diff --git a/MailFolder.cpp b/MailFolder.cpp
index c206ce8..45f004c 100644
--- a/MailFolder.cpp
+++ b/MailFolder.cpp
@@ -1,4 +1,5 @@
 #include "MailFolder.h"
+#include "Log.h"
 #include <algorithm>
 #include <ctime>
 #include <fstream>
@@ -47,6 +48,15 @@ namespace mail {
       void writeCounterFile(const std::string &path, uint32_t value) {
          std::ofstream out(path, std::ios::trunc);
          out << value;
+         // ofstream doesn't throw on a failed open (e.g. a permissions
+         // problem, a full/read-only filesystem) - confirmed live: two
+         // pre-existing mailbox index files were root-owned mode 644
+         // while the mail service runs as a non-root user, so every
+         // counter/flag persist attempt failed here completely silently
+         // for weeks. Logging it is the only way this becomes visible
+         // instead of just quietly not happening.
+         if (!out)
+            coreutils::Log(coreutils::LOG_EXCEPT) << "MailFolder: failed to write " << path << " - check ownership/permissions.";
       }
 
    }
@@ -160,9 +170,15 @@ namespace mail {
       writeCounterFile(path + "/.uidvalidity", mUidValidity);
       writeCounterFile(path + "/.uidnext", mUidNext);
       std::ofstream out(path + "/.imapindex", std::ios::trunc);
+      if (!out) {
+         coreutils::Log(coreutils::LOG_EXCEPT) << "MailFolder: failed to open " << path << "/.imapindex for writing - flag/message changes will not persist. Check ownership/permissions.";
+         return;
+      }
       for (const Message &message : mMessages)
          out << message.fileName << " " << message.uid << " " << (long long)message.internalDate
              << " " << joinFlags(message.flags) << "\n";
+      if (!out)
+         coreutils::Log(coreutils::LOG_EXCEPT) << "MailFolder: write to " << path << "/.imapindex failed partway through - index may be incomplete.";
    }
 
    uint32_t MailFolder::seq(uint32_t uid) const {