown} value
+ * @param {string} [field] - Field label used in errors, e.g. `to[1]` or `envelope.from`.
+ * @returns {string}
+ */
+const normalizePolicyAddress = (value, field = 'address') => {
+  if (typeof value === 'string') {
+    if (UNSAFE_CHARS.test(value)) throw addressError(field, 'must not contain line breaks or NUL characters');
+    if (!value.trim()) throw addressError(field, 'must not be empty');
+    return parseMailboxString(value.trim(), field).address.toLowerCase();
+  }
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw addressError(field, 'must be an address string or a { name, address } object');
+  if (typeof value.address !== 'string') throw addressError(field, 'object requires a string `address`');
+  if (value.name !== void 0 && typeof value.name !== 'string') throw addressError(field, 'object `name` must be a string');
+  if (UNSAFE_CHARS.test(value.address) || (value.name && UNSAFE_CHARS.test(value.name))) {
+    throw addressError(field, 'must not contain line breaks or NUL characters');
+  }
+  return toMailbox(value.address, field);
 };
 
 const preparePolicyEnvelope = (compiled, previousResults = []) => {
   const recipients = new Map();
   const explicit = compiled.envelope && hasOwnProp(compiled.envelope, 'to');
-  const add = (value, source, authoritative) => {
-    for (const entry of Array.isArray(value) ? value : [value]) {
+  const add = (value, source, authoritative, label = source) => {
+    const list = Array.isArray(value);
+    const entries = list ? value : [value];
+    for (let i = 0; i < entries.length; i++) {
       let address;
-      try { address = normalizePolicyAddress(entry); }
+      try { address = normalizePolicyAddress(entries[i], list ? `${label}[${i}]` : label); }
       catch (error) { if (authoritative) throw error; else continue; }
       if (!recipients.has(address)) {
         if (!authoritative) continue;
@@ -2478,7 +2606,7 @@ const preparePolicyEnvelope = (compiled, previousResults = []) => {
       if (!sources.includes(source)) sources.push(source);
     }
   };
-  if (explicit) add(compiled.envelope.to, 'envelope', true);
+  if (explicit) add(compiled.envelope.to, 'envelope', true, 'envelope.to');
   for (const source of ['to', 'cc', 'bcc']) {
     if (hasOwnProp(compiled, source) && compiled[source] !== void 0) add(compiled[source], source, !explicit);
   }
@@ -2488,14 +2616,65 @@ const preparePolicyEnvelope = (compiled, previousResults = []) => {
   }
   const envelope = { to: [...recipients.keys()] };
   if (compiled.envelope && hasOwnProp(compiled.envelope, 'from')) {
-    envelope.from = compiled.envelope.from === '' ? '' : normalizePolicyAddress(compiled.envelope.from);
+    envelope.from = compiled.envelope.from === '' ? '' : normalizePolicyAddress(compiled.envelope.from, 'envelope.from');
   } else {
-    const from = compiled.from || compiled.sender || compiled.replyTo;
-    if (from) envelope.from = normalizePolicyAddress(from);
+    // Same precedence as Nodemailer's getEnvelope(): From, then Sender, then Reply-To.
+    const field = ['from', 'sender', 'replyTo'].find((key) => compiled[key]);
+    if (field) envelope.from = normalizePolicyAddress(compiled[field], field);
   }
   return { envelope, recipients: [...recipients.values()] };
 };
 
+/**
+ * Return `compiled` with every header mailbox string whose display name needs quoting replaced by
+ * `{ name, address }`, so Nodemailer renders the same mailbox the policy checked. Other entries,
+ * including ones that do not parse, are left as they are. The input is never mutated.
+ */
+const rewritePolicyHeaders = (compiled) => {
+  let result = compiled;
+  const rewrite = (value) => {
+    if (typeof value !== 'string' || UNSAFE_CHARS.test(value)) return value;
+    try {
+      const { name, address, quote } = parseMailboxString(value.trim(), 'header');
+      return quote ? { name, address } : value;
+    } catch { return value; }
+  };
+  for (const key of ['from', 'sender', 'replyTo', 'to', 'cc', 'bcc']) {
+    if (!hasOwnProp(compiled, key)) continue;
+    const value = compiled[key];
+    const next = Array.isArray(value) ? value.map(rewrite) : rewrite(value);
+    if (Array.isArray(value) ? next.some((entry, i) => entry !== value[i]) : next !== value) {
+      if (result === compiled) result = { ...compiled };
+      result[key] = next;
+    }
+  }
+  return result;
+};
+
+/**
+ * Validate every address field present in a letter with the policy parser, so an unparseable
+ * address is rejected at `sendMail()` instead of after a queue round trip. Absent fields are
+ * skipped. Throws the same `MAIL_TIME_INVALID_ADDRESS` error the send path would.
+ * @param {object} mailOptions
+ * @returns {void}
+ */
+const validatePolicyMailOptions = (mailOptions) => {
+  const check = (value, label) => {
+    if (value === void 0) return;
+    if (Array.isArray(value)) value.forEach((entry, i) => normalizePolicyAddress(entry, `${label}[${i}]`));
+    else normalizePolicyAddress(value, label);
+  };
+  const explicit = isPlainObject(mailOptions.envelope) && hasOwnProp(mailOptions.envelope, 'to');
+  // With an explicit `envelope.to`, `preparePolicyEnvelope` treats header recipients as
+  // non-authoritative (group syntax stays legal), so do not reject them here either.
+  const keys = explicit ? ['from', 'sender', 'replyTo'] : ['from', 'sender', 'replyTo', 'to', 'cc', 'bcc'];
+  for (const key of keys) check(mailOptions[key], key);
+  if (isPlainObject(mailOptions.envelope)) {
+    check(mailOptions.envelope.to, 'envelope.to');
+    if (mailOptions.envelope.from !== '') check(mailOptions.envelope.from, 'envelope.from');
+  }
+};
+
 const validateRecipientPolicies = (value, queue) => {
   if (value === void 0) return null;
   if (!Array.isArray(value) || !value.length) throw policyError('recipientPolicies must be a nonempty array');
@@ -2532,7 +2711,7 @@ const validatePolicyResult = (raw, hook, context) => {
   const decisions = new Map();
   for (const item of raw.decisions) {
     if (!isPlainObject(item)) throw policyError('decision must be an object');
-    const address = normalizePolicyAddress(item.address);
+    const address = normalizePolicyAddress(item.address, 'decision.address');
     if (!batch.has(address)) throw policyError('decision address is outside the input batch');
     const allowed = hook === 'beforeSend' ? item.status === 'suppressed' : (item.status === 'retry' || item.status === 'rejected');
     if (!allowed) throw policyError('invalid decision status for this phase');
@@ -2666,7 +2845,11 @@ const normalizeRejections = (error, info, transport) => {
 };
 
 class RecipientPolicyLease {
-  constructor({ task, queue, interval, maxRenewals, shouldAbort, report }) {
+  constructor({ task, queue, interval, maxRenewals, sendingTimeout, shouldAbort, report }) {
+    if (typeof sendingTimeout !== 'number' || !(sendingTimeout > 0)) throw new TypeError('[mail-time] [recipientPolicies] RecipientPolicyLease requires a positive sendingTimeout');
+    this.__sendingTimeout = sendingTimeout;
+    this.__renewStale = false;
+    this.__liveAtAttempt = false;
     this.__task = task;
     this.__queue = queue;
     this.__shouldAbort = shouldAbort;
@@ -2674,6 +2857,8 @@ class RecipientPolicyLease {
     this.__closed = false;
     this.__finishing = false;
     this.__tail = Promise.resolve();
+    this.__renewUncertain = false;
+    this.__attemptedAt = 0;
     this.__timer = null;
     let pending = false;
     let renewals = 0;
@@ -2688,6 +2873,8 @@ class RecipientPolicyLease {
         renewals++;
         this.__enqueue(async (guard) => {
           const fields = { isSending: true, sendingAt: Math.max(Date.now(), this.__task.sendingAt + 1) };
+          this.__attemptedAt = fields.sendingAt;
+          this.__liveAtAttempt = this.__task.sendingAt > fields.sendingAt - this.__sendingTimeout;
           return await this.__write(fields, guard);
         }).finally(() => { pending = false; });
       }, interval);
@@ -2707,17 +2894,41 @@ class RecipientPolicyLease {
     this.__closed = true;
   }
 
-  __enqueue(operation) {
+  __enqueue(operation, phase = 'renew') {
     const pending = this.__tail.then(async () => {
       if (!this.active) return false;
       const guard = { leaseTries: this.__task.tries, leaseSendingAt: this.__task.sendingAt };
       try {
-        const ok = await operation(guard);
-        if (!ok) this.__halt();
+        let ok = await operation(guard);
+        if (!ok) {
+          // A renewal write that threw may have been applied by storage, which leaves the
+          // guard stale. Retry once with the attempted stamp: a peer takeover bumps tries or
+          // stamps a later sendingAt while the lease is live, so the retry cannot match a
+          // taken-over row. Report if it still fails.
+          if (this.__renewStale && phase !== 'renew') {
+            // The claim was already stale when the renewal threw: no retry, report the loss.
+            this.__renewStale = false;
+            this.__report(new Error('outcome write lost (renewal outcome uncertain or lease taken over)'), phase);
+          } else if (this.__renewUncertain && phase !== 'renew') {
+            this.__renewUncertain = false;
+            if (this.__shouldAbort()) {
+              this.__report(new Error('outcome write lost (renewal outcome uncertain or lease taken over)'), phase);
+              this.__halt();
+              return false;
+            }
+            ok = await operation({ ...guard, leaseSendingAt: this.__attemptedAt });
+            if (ok && phase === 'checkpoint') this.__task.sendingAt = this.__attemptedAt;
+            if (!ok) this.__report(new Error('outcome write lost (renewal outcome uncertain or lease taken over)'), phase);
+          }
+          if (!ok) this.__halt();
+        }
         return ok;
       } catch (error) {
-        this.__halt();
-        if (!this.__shouldAbort()) this.__report(error);
+        // A thrown renewal write only stops further renewals. The lease stays open so
+        // finish() still records the outcome; storage-side CAS protects row ownership.
+        if (phase === 'renew') { this.__clearTimer(); this.__renewUncertain = this.__liveAtAttempt; this.__renewStale = !this.__liveAtAttempt; }
+        else this.__halt();
+        this.__report(error, phase);
         return false;
       }
     });
@@ -2733,7 +2944,7 @@ class RecipientPolicyLease {
 
   update(fields) {
     if (this.__finishing) return Promise.resolve(false);
-    return this.__enqueue((guard) => this.__write(fields, guard));
+    return this.__enqueue((guard) => this.__write(fields, guard), 'checkpoint');
   }
 
   finish(fields, remove) {
@@ -2745,7 +2956,7 @@ class RecipientPolicyLease {
       if (ok) Object.assign(this.__task, fields);
       this.__halt();
       return ok;
-    });
+    }, 'complete');
   }
 
   async stop() {
@@ -3023,9 +3234,21 @@ let DEFAULT_TEMPLATE = '<!DOCTYPE html><html xmlns=http://www.w3.org/1999/xhtml>
  */
 
 /**
- * @typedef {{ queue: RedisQueue | MongoQueue | PostgresQueue | CustomQueue, type?: 'server' | 'client', from?: string | ((transport: MailTimeTransport, details: MailTimeFromDetails) => string), transports?: MailTimeTransport[], strategy?: 'backup' | 'balancer', failsToNext?: number, shouldFailOver?: (error: unknown, info: object | undefined, email: MailTimeTask) => boolean, retries?: number, maxTries?: number, retryDelay?: number, interval?: number, keepHistory?: boolean, concatEmails?: boolean | MailTimeConcatEmailsOptions, concatSubject?: string, concatDelimiter?: string, concatDelay?: number, concatThrottling?: number, revolvingInterval?: number, mode?: 'one' | 'batch', concurrency?: number, sendingTimeout?: number, renewClaim?: boolean | number, maxRenewals?: number, strictPayload?: boolean, allowedMailFields?: string[], verifyTransports?: boolean, template?: string, prefix?: string, debug?: boolean, josk?: MailTimeJoSkOptions, recipientPolicies?: MailTimeRecipientPolicy[], onError?: (error: unknown, email: MailTimeTask | null, details?: object, recipients?: MailTimeRecipientResult[], summary?: MailTimeRecipientSummary) => void | Promise<void>, onSent?: (email: MailTimeTask, details?: object, recipients?: MailTimeRecipientResult[], summary?: MailTimeRecipientSummary) => void | Promise<void>, onSuppressed?: (email: MailTimeTask, recipients: MailTimeRecipientResult[], summary: MailTimeRecipientSummary) => void | Promise<void>, onRejected?: (email: MailTimeTask, recipients: MailTimeRecipientResult[], summary: MailTimeRecipientSummary) => void | Promise<void> }} MailTimeOptions
+ * @typedef {{ failedWrites: number }} MailTimeDrainResult
+ */
+
+/**
+ * `details` passed to `onError`. `phase` is `'verify'` (transport verification, `email === null`), `'complete'` (a storage write recording a send outcome), or `'checkpoint'` (recipient-policy results written after SMTP). Without `phase` it is the SMTP `info` of the failed attempt.
+ * @typedef {{ phase?: 'verify' | 'complete' | 'checkpoint', transportIndex?: number, attempt?: number, [key: string]: unknown }} MailTimeErrorDetails
  */
 
+/**
+ * @typedef {{ queue: RedisQueue | MongoQueue | PostgresQueue | CustomQueue, type?: 'server' | 'client', from?: string | ((transport: MailTimeTransport, details: MailTimeFromDetails) => string), transports?: MailTimeTransport[], strategy?: 'backup' | 'balancer', failsToNext?: number, shouldFailOver?: (error: unknown, info: object | undefined, email: MailTimeTask) => boolean, retries?: number, maxTries?: number, retryDelay?: number, interval?: number, keepHistory?: boolean, concatEmails?: boolean | MailTimeConcatEmailsOptions, concatSubject?: string, concatDelimiter?: string, concatDelay?: number, concatThrottling?: number, revolvingInterval?: number, mode?: 'one' | 'batch', concurrency?: number, sendingTimeout?: number, renewClaim?: boolean | number, maxRenewals?: number, strictPayload?: boolean, allowedMailFields?: string[], verifyTransports?: boolean, verifyTimeout?: number, template?: string, prefix?: string, debug?: boolean, josk?: MailTimeJoSkOptions, recipientPolicies?: MailTimeRecipientPolicy[], onError?: (error: unknown, email: MailTimeTask | null, details?: MailTimeErrorDetails, recipients?: MailTimeRecipientResult[], summary?: MailTimeRecipientSummary) => void | Promise<void>, onSent?: (email: MailTimeTask, details?: object, recipients?: MailTimeRecipientResult[], summary?: MailTimeRecipientSummary) => void | Promise<void>, onSuppressed?: (email: MailTimeTask, recipients: MailTimeRecipientResult[], summary: MailTimeRecipientSummary) => void | Promise<void>, onRejected?: (email: MailTimeTask, recipients: MailTimeRecipientResult[], summary: MailTimeRecipientSummary) => void | Promise<void> }} MailTimeOptions
+ */
+
+const REPROBE_BASE_MS = 60000;
+const REPROBE_MAX_MS = 900000;
+
 /**
  * Class of MailTime.
  * With recipientPolicies, terminal callbacks receive grouped recipients and a complete summary after persistence.
@@ -3128,6 +3351,7 @@ class MailTime {
     this.__readyPromise = null;
     this.__schedulerTimer = null;
     this.__inFlight = new Set();
+    this.__failedWrites = 0;
     this.__pool = createPool(this.concurrency);
 
     this.failsToNext = (typeof opts.failsToNext === 'number' && opts.failsToNext > 0) ? opts.failsToNext : 4;
@@ -3135,7 +3359,12 @@ class MailTime {
     this.transports = Array.isArray(opts.transports) ? opts.transports : [];
     this.transport = 0;
     this.verifyTransports = opts.verifyTransports !== false;
+    this.verifyTimeout = (typeof opts.verifyTimeout === 'number' && opts.verifyTimeout > 0) ? Math.min(opts.verifyTimeout, 2147483647) : 30000;
     this.__unhealthyTransports = new Set();
+    this.__verifyGen = [];
+    this.__reprobe = new Map();
+    this.__probeCancels = new Set();
+    this.__uncertainRenewals = new WeakMap();
 
     if (typeof opts.from === 'string') {
       const fromStr = opts.from;
@@ -3146,6 +3375,21 @@ class MailTime {
       this.from = false;
     }
 
+    if (this.__recipientPolicies && this.type === 'server') {
+      // A transport `from` that the policy parser rejects would settle every rotated letter as
+      // failed; surface it here instead. A `from` callback is a runtime value and is not checked.
+      if (typeof opts.from === 'string') normalizePolicyAddress(opts.from, 'from');
+      this.transports.forEach((transport, i) => {
+        const from = MailTime.transportFrom(transport);
+        if (from !== void 0) normalizePolicyAddress(from, `transports[${i}].from`);
+        // `___compileMailOpts` merges these ahead of `this.from`, so they are sent as-is.
+        for (const key of ['_options', 'options']) {
+          const mailFrom = transport?.[key]?.mailOptions?.from;
+          if (mailFrom !== void 0) normalizePolicyAddress(mailFrom, `transports[${i}].${key}.mailOptions.from`);
+        }
+      });
+    }
+
     this.queue.mailTimeInstance = this;
 
     /** @type {string} */
@@ -3318,6 +3562,8 @@ class MailTime {
 
     this.__isDestroyed = true;
     this.__isPaused = false;
+    for (const cancel of [...this.__probeCancels]) cancel();
+    this.__reprobe.clear();
     // Queued jobs never started SMTP; dropping them lets a scan blocked on a
     // pool slot return, so JoSk shutdown does not wait for in-flight sends.
     this.__pool.cancelQueued();
@@ -3353,14 +3599,34 @@ class MailTime {
    * @async
    * @memberOf MailTime
    * @name drain
-   * @description Wait for all in-flight email send attempts to settle
-   * @returns {Promise<void>}
+   * @description Wait for all in-flight email send attempts to settle. Resolves with `{ failedWrites }`, the count since this instance was created of failures while recording a send outcome: a storage write that threw, an exception in the completion path, or an outcome write lost after a claim-renewal error (message `outcome write lost (renewal outcome uncertain or lease taken over)`, after one retry with the renewal's stamp (no retry when the claim was already stale at renewal time)). Each is also reported once through `onError` with `details.phase` of `'complete'` or `'checkpoint'`, except after a plain `destroy()`, which still counts but suppresses the hook and the log. A row whose write failed can stay `sending` and be re-sent after `sendingTimeout`. Compare `failedWrites` before and after to scope a shutdown.
+   * @returns {Promise<MailTimeDrainResult>}
    */
   async drain() {
     this.__debug('[drain]');
     if (this.__pool) {
       await this.__pool.drain();
     }
+    return { failedWrites: this.__failedWrites };
+  }
+
+  /**
+   * @internal
+   * @memberOf MailTime
+   * @name ___reportWriteFailure
+   * @description Count a failed completion step (a storage write that threw, an exception raised inside the completion path, or an outcome write lost after a claim-renewal error) and surface it once through `onError(error, task, { phase })`. Never throws. After a non-draining `destroy()` it still counts but skips the log and the hook.
+   * @param {MailTimeTask} task
+   * @param {unknown} error
+   * @param {'complete' | 'checkpoint'} [phase]
+   * @returns {void}
+   */
+  ___reportWriteFailure(task, error, phase = 'complete') {
+    this.__failedWrites++;
+    if (this.__abortInFlight) {
+      return;
+    }
+    logError(`[private send] completion error, ${phase} write failed; row ${task?.uuid} may stay claimed and be re-sent after sendingTimeout`, error);
+    callHook('onError', this.onError, error, task || null, { phase, attempt: task?.tries, transportIndex: task?.transport });
   }
 
   /**
@@ -3431,7 +3697,7 @@ class MailTime {
    * @description add email to the queue or append to existing letter if {concatEmails: true}
    * @param {MailTimeMailOptions} opts - email options
    * @returns {Promise<string>} uuid of the email
-   * @throws {Error}
+   * @throws {Error} missing `html`/`text`, a `raw` field, or an invalid `to`; with `recipientPolicies`, an unparseable address rejects with `error.code === 'MAIL_TIME_INVALID_ADDRESS'` and `error.field` naming the field (header recipients are skipped when `envelope.to` is explicit)
    */
   async sendMail(opts) {
     opts = (opts && typeof opts === 'object') ? opts : {};
@@ -3465,6 +3731,10 @@ class MailTime {
       throw new Error('[mail-time] [sendMail] `mailOptions.to` is required and must be a string or non-empty Array');
     }
 
+    if (this.__recipientPolicies) {
+      validatePolicyMailOptions(mailOptions);
+    }
+
     if (this.concatEmails) {
       sendAt = sendAt + this.concatDelay;
       const task = await this.queue.getPendingTo(mailOptions.to, sendAt);
@@ -3546,21 +3816,15 @@ class MailTime {
     if (task.tries >= this.maxTries) {
       this.___finalizeRejected(task, info);
 
-      const leaseRemove = __leaseRemoveOpts(task);
-      const leaseUpdate = __withLease(task, {
-        isSent: false,
-        isFailed: true,
-        isSending: false,
-        sendingAt: 0,
-        mailOptions: task.mailOptions,
-      });
-
-      let finalized = false;
-      if (!this.keepHistory) {
-        finalized = await this.queue.remove(task, leaseRemove);
-      } else {
-        finalized = await this.queue.update(task, leaseUpdate);
-      }
+      const finalized = await this.___outcomeWrite(task, (t) => (!this.keepHistory
+        ? this.queue.remove(t, __leaseRemoveOpts(t))
+        : this.queue.update(t, __withLease(t, {
+          isSent: false,
+          isFailed: true,
+          isSending: false,
+          sendingAt: 0,
+          mailOptions: task.mailOptions,
+        }))));
 
       if (!finalized) {
         this.__debug('[private handleError] lease lost before final failure update, skipping onError', task.uuid);
@@ -3586,12 +3850,12 @@ class MailTime {
       transportIndex = this.___nextHealthyTransport(transportIndex);
     }
 
-    const released = await this.queue.update(task, __withLease(task, {
+    const released = await this.___outcomeWrite(task, (t) => this.queue.update(t, __withLease(t, {
       isSending: false,
       sendingAt: 0,
       sendAt: Date.now() + this.retryDelay,
       transport: transportIndex,
-    }));
+    })));
 
     if (!released) {
       this.__debug('[private handleError] lease lost before retry release, skipping', task.uuid);
@@ -3993,6 +4257,10 @@ class MailTime {
         }));
       } catch (renewError) {
         logError('[private renewClaim] storage error during claim renewal', renewError);
+        // Storage may have applied the write before the driver failed; remember the stamp
+        // so the outcome write can retry with it (see ___outcomeWrite).
+        // A stale claim is remembered as null: the lost outcome write is reported, never retried.
+        this.__uncertainRenewals.set(task, task.sendingAt > renewedAt - this.sendingTimeout ? renewedAt : null);
         halt();
         return;
       }
@@ -4023,6 +4291,38 @@ class MailTime {
     return { stop };
   }
 
+  /**
+   * @async
+   * @internal
+   * @memberOf MailTime
+   * @name ___outcomeWrite
+   * @description Run a lease-guarded outcome write. `write(t)` must derive its lease guard from `t`. When the write loses the lease and an earlier claim renewal threw (storage may have applied it), retry once with that renewal's stamp; a peer takeover bumps `tries` or stamps a later `sendingAt` while the lease is live, so the retry cannot match a taken-over row. The stamp is only remembered when the lease was still live at renewal time. If the retry also fails, count and report the lost write. A claim that was already stale when the renewal threw is reported without a retry. After `destroy()` the loss is counted without hook or log. Without an earlier renewal error a lost lease stays a debug-only skip.
+   * @param {MailTimeTask} task
+   * @param {(t: MailTimeTask) => Promise<boolean>} write
+   * @returns {Promise<boolean>}
+   */
+  async ___outcomeWrite(task, write) {
+    if (await write(task)) {
+      this.__uncertainRenewals.delete(task);
+      return true;
+    }
+    const attempted = this.__uncertainRenewals.get(task);
+    if (attempted === void 0) {
+      return false;
+    }
+    this.__uncertainRenewals.delete(task);
+    const lost = new Error('outcome write lost (renewal outcome uncertain or lease taken over)');
+    if (attempted === null || this.__abortInFlight) {
+      this.___reportWriteFailure(task, lost, 'complete');
+      return false;
+    }
+    if (await write({ ...task, sendingAt: attempted })) {
+      return true;
+    }
+    this.___reportWriteFailure(task, lost, 'complete');
+    return false;
+  }
+
   /** @internal Serialize every policy checkpoint with this attempt's claim renewal. */
   async ___sendWithRecipientPolicies(task) {
     if (!task || task.isSent || task.isFailed || task.isCancelled || task.isSettled || this.__abortInFlight) return;
@@ -4037,9 +4337,12 @@ class MailTime {
     }
     Object.assign(task, fields);
     const lease = new RecipientPolicyLease({
-      task, queue: this.queue, interval: this.renewClaim, maxRenewals: this.maxRenewals,
+      task, queue: this.queue, interval: this.renewClaim, maxRenewals: this.maxRenewals, sendingTimeout: this.sendingTimeout,
       shouldAbort: () => this.__abortInFlight,
-      report: (error) => logError('[recipientPolicies] lease persistence failed', error),
+      report: (error, phase) => {
+        if (phase === 'complete' || phase === 'checkpoint') this.___reportWriteFailure(task, error, phase);
+        else if (!this.__abortInFlight) logError('[recipientPolicies] claim renewal write failed; renewals stop, the outcome write still runs', error);
+      },
     });
     try {
       if (!lease.active) return;
@@ -4095,7 +4398,15 @@ class MailTime {
       context.recipients = context.recipients.filter((r) => eligible.has(r.address));
       await this.___attemptPolicyTransport(task, lease, compiled, context);
     } catch (error) {
-      if (lease.active) await this.___retryPolicyTask(task, lease, error, void 0, true, true);
+      if (!lease.active) return;
+      if (isAddressError(error)) {
+        // Unparseable addresses fail identically on every attempt, so settle now instead of
+        // spending the retry budget. The message names the field, never the address.
+        if (!this.__abortInFlight) logError(`[recipientPolicies] task ${task.uuid} failed without retry:`, error.message);
+        await this.___completePolicyTask(task, lease, error, void 0, true);
+      } else {
+        await this.___retryPolicyTask(task, lease, error, void 0, true, true);
+      }
     } finally {
       await lease.stop();
     }
@@ -4104,7 +4415,7 @@ class MailTime {
   /** @internal Persist SMTP acceptance before awaiting rejection classification or observation. */
   async ___attemptPolicyTransport(task, lease, compiled, context) {
     const transport = this.transports[context.transport.index];
-    const outgoing = { ...compiled, envelope: context.envelope };
+    const outgoing = { ...rewritePolicyHeaders(compiled), envelope: context.envelope };
     const { error, info } = await new Promise((resolve) => {
       let called = false;
       const done = (error, info) => {
@@ -4312,6 +4623,7 @@ class MailTime {
       task.tries = tries;
       task.isSending = true;
       task.sendingAt = sendingAt;
+      this.__uncertainRenewals.delete(task);
 
       let transportIndex = task.transport;
       if (!this.___isHealthyTransport(transportIndex)) {
@@ -4365,20 +4677,14 @@ class MailTime {
               if (isFullyDelivered) {
                 this.__debug(`email successfully sent, attempts: #${task.tries}, transport #${transportIndex} to: `, compiledOpts.to);
 
-                const leaseRemove = __leaseRemoveOpts(task);
-                const leaseUpdate = __withLease(task, {
-                  isSent: true,
-                  isSending: false,
-                  sendingAt: 0,
-                  mailOptions: task.mailOptions,
-                });
-
-                let completed = false;
-                if (!this.keepHistory) {
-                  completed = await this.queue.remove(task, leaseRemove);
-                } else {
-                  completed = await this.queue.update(task, leaseUpdate);
-                }
+                const completed = await this.___outcomeWrite(task, (t) => (!this.keepHistory
+                  ? this.queue.remove(t, __leaseRemoveOpts(t))
+                  : this.queue.update(t, __withLease(t, {
+                    isSent: true,
+                    isSending: false,
+                    sendingAt: 0,
+                    mailOptions: task.mailOptions,
+                  }))));
 
                 if (!completed) {
                   this.__debug('[private send] lease lost before success completion, skipping onSent', task.uuid);
@@ -4396,21 +4702,15 @@ class MailTime {
               if (task.tries >= this.maxTries) {
                 this.___finalizeRejected(task, info);
 
-                const leaseRemove = __leaseRemoveOpts(task);
-                const leaseUpdate = __withLease(task, {
-                  isSent: false,
-                  isFailed: true,
-                  isSending: false,
-                  sendingAt: 0,
-                  mailOptions: task.mailOptions,
-                });
-
-                let finalized = false;
-                if (!this.keepHistory) {
-                  finalized = await this.queue.remove(task, leaseRemove);
-                } else {
-                  finalized = await this.queue.update(task, leaseUpdate);
-                }
+                const finalized = await this.___outcomeWrite(task, (t) => (!this.keepHistory
+                  ? this.queue.remove(t, __leaseRemoveOpts(t))
+                  : this.queue.update(t, __withLease(t, {
+                    isSent: false,
+                    isFailed: true,
+                    isSending: false,
+                    sendingAt: 0,
+                    mailOptions: task.mailOptions,
+                  }))));
 
                 if (!finalized) {
                   this.__debug('[private send] lease lost before partial-failure completion, skipping onError', task.uuid);
@@ -4435,19 +4735,19 @@ class MailTime {
               }
 
               const nextSendAt = Date.now() + this.retryDelay;
-              const released = await this.queue.update(task, __withLease(task, {
+              const released = await this.___outcomeWrite(task, (t) => this.queue.update(t, __withLease(t, {
                 isSending: false,
                 sendingAt: 0,
                 sendAt: nextSendAt,
                 mailOptions: task.mailOptions,
-              }));
+              })));
               if (!released) {
                 this.__debug('[private send] lease lost before partial retry release', task.uuid);
                 return;
               }
               this.__debug(`[private send] Partial delivery, next attempt at ${new Date(nextSendAt)}: #${task.tries}/${this.maxTries} for remaining recipients`);
             } catch (completionError) {
-              logError('[private send] completion error after transport callback', completionError);
+              this.___reportWriteFailure(task, completionError);
             } finally {
               resolve();
             }
@@ -4463,7 +4763,11 @@ class MailTime {
         return;
       }
       logError('Exception during runtime:', e);
-      await this.___handleError(task, e, {});
+      try {
+        await this.___handleError(task, e, {});
+      } catch (completionError) {
+        this.___reportWriteFailure(task, completionError);
+      }
     }
   }
 
@@ -4479,6 +4783,9 @@ class MailTime {
     if (this.__isDestroyed || this.__isPaused) {
       return;
     }
+    // Under `strategy: 'backup'` a quarantined primary is never selected for a send, so the
+    // send path alone would never re-probe it. Sweep here so recovery does not depend on row flow.
+    for (const index of this.__unhealthyTransports) this.___maybeReprobe(index);
     const limit = this.mode === 'one' ? 1 : Infinity;
     this.__schedulerScans++;
     try {
@@ -4525,51 +4832,183 @@ class MailTime {
    * @internal
    * @memberOf MailTime
    * @name ___verifyTransports
-   * @description Probe each transport's `verify()` once at startup. Failing transports are marked unusable and skipped during rotation; the failure is surfaced through `onError(error, null, { transportIndex, phase: 'verify' })`. Throws if every transport fails — there is nothing left that could deliver.
+   * @description Probe each transport's `verify()` once at startup, in parallel. A transport whose probe fails is quarantined (skipped during rotation) and reported through `onError(error, null, { transportIndex, phase: 'verify' })`. A probe that neither settles nor fails within `verifyTimeout` stops delaying `ready()` and leaves the transport usable; a verdict that arrives later still applies. Throws if every transport is quarantined.
    * @returns {Promise<void>}
    */
   async ___verifyTransports() {
     this.__debug('[private verifyTransports]');
-    const results = await Promise.all(this.transports.map(async (transport, index) => {
+    await Promise.all(this.transports.map(async (transport, index) => {
       if (!transport || typeof transport.verify !== 'function') {
-        return { index, ok: true };
+        return;
+      }
+      const outcome = await this.___verifyOne(transport, index);
+      if (outcome === 'timeout' && !this.__isDestroyed) {
+        console.warn(`[WARN] [mail-time] [verifyTransports] transport #${index} verify() gave no verdict within ${this.verifyTimeout}ms; keeping it usable, a late verdict still applies`);
       }
+    }));
+
+    if (this.__unhealthyTransports.size === this.transports.length) {
+      throw new Error(`[mail-time] [MailTime#ready] all ${this.transports.length} transport(s) failed verification — nothing can be delivered`);
+    }
+  }
+
+  /**
+   * @internal
+   * @memberOf MailTime
+   * @name ___verifyOne
+   * @description Start one `transport.verify(callback)` probe bounded by `verifyTimeout`. A callback is always passed. The first of the callback, a returned thenable, a synchronous throw, or a synchronous `true`/`false` decides the verdict. `false` is what Nodemailer's `Mailer#verify` returns, without calling back, when the underlying transport has no `verify` method. Any other synchronous non-thenable return value (for example the timer handle an expression-bodied arrow returns) is ignored, so a callback that reports an error later still counts, and a verify that never calls back waits for the timeout. The verdict is applied through `___applyVerdict` even when it arrives after the timeout, guarded by a per-transport generation. Resolves `'ok'`, `'fail'`, or `'timeout'` (the wait ended without a verdict or the instance was destroyed).
+   * @param {MailTimeTransport} transport
+   * @param {number} index
+   * @returns {Promise<'ok' | 'fail' | 'timeout'>}
+   */
+  ___verifyOne(transport, index) {
+    const gen = (this.__verifyGen[index] || 0) + 1;
+    this.__verifyGen[index] = gen;
+    return new Promise((resolve) => {
+      let decided = false;
+      let waiting = true;
+      const stopWaiting = (outcome) => {
+        if (!waiting) {
+          return;
+        }
+        waiting = false;
+        clearTimeout(timer);
+        this.__probeCancels.delete(cancel);
+        resolve(outcome);
+      };
+      const cancel = () => stopWaiting('timeout');
+      const timer = setTimeout(cancel, this.verifyTimeout);
+      if (typeof timer.unref === 'function') {
+        timer.unref();
+      }
+      this.__probeCancels.add(cancel);
+
+      const decide = (error) => {
+        if (decided) {
+          return;
+        }
+        decided = true;
+        this.___applyVerdict(index, gen, error);
+        stopWaiting(error ? 'fail' : 'ok');
+      };
+
       try {
-        await Promise.resolve(transport.verify());
-        return { index, ok: true };
+        const returned = transport.verify((error) => decide(error || void 0));
+        if (returned && typeof returned.then === 'function') {
+          returned.then(() => decide(), (error) => decide(error || new Error('[mail-time] [verifyTransports] verify() rejected')));
+        } else if (returned === true || returned === false) {
+          decide();
+        }
       } catch (error) {
-        return { index, ok: false, error };
+        decide(error || new Error('[mail-time] [verifyTransports] verify() threw'));
       }
-    }));
+    });
+  }
 
-    for (const r of results) {
-      if (r.ok) {
-        continue;
+  /**
+   * @internal
+   * @memberOf MailTime
+   * @name ___applyVerdict
+   * @description Apply a probe verdict to the health state. Ignored after `destroy()` and when a newer probe of the same transport has started (generation guard). Success removes the transport from quarantine. Failure quarantines it and fires `onError` once per quarantine episode; a failure for an already quarantined transport releases its re-probe slot and doubles the backoff.
+   * @param {number} index
+   * @param {number} gen
+   * @param {unknown} [error]
+   * @returns {void}
+   */
+  ___applyVerdict(index, gen, error) {
+    if (this.__isDestroyed || this.__verifyGen[index] !== gen) {
+      return;
+    }
+    const quarantined = this.__unhealthyTransports.has(index);
+    if (!error) {
+      if (!quarantined) {
+        return;
       }
-      this.__unhealthyTransports.add(r.index);
-      logError(`[mail-time] [verifyTransports] transport #${r.index} failed verification`, r.error);
-      callHook('onError', this.onError, r.error, null, { transportIndex: r.index, phase: 'verify' });
+      this.__unhealthyTransports.delete(index);
+      this.__reprobe.delete(index);
+      if (this.strategy === 'backup' && index < this.transport) {
+        this.transport = index;
+      }
+      console.log(`[mail-time] [verifyTransports] transport #${index} recovered; back in rotation`);
+      return;
     }
-
-    if (this.__unhealthyTransports.size === this.transports.length) {
-      throw new Error(`[mail-time] [MailTime#ready] all ${this.transports.length} transport(s) failed verification — nothing can be delivered`);
+    if (quarantined) {
+      const st = this.__reprobe.get(index);
+      // A slot already released by the timeout path keeps its backoff; do not double it twice.
+      if (st && st.inFlight) this.___backoffReprobe(index, st, 'failed');
+      return;
     }
+    this.__unhealthyTransports.add(index);
+    this.__reprobe.set(index, { count: 0, nextProbeAt: Date.now() + REPROBE_BASE_MS, inFlight: false });
+    if (this.transport === index && this.__unhealthyTransports.size < this.transports.length) {
+      this.transport = this.___nextHealthyTransport(index);
+    }
+    logError(`[mail-time] [verifyTransports] transport #${index} failed verification`, error);
+    callHook('onError', this.onError, error, null, { transportIndex: index, phase: 'verify' });
+  }
 
-    if (this.__unhealthyTransports.has(this.transport)) {
-      this.transport = this.___nextHealthyTransport(this.transport);
+  /**
+   * @internal
+   * @memberOf MailTime
+   * @name ___maybeReprobe
+   * @description Start one background `verify()` probe for a quarantined transport when its backoff has elapsed and no probe is in flight. Never awaited by the send path. Backoff starts at 60 s, doubles per failed or timed-out probe and caps at 15 min. A probe that reaches `verifyTimeout` without a verdict releases the slot (one `verify()` may then overlap with the hung one); its late verdict still applies unless a newer probe has started. Failures only reach `__debug`. No probes for `type: 'client'`, `verifyTransports: false`, or after `destroy()`.
+   * @param {number} index
+   * @returns {void}
+   */
+  ___maybeReprobe(index) {
+    if (this.__isDestroyed || this.type !== 'server' || !this.verifyTransports) {
+      return;
+    }
+    const st = this.__reprobe.get(index);
+    const transport = this.transports[index];
+    if (!st || st.inFlight || st.nextProbeAt > Date.now() || !transport || typeof transport.verify !== 'function') {
+      return;
     }
+    st.inFlight = true;
+    this.__debug(`[private reprobe] transport #${index}, attempt after ${st.count} failure(s)`);
+    // A verdict releases `inFlight` (see ___applyVerdict). A probe that reaches `verifyTimeout`
+    // without one counts as a failed attempt so a verify() that never settles cannot pin the
+    // transport in quarantine; its late verdict still applies unless a newer probe has started.
+    this.___verifyOne(transport, index).then((outcome) => {
+      // A live verdict always clears `inFlight` in ___applyVerdict. If it is still set, the probe
+      // timed out or its verdict was ignored (superseded generation); either way free the slot.
+      if (st.inFlight && this.__reprobe.get(index) === st) {
+        this.___backoffReprobe(index, st, outcome === 'timeout' ? 'timed out' : 'superseded');
+      }
+    });
+  }
+
+  /**
+   * @internal
+   * @memberOf MailTime
+   * @name ___backoffReprobe
+   * @description Release a re-probe slot after a failed or timed-out probe and double its backoff (cap 15 min).
+   * @param {number} index
+   * @param {{ count: number, nextProbeAt: number, inFlight: boolean }} st
+   * @param {string} why
+   * @returns {void}
+   */
+  ___backoffReprobe(index, st, why) {
+    st.inFlight = false;
+    st.count++;
+    st.nextProbeAt = Date.now() + Math.min(REPROBE_BASE_MS * Math.pow(2, st.count), REPROBE_MAX_MS);
+    this.__debug(`[private reprobe] transport #${index} ${why}, next probe at ${new Date(st.nextProbeAt)}`);
   }
 
   /**
    * @internal
    * @memberOf MailTime
    * @name ___isHealthyTransport
-   * @description Return true when the transport at `index` has not been marked unusable by verification.
+   * @description Return true when the transport at `index` is not quarantined. A quarantined transport whose backoff has elapsed triggers a background re-probe; this call still returns false.
    * @param {number} index
    * @returns {boolean}
    */
   ___isHealthyTransport(index) {
-    return !this.__unhealthyTransports.has(index);
+    if (!this.__unhealthyTransports.has(index)) {
+      return true;
+    }
+    this.___maybeReprobe(index);
+    return false;
   }
 
   /**