- Shipped
- September 6, 2026 at 11:55 PM UTC
- Author
- Kamo
- Commit
- 359d620
An IMAP IDLE listener is the only thing that notices a message arriving; it publishes email.inbox.<addr>, which is what eventually asks MediaService to buzz a phone. Those listeners were started by a browser subscribing over the mail WebSocket and closed when the last tab went — so a mailbox was observed only while somebody was already looking at it. With no browser open nothing watched the inbox, nothing published, and the phone was never told. Members reported that the only way to discover new mail was to open the inbox and look, which was exactly right: there was no other way it could have reached them. IDLE ownership therefore stops being a property of one WebSocket session. MailboxIdleService holds the listeners and counts who wants each mailbox watched; MobileMailboxWatcher retains one on behalf of any member with a listener down with it. A mailbox can now legitimately be watched twice across the cluster — here and by a browser's listener on the other pod — and each listener reports the same arrival. MobileMailPushSender recognises the repeat from the message's own identity and buzzes once; its collapse key was System.nanoTime(), unique per publish rather than per message, which would have made two listeners look like two messages to every gate downstream. Coordinating the listeners instead would mean a lease, and a lease held by a pod whose listener has quietly died is a mailbox nobody is watching — the failure this exists to prevent.