cairn/log/2026-08-11-imap-sasl-ir-override.md
Himalaya accounts gained imap.sasl-ir, forcing the RFC 4959 initial response on or off for every SASL mechanism. Unset (the default) keeps following the advertised SASL-IR capability, false waits for the server's continuation request instead of inlining credentials with AUTHENTICATE, and true always inlines.
Fixes pimalaya/himalaya#729: Coremail (NetEase 126.com and 163.com) advertises SASL-IR and then answers the inline form with BAD Request not ending with, so those accounts could not authenticate at all. Because the capability itself is false, the client has no signal of its own to correct with, which is why this is an explicit option rather than detection. It follows imap.sort.fallback, the existing override of the same shape. The option sits on imap rather than under imap.sasl, both because imap.sasl is an externally-tagged mechanism enum with deny_unknown_fields (a sibling key there would be read as a seventh mechanism) and because the defect is in the server's command parser, not in one mechanism.
Deliberately not done: no automatic retry on a tagged BAD (it would re-send credentials after a failure and only helps servers that answer BAD rather than BYE), and nothing for SMTP (RFC 4954 section 4 puts the optional initial response in the AUTH grammar itself, so there is no capability to advertise or misadvertise; io-smtp always inlines and never consults EHLO for it).
Upstream io-imap: the client connect now takes an options struct carrying starttls, auto-ID and the new SASL-IR override, replacing the tail of positional arguments it had accumulated. Breaking for io-imap, which stays unpublished on 0.4 for now, so himalaya reaches it through the patch git override.
Also fixed, unrelated and pre-existing: the pimdir backend test building an envelope from meta was stale since the public id moved to seq (pimdir-public-id). It built an item without the seq field io-pimdir now carries, and expected the envelope id to be the link id rather than the seq.
Verified: build, fmt and clippy clean on both crates; io-imap's 207 tests pass and himalaya's 84 pass. Not verified against a live Coremail account, having none.
Spec updated: provider-quirks (ADDED: SASL-IR capability is overridable, Coremail advertises SASL-IR falsely).